{"slug":"privacy-policy","title":"Privacy Policy","content":"# Privacy Policy\n\nLast updated: 15 September 2026\n\nThis policy explains what personal data Vladyslav Omelchenko (trade name DejaBars) collects\nthrough https://dejabars.com, why we collect it, and what rights you have. We are the controller.\n\nContact for anything in this policy: privacy@dejabars.com\n\n## 1. What we collect\n\n| Data | Why | Basis |\n|---|---|---|\n| Account name, email, optional phone | Create and secure your account, contact you about it | Contract |\n| Password (stored only as a bcrypt hash) | Authenticate you | Contract |\n| Age confirmation and its timestamp | Keep users under 18 out of the Service | Legal obligation (age assurance) |\n| Terms and Privacy acceptance, version and timestamp, IP address and user agent | Prove what you accepted and when | Legal obligation (accountability) |\n| Searches: pattern, timeframe, mode, filters, results, report links | Run the search, keep your history, show your reports | Contract |\n| Uploaded chart images and text descriptions used to generate a pattern | Produce the pattern you asked for | Contract |\n| Support messages, tickets, inbound and outbound email | Answer you and keep a record of the request | Contract / legitimate interest |\n| Server and security logs | Keep the Service secure and diagnose faults | Legitimate interest |\n| Analytics events (only after consent) | Understand which features are used | Consent |\n\nWe do not sell personal data and we do not use it for advertising.\n\n## 2. Age\n\nThe Service is for users aged 18 and over. Registration asks you to confirm that you are\nat least 18; if you do not, we do not create the account. If we learn that an account\nbelongs to someone under 18, we close it.\n\n## 3. Who processes data with us\n\nThese providers process personal data on our behalf, under contract, and only for the purposes\nlisted:\n\n| Provider | Purpose | Location |\n|---|---|---|\n| Paddle.com Market Ltd | Merchant of record: payments, invoices, subscription billing and payment support | United Kingdom / European Union |\n| Zoho Mail | Hosting our mailboxes, including support@ and privacy@ | European Union |\n| Cloudflare Turnstile | Bot protection on registration, login and search. Receives your IP address and browser signals | Global edge network |\n| Google (Gemini API) | Generating a pattern from your text description or uploaded image | European Union / United States |\n| Google Analytics | Aggregate usage statistics, loaded only after you consent | European Union / United States |\n| Our hosting provider | Servers, database and backups in a European data centre | European Union |\n\nGoogle and Cloudflare operate under safeguards recognised for transfers from the EU, including the\nEU–US Data Privacy Framework and standard contractual clauses. Zoho Mail and our hosting provider\nprocess data inside the European Union.\n\nWe do not send your data to any other country or provider. If that changes, this policy changes\nfirst.\n\n## 4. How long we keep data\n\n- Account data: while your account exists. Deleting your account removes or anonymises it.\n- Search history and reports: while your account exists, so your history stays usable.\n- Support mail and tickets: while your account exists, so we can see the context of past requests.\n- Notifications: 90 days.\n- Security logs: as long as needed to investigate incidents.\n- Billing records: as long as tax and accounting law requires, kept by Paddle and by us in\n  minimal form.\n\nWhen you delete your account we anonymise the account row and purge the data you own.\n\n## 5. Your rights\n\nYou can ask us to access, correct, delete, restrict or export your data, and you can object to\nprocessing based on legitimate interest. Write to privacy@dejabars.com; we answer within one month.\nYou can also complain to your local supervisory authority — in Poland, the President of\nthe Personal Data Protection Office (UODO).\n\nTwo of these rights are self-service: you can download a copy of your data and delete your\naccount yourself from your account page.\n\n## 6. Cookies and similar storage\n\nWe use a small number of cookies and browser storage entries. They are listed, with their purpose\nand lifetime, in the [Cookie Policy](/docs/cookie-policy). Analytics cookies are only set after you\nconsent, and you can change or withdraw consent at any time.\n\n## 7. Security\n\nPasswords are hashed with bcrypt. Sessions use signed, http-only cookies and CSRF tokens. Access\nto production data is limited. No system is perfectly secure; if a breach affects your rights we\nnotify you and the supervisory authority as required by law.\n\n## 8. Changes\n\nIf we change how we use personal data we update this policy and, for material changes, ask you to\naccept the new version before you continue.\n\n## 9. Operator details\n\nVladyslav Omelchenko (trade name DejaBars), [[postal address to be published before launch]], Poland, VAT ID: not VAT registered.\nData-protection contact: privacy@dejabars.com.\n","category":"policy","version":"21ec6bb01764","updated_at":"2026-09-16T21:05:35.271512+02:00","is_published":true}