1. Data Controller and Categories of Data Collected

The personal data controller is SIA "Safro Technologies" (legal address: Riga, Republic of Latvia, e-mail: [email protected]). We collect and process data strictly necessary to provide our services:

• User Account Credentials: First Name, Last Name, contact email address (login), BCRYPT password hash, interface language, and local timezone.
• Corporate & Reseller Details: Company Name, Registration Number, VAT ID, legal business address, phone, and billing details.
• E-Commerce Tracking Parameters: User-submitted target product/catalog URLs, target price thresholds, custom product titles, and price history logs.
• Technical Security Logs: IP address, browser user-agent, access timestamps, session security markers, and authentication tokens.

2. Processing Purposes and Legal Basis (GDPR Art. 6)

Data processing is conducted in strict accordance with EU General Data Protection Regulation (GDPR EU 2016/679):

• Contract Performance (Art. 6(1)(b) GDPR): Launching automated price scanners, calculating market averages, maintaining token balances, and granting dashboard access.
• Notification Alerts: Dispatching real-time email alerts when tracked product prices drop below or exceed user-defined price thresholds.
• Legal Obligations (Art. 6(1)(c) GDPR): Financial accounting of subscriptions and token purchases processed via Stripe, tax reporting, and invoicing.
• Legitimate Interest (Art. 6(1)(f) GDPR): Safeguarding the Platform against cyber-attacks, preventing DDoS attacks, spam moderation, and abuse prevention.

3. Automatic Data Anonymization in "Feedback" Module

In accordance with Privacy by Design and by Default principles (Art. 25 GDPR), when users post suggestions, feature requests, bug reports, or comments in the public "Feedback" section:

• Regular users' last names are automatically masked and anonymized for other community members (e.g. displaying only "John D." or an anonymous system ID).
• Full names and audit logs are visible exclusively to platform Owners and Administrators for support purposes.
• Submissions are moderated by AI content filters to prevent profanity, spam, or exposure of private data.

4. Data Protection, Sub-Processors (Stripe) and EU Storage

We never sell or rent personal data to third parties. Data is processed exclusively by authorized processors:

• Stripe Inc. (US/EU): Certified PCI-DSS Level 1 payment gateway. We never store or access full credit card numbers.
• EU Cloud Infrastructure: Databases and background scanner workers are hosted in tier-3 data centers within the European Union with disk encryption.
• Transmission Security: All web traffic and email notifications are encrypted via HTTPS / TLS 1.3 protocols.

5. User Rights and 1-Click Account Erasure (Right to be Forgotten)

Under GDPR, users possess full data rights regarding their personal information:

• Right to Erasure (Art. 17 GDPR): Users can permanently erase their account and all associated tracking tasks with 1 click in Profile Settings ("Danger Zone" → "Delete Account").
• Right to Access & Export (Art. 15, 20 GDPR): Request a copy of personal data by contacting [email protected].
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Data State Inspectorate of Latvia (Datu valsts inspekcija / DVI, dvi.gov.lv).