Privacy Policy

1. Who is responsible

The controller for the processing described here is Kaloyan Stefanov, bul. Ruski 82, 6000, Stara Zagora, Bulgaria. Email: kokmarok@gmail.com.

We are not required to appoint a data protection officer; please send privacy questions to kokmarok@gmail.com.

For data your team stores inside a workspace (projects, BOMs, components, orders), the workspace owner decides what is stored. We process that content to provide the service.

2. What we process and why

Visiting the website. When you open any page, our hosting provider processes your IP address, the requested page, date and time, browser and operating system (server logs) to deliver the page and protect it against abuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website).

Your account. To create and secure your account we process your email address, name, profile picture (if you add one), password hash or sign-in method, verification codes, sessions and the devices you sign in from. Sign-in is handled by our processor Clerk. Legal basis: Art. 6(1)(b) GDPR (contract).

Workspaces and their content. We store your workspaces, memberships and roles, invitations (the invitee's email address), and everything your team adds: projects, boards, BOM lines, the component library, stock levels and orders, including who created an order. Legal basis: Art. 6(1)(b) GDPR.

Distributor API keys. If your workspace connects its own LCSC, DigiKey or TME credentials, we store them encrypted (AES-256-GCM) and use them only to run the searches and price lookups you request. Search terms and part numbers are sent to that distributor; they don't contain your personal data. Legal basis: Art. 6(1)(b) GDPR.

Payments. Paid plans are bought through Stripe. Stripe collects your payment details, billing address and email; we never see your full card number. We store the Stripe customer and subscription IDs, the plan, billing interval, status and renewal date of the workspace. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for keeping invoices and accounting records.

Emails. We send sign-in, verification, invitation and account notices. To avoid sending an email twice we keep a short log (email ID, recipient, type, status). Legal basis: Art. 6(1)(b) GDPR.

Feedback. When you send feedback, we store your message, your email address and account, the workspace, the page you were on, your browser (user agent) and the app language, and forward it by email to our team. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fixing bugs and improving the product).

Preferences. Your language, currency and theme choices are stored in cookies or your browser (see section 6).

We do not use analytics, advertising or tracking tools, we do not sell personal data, and we do not make decisions about you based solely on automated processing (Art. 22 GDPR).

3. Who receives data

We use the following service providers (processors) bound by data processing agreements under Art. 28 GDPR:

• Vercel Inc. (USA): hosting of the website and app, server logs. Region: AWS Europe Central 1 (Frankfurt).
• Neon Inc. (USA): database hosting. Region: AWS Europe Central 1 (Frankfurt).
• Clerk Inc. (USA): sign-up, sign-in, sessions and account management. If you choose “Continue with Google”, Google receives the sign-in request and shares your name, email address and profile picture with us.
• Stripe Payments Europe Ltd. (Ireland) and Stripe Inc. (USA): payments, invoices, subscription management. For payment processing Stripe also acts as an independent controller (stripe.com/privacy).
• Brevo: delivery of emails.

Distributors (LCSC, DigiKey, TME) receive the search requests your workspace makes with its own API keys. Product images and datasheet links in search results are loaded directly from the distributors' servers, which then see your IP address and browser like with any website you visit.

Other members of a workspace see your name, email address and profile picture, and which orders you created. We disclose data to authorities only where we are legally required to.

4. Transfers outside the EU

Some providers above are based in the USA or may access data from there. Transfers rely on the EU–US Data Privacy Framework adequacy decision (Art. 45 GDPR) where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with additional safeguards. You can request a copy of these safeguards from us.

5. How long we keep data

• Account data: until you delete your account. Deleting it removes your profile and memberships; workspaces you own are handed to another admin or member, or deleted with all their content if nobody else is in them.
• Workspace content: until it is deleted by the team or the workspace is deleted.
• Feedback: until it has been handled; when you delete your account, your email address is removed from your reports.
• Email log: until your account is deleted.
• Invoices and accounting records: as long as tax and accounting law requires (up to 10 years).
• Server logs: for the short period set by our hosting provider (typically up to 30 days).

6. Cookies and local storage

We only use cookies and browser storage that are strictly necessary to run the service or that store a choice you made (language, currency, theme). These are allowed without consent under Art. 5(3) of the ePrivacy Directive and its national implementations, so we don't show a cookie banner. We do not use analytics, advertising or third-party tracking cookies.

During checkout you are on Stripe's website, which sets its own cookies for fraud prevention as described in Stripe's cookie policy. You can delete or block cookies in your browser settings; the app won't work without the strictly necessary ones.

7. Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you can withdraw it at any time with effect for the future.

You can change your name, email and password and delete your account yourself under “Manage account” in the app. BOMs and orders can be exported as CSV from the app. For anything else, write to kokmarok@gmail.com; we answer within one month.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

8. Security

All connections are encrypted (HTTPS/TLS). Distributor credentials are encrypted at rest, sensitive actions such as inviting people or transferring ownership require you to confirm your identity again, and access to production data is restricted.

9. Is providing data required?

You need an email address to create an account; without it we can't provide the service. Everything else you add is up to you. The service is not intended for children under 16.

10. Changes

We update this policy when the service or the law changes. The date of the current version is shown at the top of this page.