Privacy Policy

Last updated: [DATE]. Draft template — have it reviewed before going live.

1. Controller

[COMPANY LEGAL NAME], [ADDRESS], Cyprus — [PRIVACY EMAIL] — is the controller of your personal data under the EU General Data Protection Regulation (GDPR).

2. What we process and why

• Account data (username, email, password hash, display name, avatar, account type) — to provide the service (contract, Art. 6(1)(b)).
• Google sign-in data (Google ID, name, email, profile picture) — only if you choose Google login (contract).
• Content you post (notes, images, videos, comments, likes, follows, hashtags) — to provide the service (contract).
• Order and membership data (orders, coupons used, membership validity) — contract and legal obligations (tax/accounting, Art. 6(1)(c)).
• Technical data (IP address in security logs and rate-limiting records, browser data in server logs) — legitimate interest in security and abuse prevention (Art. 6(1)(f)); retained max. 24 hours for rate limiting and [X] days for server logs.
• Emails we send (verification, password reset) — contract.

3. Recipients

Hosting: GoDaddy (server location: [EU/US — check your hosting plan]). Google (only for Google sign-in). Embedded live streams load from YouTube/Vimeo/Twitch when you open the Live page. We do not sell personal data and use no advertising trackers.

4. Retention

Account data is kept until you delete your account (Settings → Danger zone), which permanently removes your content and files. Order records are kept for the retention period required by Cyprus tax law ([6] years). Security logs: see above.

5. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. Contact [PRIVACY EMAIL]. You may lodge a complaint with the Commissioner for Personal Data Protection of Cyprus (dataprotection.gov.cy) or your local supervisory authority.

6. Children

The service is not directed at children under 14. In line with the Cyprus implementation of GDPR Art. 8, users must be at least 14.

7. Security

Passwords are stored hashed (bcrypt), connections are encrypted (HTTPS), uploads are validated, and access to data is restricted. No system is 100% secure; we will notify you and the authority of breaches where required by Art. 33–34 GDPR.