Privacy policy
What we store about you, why, who helps us run the Studio, how long we keep it, and what you can ask us to do with it.
Last updated 4 November 2026
Who is responsible
The controller of your data is HeySmile EOOD, a company registered in Bulgaria (UIC 207603907), Knyaz Boris 1, Parvomay, Bulgaria. For anything about your data, email v3subusiness@gmail.com.
What we collect and why
- Your account: your email address, the name you give, and your password, which the sign-in system stores only in scrambled (hashed) form. We need these to run your account. Legal basis: the contract with you. If the link that brought you had one of our channel codes (?ref=), we also keep that code with your account, to see which channels bring people, unless your browser sends the Global Privacy Control signal. Legal basis for that: our legitimate interest.
- If you sign in with Google or Apple: that company tells us your email address, your name and its ID for your account, and Google may add a link to your profile picture, which we don't use. We get no password. If you choose Apple's Hide My Email, we get an address Apple forwards to you instead of your own. An account made this way gets no news emails, because there is no box to tick. Legal basis: the contract with you.
- Your plan: plan, status, dates and the IDs Stripe gives your customer record and subscription. Your card details go to Stripe only; we never see or store them. Legal basis: the contract, and the accounting laws we must follow.
- What you do in the Studio: the packs you download and when, your favourites and collections, the tool projects you save, and your pack requests and votes. These make your Downloads page, collections and saved projects work, keep the fair-use limit, and show us which packs to make next. Legal basis: the contract, and our legitimate interest in making the packs people need.
- Errors: our host records errors so we can fix them. They are not used to identify you. Legal basis: our legitimate interest in a site that works.
- Our own visit counts: when you open the site, we add one to an hourly and a daily total for the page, the code after ?ref= in the link if there is one, and your country, which Cloudflare works out from your connection and passes to us. A ref code names the channel that carried the link, never a person. If the link had no code, we note only the kind of site it was on, from a fixed list (for example a search engine, X or YouTube), never the address of that page. We also keep a daily total of how often each tool is opened. We set no cookie for this, store nothing on your device, keep no IP address and give no visitor an ID. If your browser sends the Global Privacy Control signal, we count neither. Legal basis: our legitimate interest in knowing which pages, tools and channels bring people.
- Feedback, if you have Pro and send it: what you type, the page you sent it from and a link to your account, which is how we reach you. We use it only to answer you and to fix what is wrong, and only we read it. It is kept in Lovable Cloud, in the Europe (Frankfurt, Germany) region. Legal basis: our legitimate interest in fixing the Studio and answering you.
- Security: our providers log requests, including IP addresses, for a short time to keep the site safe. Legal basis: legitimate interest.
- News emails, only if you tick the box: when you make an account you can choose to get an email when new packs and tools come out, about once a week. The box starts unticked. If you tick it, we store your yes and the time you gave it. Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time.
We send you sign-in emails (confirming your address, resetting a password), and Stripe sends receipts and payment notices. News emails go only to people who ticked the box. Each one has an unsubscribe link, or you can email us and we take you off the list. We don't sell your data, and the Studio shows no ads.
Who helps us run the Studio
- Lovable hosts the site and runs Lovable Cloud, which holds the database, saved projects and sign-in (built on Supabase), in the Europe (Frankfurt, Germany) region. It also records site errors.
- Google and Apple check who you are if you choose to sign in with them, under their own privacy policies. Lovable's sign-in service (oauth.lovable.app) passes the sign-in between them and the site.
- Stripe takes payments and runs the billing portal and receipts. For your card details, Stripe is responsible under its own privacy policy. If you use Apple's Hide My Email, Stripe's page asks you for an address for its receipts and reminders, because mail from Stripe may not get through Apple's forwarding.
- Cloudflare stores and delivers the pack files and protects the site from bots.
- Brevo (Sendinblue SAS, France) will send the news emails when we start sending them. It gets only the email address and name of people who ticked the box. Nothing has been sent yet.
Some of these companies are in the United States or have staff there. Transfers outside the EU are covered by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Cookies and browser storage
The Studio uses only what it needs to work, plus the channel code in the Google or Apple row below. It uses no advertising or statistics cookies.
| What | Name | Why | How long |
|---|---|---|---|
| Sign-in session | Browser storage, sb-…-auth-token | Keeps you signed in | Until you sign out |
| Bot protection | Cookie __cf_bm (Cloudflare) | Tells people from bots | 30 minutes |
| Tool settings and work | Browser storage, gridwright-… and gw-…, on the tool pages | Remembers your settings and work in that tool. It stays on your device. | Until you clear it |
| News sign-up check | Session storage, gw_news_synced | Sends your news sign-up to the mailing list only once | Until you close the tab |
| Google or Apple sign-in | Session storage, gw_oauth_next and gw_oauth_ref | Brings you back to the page you were on, and keeps the channel code if the link had one. The code is not kept if your browser sends the Global Privacy Control signal. | Until you are back, or you close the tab |
Stripe's payment page sets its own cookies on stripe.com, under Stripe's policy. The sign-in pages of Google, Apple and Lovable set their own cookies on their own sites, under their own policies.
The share buttons are plain links and load nothing from other sites. The site you pick opens only when you click, and its own policy applies there.
How long we keep it
- Your account data stays while your account exists.
- When you ask us to delete your account, we delete it and everything linked to it within 30 days. Payment records we must keep for accounting stay for as long as the accounting and tax laws require. Feedback you sent is the one exception: its link to your account goes, and the message stays so we can still fix what it reports. If it names you, or you want it gone too, we delete it as well.
- Security and error logs are kept for a short time and are not used to identify you.
- Our own visit and tool counts have nothing about you in them. The hourly totals go after 35 days; the daily ones we keep.
- Feedback stays for as long as we need it to answer you and fix the problem, and at most 2 years. Ask us and we delete it sooner.
- If you unsubscribe from news emails, we stop sending them at once. We keep only the record of when you said yes and no, as proof of your choice.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, to receive it in a portable form, and you can object to uses based on our legitimate interest. Email v3subusiness@gmail.com and we answer within one month. You can also complain to the Commission for Personal Data Protection in Bulgaria (cpdp.bg) or to the data protection authority where you live.
Children
The Studio is not meant for children under 14, the age of digital consent in Bulgaria. Paid plans need an adult, as the terms say.
Changes
If we change this policy, we update the date at the top. If a change matters to you, we email you before it applies. Questions: HeySmile EOOD, v3subusiness@gmail.com.