Privacy policy

This policy explains what personal data <CẦN XÁC NHẬN: company legal name> ("we") collects when you use Märkte & Feste, why, and what you can do about it. If anything is unclear, write to <CẦN XÁC NHẬN: support email>.

Who is responsible

<CẦN XÁC NHẬN: company legal name>, <CẦN XÁC NHẬN: company address>, is the controller of the personal data described here. For data that your organization puts into the product (for example the work you store in it), your organization is the controller and we process it on its behalf.

What we collect

Account: your email address and name. If you sign in with Google, also your Google profile picture and account identifier.
Organizations: the organizations you create or join, your role in them, invitations you send (the invitee's email address) and a log of changes made in the organization (who did what, and when).
Content: whatever you and your team enter into the product.
Security data: your IP address and browser details when you sign in, kept with your session; IP-based counters that limit abuse, deleted after one day; a one-way hash of email addresses we send sign-in links or invitations to, deleted after two days.
Billing: payments are handled by <CẦN XÁC NHẬN: payment provider>, our reseller. We receive your plan, its status and renewal dates, and the provider's customer identifier. We never see or store card numbers.
Cookies: one cookie that keeps you signed in. We do not use advertising or tracking cookies.

Why we use it

To provide the product you signed up for: sign-in, organizations, invitations, billing (performance of our contract with you).
To keep the service secure and stop abuse, such as limiting how often sign-in links can be requested (our legitimate interest).
To send emails you need: sign-in links, invitations and important account notices. We do not send marketing email without your consent.
To meet legal obligations, such as tax and accounting records kept by our payment provider.

Who processes it for us

We use these service providers, each bound to protect the data and use it only for us:

Cloudflare — hosting, network and security.
Neon — database, hosted in the United States (AWS us-east-1).
Resend — sending email.
<CẦN XÁC NHẬN: payment provider> — payments, invoices and sales tax, as merchant of record.
Google — only if you choose to sign in with Google.

We do not sell or rent personal data, and we do not share it for advertising.

International transfers

Our data is stored in the United States. When data from the European Economic Area, the United Kingdom or Switzerland is transferred there, we rely on <CẦN XÁC NHẬN: transfer safeguard, e.g. the providers' Standard Contractual Clauses>.

How long we keep it

Account data: while your account exists. You can delete your account yourself from your profile (we email a confirmation link); it is removed as soon as you confirm.
Organization data: while the organization exists. When its owner deletes it, or deletes their account while being its only owner, nobody can use it any more and it is removed for good after 30 days.
What the law requires us to keep (for example invoices, kept by our payment provider) stays for the period the law sets.
Security counters: one day. Email-sending records: two days. Expired sign-in links and invitations: removed automatically.
Backups: <CẦN XÁC NHẬN: backup retention period>.

Your rights

Depending on where you live (for example under the GDPR, UK GDPR or California law), you can ask to see, correct, export or delete your personal data, and object to or restrict how we use it. You can download your data and delete your account yourself from your profile; for anything else write to <CẦN XÁC NHẬN: support email>; we answer within 30 days. You can also complain to your local data protection authority.

Children

Märkte & Feste is not meant for anyone under 16, and we do not knowingly collect their data.

Changes

When we change this policy we update the date at the top. If a change is significant, we tell account owners by email before it takes effect.