Privacy Policy

Last updated: 15 September 2026

This policy explains what personal data Vladyslav Omelchenko (trade name DejaBars) collects

through https://dejabars.com, why we collect it, and what rights you have. We are the controller.

Contact for anything in this policy: [email protected]

1. What we collect

Data	Why	Basis
Account name, email, optional phone	Create and secure your account, contact you about it	Contract
Password (stored only as a bcrypt hash)	Authenticate you	Contract
Age confirmation and its timestamp	Keep users under 18 out of the Service	Legal obligation (age assurance)
Terms and Privacy acceptance, version and timestamp, IP address and user agent	Prove what you accepted and when	Legal obligation (accountability)
Searches: pattern, timeframe, mode, filters, results, report links	Run the search, keep your history, show your reports	Contract
Uploaded chart images and text descriptions used to generate a pattern	Produce the pattern you asked for	Contract
Support messages, tickets, inbound and outbound email	Answer you and keep a record of the request	Contract / legitimate interest
Server and security logs	Keep the Service secure and diagnose faults	Legitimate interest
Analytics events (only after consent)	Understand which features are used	Consent

We do not sell personal data and we do not use it for advertising.

The Service is for users aged 18 and over. Registration asks you to confirm that you are

at least 18; if you do not, we do not create the account. If we learn that an account

belongs to someone under 18, we close it.

These providers process personal data on our behalf, under contract, and only for the purposes

listed:

Provider	Purpose	Location
Paddle.com Market Ltd	Merchant of record: payments, invoices, subscription billing and payment support	United Kingdom / European Union
Zoho Mail	Hosting our mailboxes, including support@ and privacy@	European Union
Cloudflare Turnstile	Bot protection on registration, login and search. Receives your IP address and browser signals	Global edge network
Google (Gemini API)	Generating a pattern from your text description or uploaded image	European Union / United States
Google Analytics	Aggregate usage statistics, loaded only after you consent	European Union / United States
Our hosting provider	Servers, database and backups in a European data centre	European Union

Google and Cloudflare operate under safeguards recognised for transfers from the EU, including the

EU–US Data Privacy Framework and standard contractual clauses. Zoho Mail and our hosting provider

process data inside the European Union.

We do not send your data to any other country or provider. If that changes, this policy changes

first.

Account data: while your account exists. Deleting your account removes or anonymises it.
Search history and reports: while your account exists, so your history stays usable.
Support mail and tickets: while your account exists, so we can see the context of past requests.
Notifications: 90 days.
Security logs: as long as needed to investigate incidents.
Billing records: as long as tax and accounting law requires, kept by Paddle and by us in

minimal form.

When you delete your account we anonymise the account row and purge the data you own.

You can ask us to access, correct, delete, restrict or export your data, and you can object to

processing based on legitimate interest. Write to [email protected]; we answer within one month.

You can also complain to your local supervisory authority — in Poland, the President of

the Personal Data Protection Office (UODO).

Two of these rights are self-service: you can download a copy of your data and delete your

account yourself from your account page.

We use a small number of cookies and browser storage entries. They are listed, with their purpose

and lifetime, in the Cookie Policy. Analytics cookies are only set after you

consent, and you can change or withdraw consent at any time.

Passwords are hashed with bcrypt. Sessions use signed, http-only cookies and CSRF tokens. Access

to production data is limited. No system is perfectly secure; if a breach affects your rights we

notify you and the supervisory authority as required by law.

If we change how we use personal data we update this policy and, for material changes, ask you to

accept the new version before you continue.

Vladyslav Omelchenko (trade name DejaBars), [[postal address to be published before launch]], Poland, VAT ID: not VAT registered.

Data-protection contact: [email protected].