Privacy Policy

1. Information We Collect

We collect the following categories of data:

• Account information: your email address, name (if provided), and a hashed (encrypted) password. We never store passwords in plaintext.
• Usage and technical data: your IP address, browser type and version, device information, pages visited, and interaction with the Service.
• Cookies and similar technologies: we use cookies, local storage, and similar technologies for authentication, security, and analytics. We may also use browser fingerprinting signals to prevent fraud and abuse.
• Communication data: information you provide when contacting support, such as your name, email address, and message content.
• Payment data: we do not store your credit card or other financial details on our servers (see Section 3).

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service, including account creation, authentication, and email delivery;
• Process payments and manage subscriptions through our payment processors;
• Prevent fraud, abuse, and security incidents, and protect the safety of our users;
• Provide customer support and respond to your inquiries;
• Improve and personalize the Service, and comply with legal obligations.

We do not sell your personal information to third parties.

3. Payment Processing & PCI-DSS Compliance

We do not store your credit card or financial detailed data on our servers. All payments are securely processed through our third-party payment processor, Stripe, in compliance with PCI-DSS standards.

Depending on the payment channel you choose, payments may also be processed through our alternative processor, Creem. Both processors are PCI-DSS compliant, and your card details are entered and processed exclusively on their secured payment pages, never on our servers.

4. Cookies & Tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used. You can control or disable cookies through your browser settings; however, some features of the Service may not function properly without them.

See our Cookie Policy for more details.

5. Data Sharing & Third Parties

We share personal information only with trusted service providers who process it on our behalf, including:

• Payment processors (Stripe, Creem) — to process payments;
• Hosting and infrastructure providers — to operate the Service;
• Email delivery providers — to send emails on your behalf;
• Authorities — where required by law or to protect our legal rights.

6. International Data Transfers

Your personal information may be processed in countries other than your own. Where we transfer personal data from the EEA or the UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, to ensure that your data receives an adequate level of protection.

7. Your Data Rights (GDPR & CCPA)

Subject to applicable law, you have the right to:

• Access: request a copy of the personal data we hold about you;
• Export (data portability): receive your personal data in a structured, machine-readable format;
• Correct: update or correct inaccurate personal data;
• Restrict or object: restrict or object to certain processing of your personal data;
• Delete (the "Right to be Forgotten"): request the complete deletion of your personal data and account records;
• Withdraw consent: withdraw any consent you previously gave us.

California residents may also exercise the rights of knowing what personal information is collected, deleting their personal information, and opting out of the sale of their personal information (we do not sell personal information).

To exercise any of these rights, email us at [email protected] with the subject "Data Request" and your account email address. We will respond within 30 days (or 45 days for California residents, as required by the CCPA). We may need to verify your identity before processing your request.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When you request deletion, we will delete or anonymize your personal data within a reasonable time, except where we are legally required to retain it (for example, for tax or anti-fraud purposes).

9. Security

We take reasonable technical and organizational measures to protect your personal information, including encryption of data in transit (TLS), hashing of passwords, and restricted access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Children's Privacy

The Service is not directed to individuals under the age of 18 (or the applicable age of majority). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes become effective when posted on this page, and the effective date is updated accordingly. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at [email protected] or through our Contact page.