Privacy policy

This is a translation of the Danish privacy policy. If the two versions differ, the Danish version prevails.

This policy explains which personal data we (snakker meget) collect, why, and which rights you have under the GDPR.

1. Data controller

GIJA HUB MB (company code 307210538, Lithuania) • Polocko g. 4B-20, LT-01204 Vilnius, Lithuania

2. Which data we process

Account data: name, email, password (hashed).
Goal data: title, dates and creation fee, stored only for the purpose of running the platform.
Uploaded images: Images you upload to your goals are stored securely with an EU-based cloud provider using unique tokens. Images are deleted automatically when goals or your account are deleted.
Stripe references: Checkout Session ID, payment reference and invoice number for your creation fee. All payments are made through Stripe Managed Payments, where Stripe or Link is the merchant of record and processes the payment, calculates and collects VAT and issues the receipt and tax invoice. Stripe/ Link receive the payment details (for example email and billing address) needed for the purchase, and act as independent data controller for these. We store no card details.
Necessary cookies for session & CSRF protection.
Anonymous traffic analytics: We use an EU-based, cookie-free analytics service to understand how the site is used. No personally identifiable data is collected.
Emails: Transactional emails (confirmations, reminders) are sent via an EU-based email provider.
IP addresses: Logged temporarily for security purposes (rate limiting, protection against abuse).
Google reCAPTCHA is used solely to protect our forms from abuse by bots. This may result in Google receiving your IP address and setting technical cookies.

3. Legal basis

The processing is necessary to perform the contract (Art. 6(1)(b)), and for our legitimate interest in running a secure service (Art. 6(1)(f)).

4. Retention period

Account and goal data are deleted 12 months after an account is closed. Stripe IDs are kept for as long as necessary for accounting reasons. Deleted content is kept for up to 7 days for security reasons, after which it is permanently deleted.

5. Your rights

You can request access, rectification, erasure, restriction or data portability at any time. Write to us at the address above.

6. Complaints

You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark.