Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

My Web LLC
Hungary, 1137 Budapest, Katona József utca 25
VAT number: HU14373134
D-U-N-S Number: 401231538
Email: [email protected]

2. Personal Data We Collect

2.1 Account and Identity Data

When you register, we collect your name, email address, and a hashed password. If you register via a social login provider (such as Google), we receive the data made available by that provider per your consent settings there.

2.2 Workspace and Billing Data

We collect your organisation or workspace name, billing address, VAT number (where applicable), and subscription plan details. Full payment card details are never stored on our servers — they are handled directly by our payment processors (see Section 6).

2.3 Customer Content (Domain Portfolio Data)

You provide domain names, hosting plan details, customer billing/contact records, expiration and renewal dates, registrar and hosting information, DNS records, notes, tags, and associated contact details (e.g., customer email addresses, notification email addresses, SMS phone numbers) when managing your domain portfolio, hosting records, and customer assignments. This data is your content; we process it solely to deliver the Service to you.

2.4 Notification Channel Configuration

Depending on the channels you enable, we may store email addresses, phone numbers (for SMS), Slack OAuth access tokens (for Slack workspace integration), and webhook endpoint URLs together with signing secrets. Phone numbers are used exclusively to deliver domain expiration and hosting plan renewal reminders you have configured.

2.5 Usage and Technical Data

We automatically collect log data such as your IP address, browser type and version, operating system, pages visited, timestamps, referring site, campaign parameters (such as UTM tags), advertising click identifiers when present, and error reports. If you create an account after following a campaign link, we may associate the first and most recent campaign details with your account and record when you first add a domain. We use this data to operate, secure, measure, and improve the Service.

2.6 Cookies and Similar Technologies

We use strictly necessary cookies for session management and authentication, and may use functional cookies to remember your preferences (for example, dashboard tile visibility). Campaign parameters may be held in your first-party session so that a later account registration can be attributed to the page or campaign that brought you to the Service. We do not use advertising or cross-site tracking cookies. You can control cookies through your browser settings; disabling session cookies will prevent you from logging in.

3. Legal Bases for Processing (GDPR Article 6)

We process personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): Processing necessary to create and manage your account, provide the Service, process payments, send transactional emails (verification, reminders, receipts), and handle support requests.
• Legitimate interests (Art. 6(1)(f)): Processing necessary to detect and prevent fraud, abuse, and security threats; maintain and improve the Service; send service-related announcements; and enforce our Terms of Service — except where your interests or fundamental rights override these interests.
• Legal obligation (Art. 6(1)(c)): Processing required to comply with applicable Hungarian and EU law, including tax, accounting, and financial record-keeping obligations.
• Consent (Art. 6(1)(a)): Where we rely on consent (for example, for optional marketing communications, if any), you may withdraw consent at any time without affecting the lawfulness of prior processing.

4. How We Use Personal Data

• To create and manage your account and workspace.
• To deliver the core domain monitoring, notification, and reminder functionality.
• To send domain expiration and hosting plan renewal reminders via your configured channels (email, SMS, Slack, webhook).
• To process subscription payments, generate invoices, and manage billing.
• To verify email addresses, phone numbers, and other contact details.
• To respond to support requests and communicate service-related information.
• To detect, investigate, and prevent fraudulent transactions, abuse, and security incidents.
• To comply with legal obligations, including tax and accounting requirements.
• To analyse aggregate usage patterns and improve the Service (using anonymised or aggregated data where possible).
• To measure which campaigns lead to account registrations and the first use of core product features.

5. SMS Communications

Where you enable SMS reminders, your phone number is processed by our SMS delivery provider, Twilio Inc. (see Section 6). We send only the transactional messages you have configured (domain expiration and hosting plan renewal reminders) to numbers you have explicitly added and verified. We do not use your phone number for marketing messages.

SMS delivery is currently available only to the destinations listed in our Terms of Service. That list presently contains 99 destinations under our current Twilio coverage and cost policy. Depending on the destination country, messages may be sent from a US toll-free number or via a registered alphanumeric sender ID selected by our Twilio Messaging Service. Reply-based STOP/HELP handling (US & Canada only) is currently available for United States and Canada; other supported destinations are treated as one-way for opt-out purposes.

You can opt out of SMS reminders at any time by disabling the SMS channel in your workspace notification settings. Where the originating number type supports it (currently United States and Canada), you may also reply STOP to opt out or HELP for help (US & Canada only). For one-way destinations, reminder SMS includes a signed direct opt-out link that disables SMS reminders for the relevant workspace or domain.

6. Data Processors and Third-Party Service Providers

We share personal data with trusted third-party processors only to the extent necessary to provide the Service. GDPR Art. 13/14 requires us to identify "recipients or categories of recipients." For processors that handle particularly sensitive data we name them specifically below; for interchangeable infrastructure categories (hosting, email delivery, monitoring) we describe the category, which is the form permitted by the Regulation. We maintain data processing agreements (DPAs) with processors as required by GDPR Art. 28.

• Paddle (payment processing) — processes subscription payments and manages billing on our behalf. Paddle acts as a merchant of record in many jurisdictions and has its own applicable privacy policy. We have a DPA in place with Paddle covering EU personal data.
• Twilio Inc. (SMS delivery) — sends SMS reminders to phone numbers you have configured. Twilio processes message content and recipient phone numbers as our data processor. We have accepted Twilio's Data Processing Agreement; for EU personal data, Twilio relies on Standard Contractual Clauses as the transfer mechanism.
• Slack Technologies LLC (Slack integration) — when you connect a Slack workspace, Slack's platform processes the notification content delivered to your channel and holds the OAuth access token used to post messages on your behalf. Your use of Slack is also governed by Slack's own privacy policy.
• Cloud hosting and infrastructure providers — host the application, databases, and file storage. Personal data stored in the Service resides on these servers. We select providers that offer GDPR-compliant hosting and appropriate contractual safeguards.
• Transactional email delivery providers — deliver emails on our behalf (account verification, domain reminders, billing receipts). These providers process your email address and message metadata as our data processors.
• Application monitoring and error-tracking tools — capture application errors, performance metrics, and diagnostic logs to maintain Service reliability. We configure these tools to minimise personal data exposure in error reports.

We do not sell personal data to third parties or use account and portfolio content to build advertising profiles.

7. International Data Transfers

Some of our processors are located outside the European Economic Area (EEA), in particular in the United States. We ensure that any such transfers are subject to appropriate safeguards as required by GDPR Chapter V, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission, and/or
• adequacy decisions where applicable.

You may request information about the specific safeguards applicable to transfers of your data by contacting us at [email protected].

8. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Account data: retained for the duration of your account and deleted within 30 days of account closure, subject to the exceptions below.
• Billing and transaction records: retained for 8 years after the end of the tax year in which the transaction occurred, to comply with Hungarian and EU accounting and tax law.
• Domain portfolio data: deleted together with your account upon closure.
• Campaign attribution data: retained with your account and deleted when the account is deleted.
• Unverified accounts: automatically deleted after 7 days if email verification has not been completed and no protected billing, workspace, invitation, address, or other meaningful records exist.
• Notification delivery logs: retained for a limited period for operational purposes (debugging and replay), then deleted or anonymised.
• Log and security data: retained for a short period (typically up to 90 days) for security and fraud prevention, then deleted.

9. Your Rights Under the GDPR

As a data subject, you have the following rights under GDPR. To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month (extendable by a further two months for complex requests).

• Right of access (Art. 15): You may request a copy of the personal data we hold about you and information about how we process it.
• Right to rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.
• Right to erasure / "right to be forgotten" (Art. 17): You may request deletion of your personal data where there is no longer a lawful basis for processing it, subject to our legal retention obligations.
• Right to restriction of processing (Art. 18): You may request that we restrict processing of your data in certain circumstances (for example, while a correction request is pending).
• Right to data portability (Art. 20): Where processing is based on consent or contract and carried out by automated means, you may request a copy of your data in a structured, commonly used, machine-readable format, and may ask us to transmit it to another controller where technically feasible.
• Right to object (Art. 21): You may object to processing based on legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right not to be subject to automated decision-making (Art. 22): We do not make decisions based solely on automated processing that produce significant legal or similar effects on you.

You also have the right to lodge a complaint with the competent supervisory authority. In Hungary, this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH):

NAIH
1055 Budapest, Falk Miksa utca 9-11
www.naih.hu | [email protected]

If you reside in another EU/EEA member state, you may also complain to the supervisory authority of your country of residence.

10. Security

We implement technical and organisational security measures appropriate to the risk, including encrypted communications (HTTPS/TLS), hashed password storage, access controls, and signed webhook payloads with rotating secrets. No system is completely secure; in the event of a personal data breach that is likely to result in high risk to your rights and freedoms, we will notify you without undue delay as required by GDPR Art. 34.

11. Children's Privacy

The Service is intended for use by businesses and individuals aged 18 or over. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal data.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or by a prominent notice within the Service at least 14 days before the changes take effect. The updated effective date will always be stated at the top of this page.

14. Contact and Data Protection Enquiries

For any questions about this Privacy Policy, to exercise your data subject rights, or to raise a data protection concern, please contact us:

My Web LLC
Hungary, 1137 Budapest, Katona József utca 25
Email: [email protected]

We do not currently have a designated Data Protection Officer (DPO), as we are not required to appoint one under GDPR Art. 37. The above contact handles all data protection enquiries.