Privacy First

Privacy Policy

Last updated: January 15, 2025

This Privacy Policy explains how Bridged.vu ("we," "our," or "us") collects, uses, discloses, and protects your personal information when you use our subscription management platform (the "Service"). We are committed to protecting your privacy and handling your data in an open and transparent manner in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

1. Introduction

This Privacy Policy describes our practices regarding the collection, use, and disclosure of information when you use Bridged.vu. By using our Service, you agree to the collection and use of information in accordance with this policy.

Data Controller: For the purposes of the GDPR and other applicable data protection laws, the data controller is Bridged.vu, operating at bridged.vu, reachable at anas@bridged.vu.

This Privacy Policy applies to all information collected through our Service, as well as any related services, sales, marketing, or events. Please read this Privacy Policy carefully to understand our views and practices regarding your personal data and how we will treat it.

2. Information We Collect

2.1 Information You Provide to Us

We collect information that you provide directly to us when you:

Account Information: When you create an account, we collect your email address and optionally, a display name. This information is used to authenticate you and enable access to the Service.
Subscription Data: We collect the subscription information you enter, including service names, prices, billing cycles, renewal dates, categories, notes, and any other details you choose to provide. This data is stored in your account and is essential for providing the Service's core functionality.
Communication Data: If you contact us for support, feedback, or inquiries, we collect the information you provide in such communications, including your email address and the content of your messages.
Profile Information: You may choose to provide additional information such as currency preferences and display settings, which are stored in your user profile.

2.2 Automatically Collected Information

When you use our Service, we automatically collect certain information, including:

Usage Data: We collect information about how you access and use the Service, including your IP address, browser type, operating system, device information, pages viewed, time spent on pages, and the date and time of your visits. This data is collected through our hosting provider (Vercel) and is used for performance monitoring and security purposes.
Authentication Data: Our authentication provider (Supabase) collects and processes your password (which is hashed and encrypted), authentication tokens, and session information. We do not have access to your password in plain text.
Cookies and Similar Technologies: We use cookies and similar tracking technologies to track activity on our Service and store certain information. Cookies are files with a small amount of data that may include an anonymous unique identifier. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

2.3 Information We Do Not Collect

We do not collect:

Financial account credentials or banking information
Third-party service access tokens or API keys beyond what you explicitly provide
Personal information from third-party sources without your consent
Biometric data or sensitive personal information (as defined under GDPR)
Location data beyond what may be inferred from your IP address

3. Legal Basis for Processing (GDPR)

Under the GDPR, we process your personal data based on the following legal bases:

Contractual Necessity: We process your account information and subscription data because it is necessary to perform our contract with you (i.e., to provide the Service).
Legitimate Interests: We process usage data and analytics for our legitimate interests in improving the Service, ensuring security, and preventing fraud.
Consent: Where we rely on consent for processing, you have the right to withdraw your consent at any time by contacting us at anas@bridged.vu.
Legal Obligation: We may process personal data to comply with legal obligations, such as responding to legal requests or protecting our rights.

4. How We Use Your Information

We use the information we collect for the following purposes:

To Provide and Maintain the Service: We use your information to create and manage your account, store and display your subscription data, calculate renewal reminders, generate analytics and insights, and provide all features and functionality of the Service.
To Communicate with You: We use your email address to send you operational communications, such as login links, password reset instructions, important service updates, and responses to your support inquiries.
To Improve the Service: We analyze usage data to understand how users interact with the Service, identify technical issues, and make improvements to functionality and user experience.
To Ensure Security: We use your information to detect, prevent, and address technical issues, fraud, security threats, and unauthorized access to the Service.
To Comply with Legal Obligations: We may use your information to comply with applicable laws, regulations, legal processes, or governmental requests.
To Enforce Our Terms: We may use your information to investigate violations of our Terms of Service and to enforce our agreements.

We do not use your personal information for marketing purposes, and we do not sell, rent, or trade your personal information to third parties for their marketing purposes.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Our security measures include:

Encryption: Data is encrypted in transit using TLS/SSL and at rest using industry-standard encryption methods.
Authentication Security: Passwords are hashed and encrypted by Supabase using secure hashing algorithms. We never have access to your password in plain text.
Access Controls: We implement row-level security policies in our database to ensure users can only access their own data. Access to production data is limited to authorized personnel only.
Secure Infrastructure: Our service providers (Supabase, Vercel) maintain secure data centers with physical and logical security controls, regular security audits, and compliance certifications.
Monitoring: We monitor for unusual activity, security threats, and unauthorized access attempts.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:

Account Data: We retain your account information and subscription data for as long as your account is active or as needed to provide you the Service.
Upon Account Deletion: When you request account deletion, we will delete your account and all associated personal data within 30 days, except where we are required to retain certain information for legal, regulatory, or legitimate business purposes (e.g., to comply with legal obligations, resolve disputes, or enforce our agreements).
Usage Data: Aggregated and anonymized usage data may be retained indefinitely for analytical purposes.
Legal Requirements: We may retain certain information if required by law or if we believe in good faith that retention is necessary to comply with legal processes, resolve disputes, or protect our rights and interests.

If you wish to delete your account and associated data, please contact us at anas@bridged.vu from your registered email address. We will confirm deletion within 30 days of your request.

8. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information. We are committed to respecting these rights:

8.1 GDPR Rights (European Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights:

Right of Access: You have the right to request access to your personal data and to receive a copy of the personal data we hold about you.
Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or when you withdraw your consent.
Right to Restrict Processing: You have the right to request restriction of processing of your personal data under certain circumstances.
Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
Right to Object: You have the right to object to processing of your personal data based on legitimate interests.
Right to Withdraw Consent: Where we rely on consent, you have the right to withdraw your consent at any time.
Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates applicable data protection laws.

8.2 CCPA Rights (California Users)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

Right to Know: You have the right to request information about the categories and specific pieces of personal information we collect, use, disclose, and sell (we do not sell personal information).
Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
Right to Opt-Out: You have the right to opt-out of the sale of personal information (we do not sell personal information).
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

8.3 How to Exercise Your Rights

To exercise any of these rights, please contact us at anas@bridged.vu. We will respond to your request within 30 days (or as required by applicable law). Before processing your request, we may need to verify your identity to ensure the security of your personal information. You can also access, update, or delete much of your information directly through the Service's interface.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our Service and store certain information. Cookies are small data files stored on your device. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain until deleted or expired).

Types of Cookies We Use:

Essential Cookies: These cookies are necessary for the Service to function and cannot be switched off. They are usually set in response to actions made by you, such as setting privacy preferences, logging in, or filling in forms.
Performance Cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our Service. All information these cookies collect is aggregated and anonymous.

You can control cookies through your browser settings. Most browsers allow you to refuse cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

We do not use advertising cookies, behavioral tracking cookies, or other tracking technologies for marketing purposes.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country.

When we transfer personal data from the EEA or the UK to countries outside the EEA, we ensure that appropriate safeguards are in place, such as:

Standard Contractual Clauses approved by the European Commission
Adequacy decisions by the European Commission
Other legally recognized transfer mechanisms

Our service providers (Supabase, Vercel) maintain appropriate safeguards and certifications to ensure the protection of your data when transferred internationally.

11. Children's Privacy

Our Service is not intended for individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately at anas@bridged.vu. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information from our servers.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

Updating the "Last updated" date at the top of this page
Posting a notice on our Service
Sending an email to your registered email address (for significant changes)

Your continued use of the Service after such modifications constitutes your acknowledgment of the modified Privacy Policy and agreement to abide by it. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: anas@bridged.vu

Data Protection Officer: For GDPR-related inquiries, you can contact our Data Protection Officer at anas@bridged.vu.

We will respond to your inquiry as soon as reasonably possible and within the timeframes required by applicable law.

14. Additional Disclosures

Do Not Track Signals: Some browsers include a "Do Not Track" (DNT) feature that signals to websites you visit that you do not want to have your online activity tracked. Our Service does not currently respond to DNT signals because there is no common industry standard for DNT.

Third-Party Links: Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of such third parties. We encourage you to read the privacy policies of any third-party websites or services you visit.

Business Information: For purposes of the CCPA, we do not sell personal information, and we do not have actual knowledge that we sell the personal information of minors under 16 years of age.