Effective date: [EFFECTIVE DATE]. This Privacy Policy explains how [LEGAL ENTITY NAME] ("we") processes personal data of visitors and account holders of the BulFront platform. For personal data that our customers’ published websites collect from their own visitors, we act as a processor — see the Data Processing Agreement.
Who is responsible (controller) [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. Contact for privacy matters: [PRIVACY EMAIL].
What we collect - Account data: name, email, password (hashed), business details you enter. - Billing data: processed by our payment provider; we store limited records (plan, status, invoices), not full card numbers. - Usage data: log data, device/browser information, and product analytics needed to run and secure the Service. - Content you create through the Service.
Why we process it and lawful bases - To provide the Service and perform our contract with you (Art. 6(1)(b)). - To bill you and comply with tax/accounting law (Art. 6(1)(c)). - To secure, maintain and improve the Service, on our legitimate interests (Art. 6(1)(f)). - With your consent where required, e.g. certain communications (Art. 6(1)(a)).
AI processing and transparency We use third-party AI providers to generate content at your request. Prompts and the business details needed for generation are sent to those providers under their terms. We do not sell your data. In line with the EU AI Act (Regulation (EU) 2024/1689) transparency obligations, content we generate with AI and publish is labelled as AI-generated (a visible notice plus a machine-readable marker), and our AI chat assistant identifies itself as AI so you always know when you are interacting with a machine rather than a person.
Sharing We share data with the subprocessors listed on our Subprocessor page (payments, email, hosting, AI, imagery), each only as needed. We may disclose data where legally required.
International transfers Where data is processed outside the EEA, we rely on appropriate safeguards (e.g. Standard Contractual Clauses).
Retention We keep account data for the life of your account and for a reasonable period afterward, and billing records as required by law. A website that goes offline because its trial or subscription ended and was not renewed is treated as abandoned and is retained for **45 days**, after which the website and all associated data and assets are permanently deleted. When you delete a website (or your account), the associated content and uploaded assets are deleted promptly, save for records we must retain for legal, tax or security reasons.
Your rights You have the rights of access, rectification, erasure, restriction, portability and objection, and to lodge a complaint with a supervisory authority. To exercise them, see our GDPR Request Process or email [PRIVACY EMAIL].
Cookies See our Cookie Policy. Our product analytics are configured to be cookieless where possible.
Changes We will post updates here and, for material changes, notify account holders.
This document is a template pending review by a qualified lawyer.