Privacy policy

Who is responsible

The controller of your data is HeySmile EOOD, a company registered in Bulgaria (UIC 207603907), Knyaz Boris 1, Parvomay, Bulgaria. For anything about your data, email v3subusiness@gmail.com.

What we collect and why

• Your account: your email address and the name you give. You sign in with a one-time code we email you, so there is no password; we keep only scrambled (hashed) forms of the codes and of your sign-in sessions. We need these to run your account. Legal basis: the contract with you. If the link that brought you had one of our channel codes (?ref=), we also keep that code with your account, to see which channels bring people, unless your browser sends the Global Privacy Control signal. Legal basis for that: our legitimate interest.
• If you made your account with Google or Apple before 13 November 2026: we keep the email address, name and ID that company gave us then (and Google's link to your profile picture, which we don't use). You now sign in with a code sent to that email address. If it is an Apple Hide My Email address, the code goes through Apple's forwarding. Legal basis: the contract with you.
• What you buy: the packs and tools you have bought, kept with your account so you can download them again, and the IDs Stripe gives your customer record and payments (and an earlier plan, if you had one). Stripe keeps each payment with the item, your account's ID and when you ticked that the download may start at once. Your card details go to Stripe only; we never see or store them. Legal basis: the contract, and the accounting laws we must follow.
• What you do in the Studio: the packs you download and when, your favourites and collections, the tool projects you save, and your pack requests and votes. These make your Downloads page, collections and saved projects work, keep the fair-use limit, and show us which packs to make next. Legal basis: the contract, and our legitimate interest in making the packs people need.
• Errors: our host records errors so we can fix them. They are not used to identify you. Legal basis: our legitimate interest in a site that works.
• Our own visit counts: when you open the site, we add one to an hourly and a daily total for the page, the code after ?ref= in the link if there is one, and your country, which Cloudflare works out from your connection and passes to us. A ref code names the channel that carried the link, never a person. If the link had no code, we note only the kind of site it was on, from a fixed list (for example a search engine, X or YouTube), never the address of that page. We also keep a daily total of how often each tool is opened, and of these clicks, each by the page it was on: the Megabundle button, a pack's free-sample button, opening the sign-up page (by the page it will take you back to), opening a tool's demo, and starting a custom pack order. We set no cookie for this, store nothing on your device, keep no IP address and give no visitor an ID. If your browser sends the Global Privacy Control signal, we count neither. Legal basis: our legitimate interest in knowing which pages, tools and channels bring people.
• Feedback, if you have bought something and send it: what you type, the page you sent it from and a link to your account, which is how we reach you. We use it only to answer you and to fix what is wrong, and only we read it. It is kept in our database on Cloudflare, in Western Europe. Legal basis: our legitimate interest in fixing the Studio and answering you.
• Custom pack orders: your email, the brief you write (what you need, the grid and engine, reference links) and, if you give it, your Discord username, so we can make the pack, find your ticket and deliver it. Stripe takes the payment and tells us that it went through; we never see your card. It is kept in our database on Cloudflare, in Western Europe, and in Stripe. Legal basis: the contract you make with us when you order (GDPR Art. 6(1)(b)).
• Security: our providers log requests, including IP addresses, for a short time to keep the site safe. Legal basis: legitimate interest.
• News emails, only if you tick the box: when you make an account you can choose to get an email when new packs and tools come out, about once a week. The box starts unticked. If you tick it, we store your yes and the time you gave it. Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time.

We send you sign-in emails (the one-time code), and Stripe sends receipts and payment notices. News emails go only to people who ticked the box. Each one has an unsubscribe link, or you can email us and we take you off the list. We don't sell your data, and the Studio shows no ads.

Who helps us run the Studio

• Cloudflare hosts the site and runs its database, saved projects and sign-in (the database in Western Europe). It also stores and delivers the pack files, protects the site from bots and records site errors.
• Resend sends the sign-in code emails. It gets your email address and the code.
• Stripe takes payments and runs the billing portal and receipts. For your card details, Stripe is responsible under its own privacy policy. If you use Apple's Hide My Email, Stripe's page asks you for an address for its receipts, because mail from Stripe may not get through Apple's forwarding. The Megabundle is sold by itch.io: when you follow its button, itch.io's own privacy policy applies there.
• Brevo (Sendinblue SAS, France) will send the news emails when we start sending them. It gets only the email address and name of people who ticked the box. Nothing has been sent yet.

Some of these companies are in the United States or have staff there. Transfers outside the EU are covered by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Cookies and browser storage

The Studio uses only what it needs to work. It uses no advertising or statistics cookies.

Stripe's payment page sets its own cookies on stripe.com, under Stripe's policy.

The share buttons are plain links and load nothing from other sites. The site you pick opens only when you click, and its own policy applies there.

Comments on our Instagram and Facebook posts

When you comment on one of our Instagram or Facebook posts, we may answer you in public under your comment and send you one private message with a link to our site or one of our tools. We do this through Meta's official tools. From Meta we read only your comment, your username and the comment's ID; we never see your password or anything else in your account.

We keep a short log of who got a message from us (the username, the time and the link) for up to 12 months, so nobody gets the same message twice. Legal basis: our legitimate interest in answering the people who talk to us. What Meta does with your data on its own platforms is covered by Meta's privacy policy.

How long we keep it

• Your account data stays while your account exists.
• When you ask us to delete your account, we delete it and everything linked to it within 30 days. Payment records we must keep for accounting stay for as long as the accounting and tax laws require. Feedback you sent is the one exception: its link to your account goes, and the message stays so we can still fix what it reports. If it names you, or you want it gone too, we delete it as well.
• Security and error logs are kept for a short time and are not used to identify you.
• The log of private messages we sent after a comment on Instagram or Facebook: at most 12 months.
• Our own visit and tool counts have nothing about you in them. The hourly totals go after 35 days; the daily ones we keep.
• Feedback stays for as long as we need it to answer you and fix the problem, and at most 2 years. Ask us and we delete it sooner.
• A custom pack order stays for 2 years, so we can answer questions about it and redo a lost download; its payment record in Stripe stays as long as the accounting and tax laws require.
• If you unsubscribe from news emails, we stop sending them at once. We keep only the record of when you said yes and no, as proof of your choice.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, to receive it in a portable form, and you can object to uses based on our legitimate interest. Email v3subusiness@gmail.com and we answer within one month. You can also complain to the Commission for Personal Data Protection in Bulgaria (cpdp.bg) or to the data protection authority where you live.

How to have your data deleted

Email v3subusiness@gmail.com and say what you want deleted. For your Studio account, write from the email address of the account. For a comment you left on our Instagram or Facebook posts, give your username there. We delete the account, or the log entry and anything else we got from your comment, within 30 days and confirm by email. You can also delete your comment yourself on Instagram or Facebook at any time.

Children

The Studio is not meant for children under 14, the age of digital consent in Bulgaria. Buying needs an adult, as the terms say.

Changes

If we change this policy, we update the date at the top. If a change matters to you, we email you before it applies. Questions: HeySmile EOOD, v3subusiness@gmail.com.