Privacy Policy

registered in the Commercial Register maintained by the Regional Court in Ostrava, Section C, Insert 100309

Contact for data-protection questions: 404branding@gmail.com. The company does not currently have a formally appointed Data Protection Officer (DPO); the contact above is not a DPO address, but a general contact point for privacy-related questions and requests.

2.1 This Policy applies to personal data that 404 Branding s.r.o. processes as an independent controller in connection with user account administration, workspace administration, subscription and billing administration, login and session security, fraud and abuse prevention, operational and legal communications, maintenance of legal and compliance records, and technical operation of the website and the Service.

2.2 This Policy does not apply to personal data contained in contacts, subscribers, or campaigns that the Customer uploads to or generates through the Service ("Customer Data"). Processing of Customer Data is governed by Section 6.

3.1 As an independent controller, we process in particular the following categories of personal data:

• name;
• email address;
• user account identifier;
• workspace membership and role (OWNER/ADMIN/MEMBER);
• account and subscription information (selected plan, subscription status);
• billing identifiers and status held with the payment processor Stripe (e.g. a customer and subscription identifier) - not full payment-card details, which Stripe does not make available to us;
• login and session information;
• IP address and user agent, where actually processed - in particular for rate-limiting and abuse-prevention purposes on login, registration, password reset, and public form submission;
• information related to security, rate-limiting, and abuse prevention;
• the content of support and contact communications sent to our contact email;
• operational email records (e.g. a password-reset email, an upcoming workspace-deletion reminder, a completed-deletion confirmation); and
• legal and compliance records (e.g. an audit record that a deletion was carried out).

3.2 We do not claim to process categories of data that we do not actually process in connection with the Service or our business. In particular, we do not store full payment card numbers or the security code (CVV) - payments are processed exclusively by Stripe through its hosted solution.

4.1 We obtain the personal data described in Section 3 in particular:

• directly from the user or Customer (e.g. upon registration or completing a profile);
• automatically in connection with use of the Service (e.g. session information, security and operational records);
• from workspace owners or administrators who invite or manage other users;
• from service providers such as Stripe, to the extent relevant to billing; and
• from technical and security systems, where necessary to protect the Service.

4.2 We do not carry out broad data enrichment, nor do we purchase personal data about users from data brokers.

Performance of a contract and steps prior to entering into one (Art. 6(1)(b) GDPR)

• creating and administering a user account;
• providing the Service;
• administering the subscription and account; and
• handling requested support.

Compliance with a legal obligation (Art. 6(1)(c) GDPR)

• maintaining accounting and tax records;
• compliance with binding legal obligations; and
• responses required by applicable law.

Legitimate interests (Art. 6(1)(f) GDPR)

Our legitimate interest consists of:

• securing the Service;
• preventing fraud and abuse;
• ensuring the reliability of the Service;
• defending against legal claims;
• reasonable operational administration of the account and workspace; and
• protecting infrastructure and other users.

Consent (Art. 6(1)(a) GDPR)

5.1 We use consent as a legal basis only where we actually rely on it for a specific controller-side activity - we do not currently use it as a general legal basis for account- or Service-related processing.

6.1 Contacts, subscribers, campaigns, and related data that the Customer uploads to or generates through the Service are generally processed by 404 Branding s.r.o. on behalf of the Customer. The Customer determines the purposes and means of this processing as controller; 404 Branding s.r.o. acts as processor.

6.2 404 Branding s.r.o. processes Customer Data on the Customer's documented instructions and in accordance with a separate Data Processing Agreement (DPA), which governs this processing in detail, including the subprocessors used - see the Subprocessor List.

6.3 404 Branding s.r.o. does not use the Customer's subscriber or contact database for its own marketing.

7.1 Personal data that we process as an independent controller may be disclosed to providers that supply us with infrastructure or services necessary for operating the Service, in particular:

• OVHcloud (cloud infrastructure provider);
• Plus Five Five, Inc. (Resend) (operational email delivery); and
• Stripe (payment processing and subscription management).

7.2 The role of these providers differs depending on the particular activity - Stripe may act as either a processor or an independent controller, depending on the nature of the processing. The current and complete list of subprocessors and other service providers is maintained on the separate Subprocessors and Other Service Providers page, which remains the controlling source of information on individual providers and their role.

8.1 Personal data may be transferred outside the European Economic Area (EEA) in connection with providing the Service. We do not claim that all processing takes place solely within the European Union, nor that no international transfers occur.

8.2 Where personal data is transferred outside the EEA, appropriate safeguards apply, which may include:

• a European Commission adequacy decision;
• the European Commission's Standard Contractual Clauses;
• the EU-US Data Privacy Framework, where applicable; and
• supplementary measures, where appropriate.

8.3 Details of international transfers of Customer Data are governed by the DPA and the Subprocessor List - see Sections 6 and 7.

9.1 We retain account and Service data for the duration of the contractual relationship and for the period reasonably necessary to administer that relationship.

9.2 Expired Better Auth sessions are regularly removed from the application database.

9.3 Accounting and tax records may be retained for the period required by applicable law.

9.4 Security, abuse-prevention, and legal records may be retained for as long as necessary for legitimate or legal purposes, including the establishment or defence of legal claims.

9.5 We retain support-communication records only for as long as reasonably necessary.

9.6 Deletion of Customer Data is governed separately by the DPA, the Terms, and the separate Data Retention & Deletion Policy - see Section 10.

9.7 We do not guarantee immediate deletion from backups. After removal from active systems, residual copies may temporarily remain in finite backups according to documented retention cycles; such residual copies are not used for ordinary processing. This does not create a right to retain data indefinitely.

10.1 Deletion of Customer Data and workspace data is governed separately by the Terms (Section 11) and the DPA, and reflects the implemented 30-day workspace closure and deletion process.

10.2 Deletion of Customer Data and workspace data itself must be distinguished from necessary controller-side records that 404 Branding s.r.o. may retain independently (e.g. accounting, legal, or security records under Section 9).

10.3 We do not claim that absolutely every record concerning a former Customer disappears after the 30-day period. Narrow, legally necessary business records may be retained in accordance with Sections 9 and 10 of the DPA.

11.1 The Service currently uses only technical cookies necessary for operation, login, and security - in particular a session cookie for login management, which is set as httpOnly, requires HTTPS (Secure) in production, and uses appropriate SameSite protection.

11.2 This cookie serves solely to let the Service recognise a logged-in user between requests, and for related security purposes (CSRF protection).

11.3 The Service does not currently use advertising or analytics tracking cookies, nor a consent mechanism for such cookies, because no such cookies are deployed.

11.4 The Service does not currently use localStorage, sessionStorage, or IndexedDB for tracking users, nor any form of browser fingerprinting for tracking purposes.

11.5 If analytics or advertising technologies are introduced in the future, this Policy will be updated accordingly, and a corresponding consent mechanism will be implemented where required by applicable law.

12.1 404 Branding s.r.o. does not carry out solely automated decision-making, including profiling, that produces legal effects concerning natural persons or similarly significantly affects them within the meaning of Article 22 GDPR.

12.2 This does not affect the fact that the Service offers automations in the area of email marketing (e.g. automated campaign sequences) - these automations are a tool for the Customer's own marketing activity and are not automated decision-making within the meaning of Article 22 GDPR concerning a user of the Service.

13.1 To the extent provided by the GDPR, data subjects may exercise in particular the right to:

• access personal data;
• rectify inaccurate data;
• erasure (the "right to be forgotten");
• restrict processing;
• object to processing;
• data portability; and
• withdraw consent, where processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal.

13.2 The scope and conditions for exercising each right depend on the particular legal basis and circumstances of the processing.

13.3 Where 404 Branding s.r.o. processes Customer Data solely as processor, a request concerning that data may need to be directed to the relevant Customer as controller, or handled through that Customer.

14.1 A data subject has the right to lodge a complaint with a supervisory authority. For the Czech Republic, that authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

14.2 A complaint may also be lodged with another competent supervisory authority, where relevant under applicable law.

15.1 404 Branding s.r.o. applies reasonable technical and organisational measures appropriate to the nature and risks of the processing.

15.2 This Policy does not claim that we provide multi-factor authentication (MFA), PostgreSQL row-level security (RLS), full disk encryption on the production server, formal external certification, guaranteed security, guaranteed availability, or fixed RTO/RPO values.

15.3 A more detailed and contractually binding description of technical and organisational measures is contained in Annex 2 of the DPA, which remains the controlling source of information on the Service's security.

16.1 The Service is intended for persons acting in connection with their business, trade, or professional activity (B2B) and is not offered to consumers.

16.2 The Service is not intended for use by minors acting in a personal or consumer capacity, and we do not actively target the collection of personal data of minors beyond what is necessary in the ordinary course of a Customer's business activity.

17.1 We may update this Policy in the future. We will give reasonable notice of material changes in an appropriate manner.

17.2 The current version and effective date are always stated in the header of this Policy.

17.3 An update to this Policy does not, by itself, create consent to processing where consent is required under applicable law - such consent must be obtained separately.

17.4 This Policy may be made available in Czech and in English. The Czech version shall prevail.

Questions and requests regarding data protection may be sent to:

Company ID No.: 23561076

Email: 404branding@gmail.com

Overview of all legal documents