In short: we collect what we need to run your account, send the emails you ask for and get paid. Analytics and advertising cookies run only if you say yes. We never sell your data. You can see, download or delete it at any time.
1. Who is responsible
The data controller is Bornbee Technologies, Trieste, Italy, VAT number 10570971217 ("we"). Contact for anything about privacy: [email protected]. This policy explains how we process personal data under Regulation (EU) 2016/679 (GDPR), the Italian Personal Data Protection Code (Legislative Decree 196/2003 as amended by Legislative Decree 101/2018) and the guidance of the Italian Data Protection Authority (Garante per la protezione dei dati personali).
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Email, name, password (stored only as a salted hash), language, time zone | You, at sign-up |
| Profile and uploads | Bio, website, Instagram handle, photographs, titles and captions | You, if you use these features |
| Usage in your account | Saved contests, entry tracker, alerts, budget | You |
| Billing data | Plan, subscription status, invoices, the last four digits and brand of your card | You and Stripe |
| Newsletter data | Email, sign-up date and source, emails sent | You |
| Attribution data | Campaign tags in the link you arrived from (utm parameters), creator code, landing page | The link you clicked |
| Technical data | IP address, browser, device type, pages requested, in server logs | Your browser |
| Organizer and sponsor data | Business name, contact email, listing or campaign content, invoices | You |
3. Why, and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Creating and running your account, Pro features, uploads, listings and campaigns | Performance of a contract, 6(1)(b) |
| Billing, invoicing and accounting | Legal obligation, 6(1)(c), under Italian tax law |
| Service emails (sign-in links, receipts, reminders of trial ends, moderation decisions) | Performance of a contract, 6(1)(b) |
| The Friday list newsletter and welcome emails | Consent, 6(1)(a) |
| Analytics cookies and advertising measurement | Consent, 6(1)(a), and article 122 of the Privacy Code |
| Recording which campaign or creator brought a new account, to pay commissions and judge which channels work | Legitimate interest, 6(1)(f): paying partners correctly and spending our budget wisely. Only first-party data, never shared for others' ads. |
| Security, fraud prevention and keeping logs | Legitimate interest, 6(1)(f) |
| Defending legal claims | Legitimate interest, 6(1)(f) |
You can object to processing based on legitimate interest at any time (article 21 GDPR) by writing to us.
4. Newsletter and marketing
We send the newsletter only if you ask for it. Every email has a one-click unsubscribe link and we stop at once. If you are a Pro member we may send you occasional emails about features similar to those you pay for, as allowed by article 130(4) of the Privacy Code, and you can refuse them at any time.
5. Advertising measurement
We advertise on Instagram, Facebook, Google and TikTok. If, and only if, you accept marketing cookies, we load the Meta Pixel, Google tags and the TikTok Pixel, which tell those platforms that a visit, a newsletter sign-up, a new account, a trial or a purchase came from an ad. When you have accepted marketing cookies we may also send the same events from our server through the Meta Conversions API, with your email address hashed (SHA-256) so the platform can match the event to an ad without receiving the address in clear. With Meta, we are joint controllers for the collection and transmission of this data (article 26 GDPR, see Meta's Controller Addendum); Meta's own processing afterwards is governed by its privacy policy. Without your consent none of this happens. You can change your choice at any time with the "Cookie settings" link in the footer.
6. Photographs
Every photograph you upload is processed to remove embedded metadata, including GPS location, camera serial numbers and author fields, before it is stored. Photographs remain private until a moderator approves them. If a photograph shows identifiable people, you are responsible for having their consent to publish it.
7. Who we share data with
We use carefully chosen providers who process data on our behalf under data processing agreements (article 28 GDPR):
| Provider | What for | Location |
|---|---|---|
| Stripe Payments Europe Ltd | Payments and the billing portal (Stripe is an independent controller for its own fraud and legal obligations) | Ireland, with transfers to the US |
| Hosting and database provider | Running the website and storing data | European Union |
| Cloudflare, Inc. (R2 storage) | Storing and delivering uploaded photographs | EU region, global delivery |
| Email delivery provider | Sending service emails and the newsletter | European Union or US with safeguards |
| Google Ireland Ltd, Meta Platforms Ireland Ltd, TikTok Technology Ltd | Analytics and advertising measurement, only with your consent | Ireland, with transfers to the US |
The current list of providers is available on request. We may disclose data to authorities when the law requires it. We never sell personal data.
8. Transfers outside the EU
Where a provider processes data outside the European Economic Area, we rely on an adequacy decision (including the EU-US Data Privacy Framework for certified companies) or on the European Commission's Standard Contractual Clauses with additional safeguards where needed.
9. How long we keep data
| Data | Kept for |
|---|---|
| Account data | As long as your account is open, then deleted within 30 days of closure |
| Invoices and accounting records | 10 years, as required by article 2220 of the Italian Civil Code |
| Newsletter subscription | Until you unsubscribe; a suppression record of your address is kept so we never email you again by mistake |
| Uploaded photographs | Until you delete them or close your account; backups are overwritten within 35 days |
| Server logs | Up to 90 days |
| Attribution data | Up to 26 months, then aggregated |
| Cookie consent record | 6 months, after which we ask again |
10. Your rights
You have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time without affecting earlier processing (articles 15 to 22 GDPR). Write to [email protected]; we answer within one month. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, garanteprivacy.it, or with the authority in the EU country where you live or work.
11. Security
We use encryption in transit, hashed passwords, least-privilege access for staff, an audit log of administrative actions, and regular backups. If a breach puts your rights at risk, we will tell you and the Garante as the GDPR requires.
12. Children
The service is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.
13. Changes
We will update this policy when our processing changes and tell account holders by email about material changes before they take effect.