Privacy Policy

We use the following categories of cookies:

• Essential — Always active. Required for authentication, security, and core functionality. Cannot be disabled.
• Analytics — Firebase Analytics, activated only with your explicit consent. Used to understand how the service is used.
• Marketing — None currently. If we ever introduce marketing cookies, we will update this policy and request separate consent.

Granular cookie control is available via the consent banner shown on your first visit. You can change your preferences at any time via the cookie settings link in the footer.

Under the GDPR, you have the following rights:

• Right of access (Article 15) — Obtain a copy of your personal data and information about how it is processed.
• Right to rectification (Article 16) — Correct inaccurate or incomplete personal data.
• Right to erasure (Article 17) — Request deletion of your personal data, subject to legal retention obligations.
• Right to restriction of processing (Article 18) — Limit how we process your data in certain circumstances.
• Right to data portability (Article 20) — Receive your data in a structured, commonly-used, machine-readable format.
• Right to object (Article 21) — Object to processing based on legitimate interests.
• Right not to be subject to automated decision-making (Article 22) — Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

How to exercise: Email legal@nothingasaservice.co or use the self-service options in your account dashboard. We will respond within 30 days as required by GDPR Article 12.

• Active account — Data is retained for the duration of your account to provide the service.
• Deleted account — Personal data is purged within 30 days of account deletion, except where legal retention applies.
• Exception: Transaction records — Retained for 7 years as required by the Algemene wet inzake rijksbelastingen (Dutch General Tax Act), Article 52.
• Exception: Consent records — Retained for 5 years to demonstrate GDPR compliance.

• All data is encrypted at rest and in transit (TLS 1.2+).
• Payment processing is handled by Stripe, which is PCI DSS Level 1 certified. We do not store credit card numbers, CVVs, or other sensitive payment data on our servers.
• No sensitive authentication data is stored client-side beyond session tokens.
• In the event of a data breach, we will notify affected users and the Autoriteit Persoonsgegevens within 72 hours as required by GDPR Article 33.

We currently do not sell, rent, or trade your personal data to third parties for marketing or any other purpose.

If data monetization is ever considered in the future:

• Separate, explicit consent will be required before any data is shared.
• The service will continue to work fully without opting in.
• Full transparency will be provided about what data is shared, with whom, and for what purpose.
• Consent can be withdrawn at any time, without penalty.
• This privacy policy will be updated before any such change takes effect.

We mention this because we believe in being upfront, not because we're planning it.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Dutch Data Protection Authority:

• Autoriteit Persoonsgegevens
• Postbus 93374, 2509 AJ Den Haag
• autoriteitpersoonsgegevens.nl

• Material changes — We will notify you via email at least 30 days before any material changes to this privacy policy take effect.
• Non-material changes — Updated on this page with a revised "Last updated" date.

For any privacy-related inquiries, contact us at:

• Email: legal@nothingasaservice.co
• Entity: placeholder
• KvK: 93724454
• BTW: NL005039345B64