Privacy notice
Draft for legal review. Last edited 6 October 2026. Written for an EU subscription service and not yet reviewed by a lawyer; details in [square brackets] are still to be filled in. It must be reviewed and approved before any paid plan is sold.
Who is responsible
The controller of your personal data is BHNV LTD, Georgiou Griva Digeni 43, Floor 2, Limassol, 3106, Cyprus. Contact: [privacy contact email]. Data protection officer: [appointed / not required — reviewer to confirm].
What we record, and why
- Your account: your email address and, if you give it, your name — to sign you in and to provide the service (contract).
- Your second factor: if you switch on two-factor sign-in, a secret shared with your authenticator app, held by our authentication provider — to protect your account (contract and legitimate interest).
- Billing details: the name, address and phone number our payment provider requires for a card payment, and a billing email if you set one — to take payment (contract), and payment records to meet accounting law (legal obligation).
- Your card: we never see or store your card number. Our payment provider handles it, and keeps a token that lets us charge your renewals; we store that token and nothing else about the card.
- Your sites: the web addresses you ask us to look after — to provide the service (contract).
- Messages you send us: what you write in the contact form, with your name, email address and website if you give one, is emailed to our own mailbox so a person can reply — to answer you (legitimate interest). It is not stored on the website.
- Stopping abuse of the contact form: a one-way scrambled form of your network address and the time you sent, never the message, kept for at most a day so the form cannot be used to flood us. The scrambling changes every day, so it cannot link your visits across days (legitimate interest).
We do not use analytics or advertising trackers, and we do not sell personal data.
Who processes it for us
- Supabase — our database and sign-in, hosted in the European Union (Ireland).
- Vercel — hosts the website; requests are served from the European Union (Ireland).
- Resend — sends our emails: sign-in links, receipts, billing notices, and contact-form messages to our mailbox.
- Hostinger — hosts our mailbox, where contact-form messages and replies are kept.
- Trezuz — our payment provider, which processes card payments and holds your card details.
Where a provider is established outside the EU, transfers are covered by [the EU Standard Contractual Clauses / an adequacy decision — reviewer to confirm per provider].
How long we keep it
Your account data for as long as you have an account. Payment records for [retention period required by accounting law], even after you delete your account, because the law requires it. Everything else is deleted when you delete your account.
Your rights
You can ask for a copy of your data, to have it corrected or deleted, to restrict or object to how it is used, and to receive it in a portable format. Write to [privacy contact email]. You can also complain to the Office of the Commissioner for Personal Data Protection (Cyprus).
Cookies
Only those needed to keep you signed in. See the cookie notice.