# Privacy Policy # Privacy Policy Last updated: 15 September 2026 This policy explains what personal data Vladyslav Omelchenko (trade name DejaBars) collects through https://dejabars.com, why we collect it, and what rights you have. We are the controller. Contact for anything in this policy: privacy@dejabars.com ## 1. What we collect | Data | Why | Basis | |---|---|---| | Account name, email, optional phone | Create and secure your account, contact you about it | Contract | | Password (stored only as a bcrypt hash) | Authenticate you | Contract | | Age confirmation and its timestamp | Keep users under 18 out of the Service | Legal obligation (age assurance) | | Terms and Privacy acceptance, version and timestamp, IP address and user agent | Prove what you accepted and when | Legal obligation (accountability) | | Searches: pattern, timeframe, mode, filters, results, report links | Run the search, keep your history, show your reports | Contract | | Uploaded chart images and text descriptions used to generate a pattern | Produce the pattern you asked for | Contract | | Support messages, tickets, inbound and outbound email | Answer you and keep a record of the request | Contract / legitimate interest | | Server and security logs | Keep the Service secure and diagnose faults | Legitimate interest | | Analytics events (only after consent) | Understand which features are used | Consent | We do not sell personal data and we do not use it for advertising. ## 2. Age The Service is for users aged 18 and over. Registration asks you to confirm that you are at least 18; if you do not, we do not create the account. If we learn that an account belongs to someone under 18, we close it. ## 3. Who processes data with us These providers process personal data on our behalf, under contract, and only for the purposes listed: | Provider | Purpose | Location | |---|---|---| | Paddle.com Market Ltd | Merchant of record: payments, invoices, subscription billing and payment support | United Kingdom / European Union | | Zoho Mail | Hosting our mailboxes, including support@ and privacy@ | European Union | | Cloudflare Turnstile | Bot protection on registration, login and search. Receives your IP address and browser signals | Global edge network | | Google (Gemini API) | Generating a pattern from your text description or uploaded image | European Union / United States | | Google Analytics | Aggregate usage statistics, loaded only after you consent | European Union / United States | | Our hosting provider | Servers, database and backups in a European data centre | European Union | Google and Cloudflare operate under safeguards recognised for transfers from the EU, including the EU–US Data Privacy Framework and standard contractual clauses. Zoho Mail and our hosting provider process data inside the European Union. We do not send your data to any other country or provider. If that changes, this policy changes first. ## 4. How long we keep data - Account data: while your account exists. Deleting your account removes or anonymises it. - Search history and reports: while your account exists, so your history stays usable. - Support mail and tickets: while your account exists, so we can see the context of past requests. - Notifications: 90 days. - Security logs: as long as needed to investigate incidents. - Billing records: as long as tax and accounting law requires, kept by Paddle and by us in minimal form. When you delete your account we anonymise the account row and purge the data you own. ## 5. Your rights You can ask us to access, correct, delete, restrict or export your data, and you can object to processing based on legitimate interest. Write to privacy@dejabars.com; we answer within one month. You can also complain to your local supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO). Two of these rights are self-service: you can download a copy of your data and delete your account yourself from your account page. ## 6. Cookies and similar storage We use a small number of cookies and browser storage entries. They are listed, with their purpose and lifetime, in the [Cookie Policy](/docs/cookie-policy). Analytics cookies are only set after you consent, and you can change or withdraw consent at any time. ## 7. Security Passwords are hashed with bcrypt. Sessions use signed, http-only cookies and CSRF tokens. Access to production data is limited. No system is perfectly secure; if a breach affects your rights we notify you and the supervisory authority as required by law. ## 8. Changes If we change how we use personal data we update this policy and, for material changes, ask you to accept the new version before you continue. ## 9. Operator details Vladyslav Omelchenko (trade name DejaBars), [[postal address to be published before launch]], Poland, VAT ID: not VAT registered. Data-protection contact: privacy@dejabars.com.