Privacy Policy

Effective date: October 19, 2026

1. Controller

The controller for the processing described here is Volodymyr Karabylo, Mikeladze 16, 53031 Kryvyi Rih, Ukraine. Contact for all privacy matters: hello@business-watchdog.com. We operate the Service from Ukraine; its servers and backups are located in Germany (EU).

2. Visiting the website

The pages of the public website set no cookies, except the pages with a form (Section 10), and use no analytics, tracking, advertising or social media tools, and loads no fonts or scripts from third parties. Our web server keeps no access logs. To deliver the pages, your browser sends technical data (IP address, time, requested address, browser type); it is used only to answer the request. Error logs of the application may briefly contain such data; they are rotated and overwritten automatically. Legal basis: Art. 6(1)(f) GDPR (secure and reliable operation of the website).

3. Contact form and email

When you write to us via the contact form or by email, we process your name, email address, your message and our correspondence in order to answer you. Legal basis: Art. 6(1)(b) GDPR where the request concerns a contract, otherwise Art. 6(1)(f) GDPR. Messages from the contact form are deleted one year after the request is closed; emails are kept as long as needed for the matter and statutory retention.

4. Free store check on the website

When you check a store by its address on the website, we process the address entered and a one-way hash of your IP address to prevent abuse (a repeated check of the same store or from the same address is blocked for a while). Screenshots of the check are deleted five minutes after it ends, the check record after 90 days. The check never places an order and never enters personal data into the store. Legal basis: Art. 6(1)(f) GDPR (providing the free check and protecting it from abuse).

5. Account and use of the Service

• Account data: name, email address, password (stored only as a hash), language, time zone, the organisation name, the secret of the authenticator app (encrypted), invitations of team members (their email address and role).
• Sign-in and security: a session record with IP address and browser information while you are signed in; sessions expire after two hours of inactivity. Actions in the account are recorded in an audit log (who, what, when); records of the operator’s administration are kept for two years.
• Consent to documents: which version of these documents you accepted and when (without the IP address).
• Notifications: the email addresses and, if you connect Telegram, the Telegram chat to which alerts are sent.

Legal basis: Art. 6(1)(b) GDPR (providing the Service under the contract) and Art. 6(1)(f) GDPR (security of the Service, proof of consent). We keep account data for the lifetime of the account and delete it within 30 days after the account is closed or on your request, unless we must keep it by law.

6. Data of your stores

Store addresses, connection keys (encrypted), order and payment records (status, amounts, currencies, payment method, transaction references, timestamps), incidents and screenshots of storefront pages taken during checks (kept 30 days) are processed on behalf of your organisation as described in Section 15 of the Terms of Service. The Service is built not to collect the names, addresses or email addresses of your customers. Browser checks use test data only.

7. Payments

Purchases of subscriptions are handled by Paddle.com Market Limited, London, United Kingdom, as Merchant of Record. Paddle collects your billing and payment data as its own controller under its privacy notice. We receive from Paddle the data needed to link the subscription to your account: subscription status, plan, invoices and amounts, Paddle’s customer identifier and the billing email address. We never see your card details. Legal basis: Art. 6(1)(b) and (c) GDPR; billing records are kept as long as tax and commercial law require.

8. Recipients and processors

• Contabo GmbH, Munich, Germany — servers and encrypted backup storage (processor).
• Paddle.com Market Limited, United Kingdom — sale and payment of subscriptions (own controller; the United Kingdom has an EU adequacy decision).
• Telegram — only if you connect a Telegram chat for alerts; the alert text is sent to Telegram’s servers.
• Stores and payment providers you connect (for example WooCommerce, Shopware, Stripe, PayPal) — we read data there on your instruction; we do not send them your personal data.

We send email from our own mail server; we do not use newsletter or email tracking tools. We do not sell personal data.

9. Backups

The database and mailboxes are backed up daily, encrypted and stored in Germany. Backups are kept on a schedule: all backups of the current week, the last one of each earlier week of the current month and the last one of each month for twelve months. Deleted data therefore disappears from backups at the latest after this period.

10. Cookies

The customer account and the pages of the website with a form (contact, store check, sign-up) use only technically necessary cookies: a session cookie and a protection cookie against cross-site request forgery. They are required to provide the service you request (§ 25(2) TDDDG, Art. 6(1)(b) GDPR) and expire with the session. When you open the payment step, the checkout of Paddle is loaded from Paddle’s servers and may set the cookies Paddle needs for the payment, under Paddle’s privacy notice. No consent banner is needed because we use no other cookies.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw a consent at any time with effect for the future. Write to hello@business-watchdog.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence or workplace (Art. 77 GDPR).

12. Security

We use encrypted connections (TLS), store keys and secrets encrypted, protect administrative access with two-factor authentication, separate the data of each organisation and encrypt backups.

13. Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you, and we do not use artificial intelligence to process your data.

14. Changes

We update this policy when the Service or the law changes. The current version is always available on this page; we inform account holders of material changes by email.