Privacy Policy (GDPR)
Last updated: November 2026
Data controller: Black Sea Tech SRL, Romania.
Contact: privacy@wtfk.net.
DPO: not appointed — small-scale processing under Art. 37 GDPR.
This policy explains what we collect, why, how long we keep it, and the rights you have under the General Data Protection Regulation (EU/2016/679) and equivalent international frameworks (UK GDPR, CCPA/CPRA, PIPEDA).
1. What we collect
| Category | Data | Source | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Account | name, email, hashed password | you | Contract (Art. 6(1)(b)) |
| Uploads / Processed content | files you purify (deleted immediately / 7-day auto-expiry for results) | you | Consent + Contract |
| Usage | number and types of operations performed, credits spent | automated | Legitimate interest (fraud prevention) |
| Billing | transaction ID, last 4 card digits via Stripe / PayPal — we never see full card data | processor | Contract |
| Server logs | IP address, user-agent, timestamps | automated | Legitimate interest (security) |
| Cookies | single session cookie (laravel_session) |
automated | Strictly necessary — exempt from consent under Art. 5(3) ePrivacy Directive |
2. What we do not do
- We do not keep your uploaded originals. They are deleted from our filesystem immediately when the purification finishes (or the job fails).
- We do not keep your purified files longer than 7 days; they auto-expire after that and are deleted permanently.
- We do not train any machine-learning model on your uploads, before or after purification.
- We do not sell, rent, broker, or share your personal data with third parties other than the payment processors, our hosting provider, and the authorities where required by law.
- We do not use your email for marketing without explicit opt-in.
- We do not operate advertising trackers, third-party analytics (no Google Analytics, no Meta pixel), or behavioral advertising.
3. Transfers outside the EEA
Your data is processed in Romania (EEA). Stripe and PayPal process payment data primarily in the US under Standard Contractual Clauses approved by the European Commission (Stripe: SCCs, PayPal: SCCs). No other international transfer takes place.
4. Your rights (GDPR Chap. III)
You have the right to:
- Access (Art. 15) — request a copy of everything we hold about you.
- Rectification (Art. 16) — fix wrong data.
- Erasure / "right to be forgotten" (Art. 17) — see "Delete your account" below. Erasure extends to processed content immediately; billing records are kept for the accounting-retention period required by Romanian law (typically 10 years).
- Restriction (Art. 18), Portability (Art. 20), Objection (Art. 21) — contact us.
- Withdraw consent at any time, with future effect.
- Lodge a complaint with the Romanian Data Protection Authority (ANSPDCP, https://www.dataprotection.ro) or your local supervisory authority.
Delete your account — /profile → Danger Zone → "Delete account". This erases all personal data immediately. Billing history is anonymized to the extent possible while preserving our legal accounting obligations.
5. Security
- TLS-only transport (
https://wtfk.net). - Passwords hashed with bcrypt/argon2.
- Upload-storage isolated per-user with randomized filenames.
- No public listing of user content, no scraping surface.
6. Children
Service is not directed to children under 16 (Art. 8 GDPR). We do not knowingly collect child data.
7. Changes
Material changes will be announced by email 14 days before taking effect and posted on this page. The "Last updated" date at the top reflects the current version.
8. Contact
For any privacy request (access, deletion, portability, objection):
privacy@wtfk.net — we respond within 30 days as required by Art. 12 GDPR.