Privacy Policy

Effective date: pending completion. This page is written in English only; it has not been reviewed by a lawyer and is not legal advice.

1. Data controller

For your own SwitchRegister account, the data controller is the operator of this instance,
Warning: Trying to access array offset on null in /home/dataactswitchingkit.bluezero.sk/templates/privacy.php on line 17
[registered address — to be added]. For data your own customers submit through your public switching-request form, you (the account holder) are the controller and SwitchRegister acts as your processor.

2. What we collect

This list reflects exactly what the application stores — audited against the database schema, not guessed:

• Account data (if you sign up): email address, a hashed password (never the password itself), company name, preferred language, plan, and — briefly, during signup — a hashed one-time email verification code.
• Register/clause content you author: data-category names, formats, standards, export methods, and clause parameters. This is business/product information, not personal data, by design.
• Switching-request data (submitted by your customers via your public form): requester name, email, request type, and any notes — this is your customers' data, processed on your behalf (see §1).
• Readiness-checker responses: anonymous by default; an email address only if you choose to have your result emailed to you.
• Security/anti-abuse logs: IP address and timestamp for rate-limiting public forms, retained briefly and only to deter spam/abuse.
• Contact-form messages: name, email, and message text — emailed directly to the operator, not stored in the application's database (see §6).
• Usage analytics: counts of actions taken (e.g. "a register was published"), with no third-party analytics script — queried directly by the operator, never sold or shared.

3. Why, and legal basis

• Account and register/clause data: processed to provide the service you signed up for (contract necessity).
• Switching-request data: processed on the account holder's behalf as their data processor, under the account holder's own legal basis with their customer.
• Security/anti-abuse logs: legitimate interest in keeping public forms usable and free of spam.
• Usage analytics: legitimate interest in understanding which features are actually used, to guide development.

4. Third parties

Stripe processes payments for the paid plan and receives your email address at checkout (outbound only — see Stripe's privacy policy). If SMTP is configured, your email provider transmits the content of transactional emails on the operator's behalf. No advertising or analytics network receives any data. A donate button, if shown, links to a separate platform (e.g. Ko-fi) that you visit directly — SwitchRegister never sees or stores anything from that transaction.

5. Cookies

SwitchRegister sets exactly one cookie: a session cookie (PHPSESSID) used to keep you logged in. This is strictly necessary for the service to function and is exempt from cookie-consent requirements — no analytics, advertising, or marketing cookies are set, so no consent banner is shown.

6. Contact form

Messages sent via the Contact page are emailed directly to the operator and are not stored in the application's database. The form is protected by a hidden anti-spam field and rate-limiting; submissions from suspected bots receive the same confirmation message but are never actually sent.

7. Retention and your rights

Account data is kept for as long as your account is active. You can request access to, correction of, export of, or deletion of your personal data, or object to a specific processing activity, via the Contact page. If you are in the EU/EEA, you also have the right to lodge a complaint with your national data protection authority (e.g. Spain's AEPD, Germany's BfDI, France's CNIL) if you believe your data has been mishandled.

8. Age

SwitchRegister is intended for users aged 18 and over, matching the Terms of Service.