Privacy Policy

This privacy policy explains how Favlista ("we", "us", or "our") collects, uses, and protects your personal data when you use our website and services. We are committed to protecting your privacy and ensuring transparency about our data practices.

1. Data Controller

The data controller responsible for your personal data is: Piotr Ciechowicz Schmohlstr. 2 13086 Berlin, Germany Email: hello@favlista.com For any privacy-related inquiries, please contact us at the email address above.

2. Data We Collect

We collect the following types of personal data:

Account Information

Email address (required for registration)
Display name
Profile bio
Avatar image
Website URL
Social media links (Instagram, TikTok, YouTube, X/Twitter)

Analytics and Usage Data

Page views and interactions
Referrer URL (where you came from)
Browser type and version (User-Agent)
Country (derived from IP address via CDN headers)
Device type (mobile, desktop, tablet)
Session identifier (anonymous)

Content Data

Lists you create (titles, descriptions)
Products you add to lists (titles, URLs, prices, images)
Click tracking on product links
View counts on your lists

Payment Information

Payment is processed by Stripe
We do not store your credit card details
We store subscription status and billing history
Stripe may store payment methods on their servers

3. Cookies and Tracking Technologies

We use cookies to provide and improve our services:

Essential Cookies

cc_cookie - Stores your cookie consent preferences (1 year)
Session cookies - Required for authentication and security

Analytics Cookies (Opt-in Only)

_ga - Google Analytics identifier (2 years)
_gid - Google Analytics session identifier (24 hours)

These cookies are only set after you explicitly accept analytics cookies through our cookie banner.

4. How We Use Your Data

To provide and maintain our service
To manage your account and subscription
To process payments through Stripe
To send important service notifications
To analyze usage patterns and improve our service
To prevent fraud and ensure security
To comply with legal obligations

5. Legal Basis for Processing

Contract Performance - Processing necessary to provide our services to you
Consent - Analytics cookies and marketing communications (where applicable)
Legitimate Interest - Security, fraud prevention, and service improvement
Legal Obligation - Tax records, fraud prevention, legal requests

6. Third-Party Services

We share your data with the following third-party service providers:

Google Analytics

Purpose: Website analytics and usage statistics

Data: Page views, user interactions, device information

Location: USA (with Standard Contractual Clauses)

Google OAuth

Purpose: Social login authentication

Data: Email, name, profile picture (from your Google account)

Location: USA (with Standard Contractual Clauses)

Stripe

Purpose: Payment processing

Data: Payment methods, billing address, transaction history

Location: USA (EU-US Data Privacy Framework, Standard Contractual Clauses)

Amazon Web Services EMEA SARL (Amazon SES)

Purpose: Transactional email delivery

Data: Email addresses, email content for verification, password reset, and notifications

Location: AWS Europe (Frankfurt); recipient mail servers may be elsewhere

Cloudflare R2

Purpose: Image storage

Data: Uploaded images (avatars, list cover images, list backgrounds)

Location: Automatic (nearest Cloudflare data center)

netcup GmbH

Purpose: Primary application, database, and backup hosting

Data: Server logs, application data, database storage

Location: European Union

Railway Corporation

Purpose: Temporary hosting rollback during migration

Data: Previous deployment, server logs, application data, and database storage until verified deletion

Location: Existing EU deployment; support and other processing may occur elsewhere

7. Data Retention

Account data - Retained until you delete your account
Analytics data - 26 months (Google Analytics default)
Click/view tracking data - Personal identifiers are anonymized after 30 days; aggregated statistics retained for 26 months
Payment records - 10 years (as required by German tax law)
Cookie consent preferences - 1 year

8. Your Rights Under GDPR

As a data subject in the EU, you have the following rights:

Right to Access - Request a copy of your personal data
Right to Rectification - Correct inaccurate personal data
Right to Erasure - Request deletion of your personal data ("right to be forgotten")
Right to Restriction - Limit how we process your data
Right to Data Portability - Receive your data in a machine-readable format
Right to Object - Object to processing based on legitimate interest
Right to Withdraw Consent - Withdraw consent for analytics cookies at any time
Right to Lodge a Complaint - File a complaint with your local data protection authority

To exercise any of these rights, please contact us at hello@favlista.com.

Supervisory Authority

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the supervisory authority: Berliner Beauftragte fuer Datenschutz und Informationsfreiheit Alt-Moabit 59-61 10555 Berlin Email: mailbox@datenschutz-berlin.de Website: https://www.datenschutz-berlin.de

9. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA). When we transfer your data outside the EEA, we ensure appropriate safeguards are in place: - Standard Contractual Clauses (SCCs) approved by the European Commission - EU-US Data Privacy Framework for certified US providers - Adequacy decisions where applicable You can request a copy of the safeguards we use by contacting us at hello@favlista.com.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including: - Encryption of data in transit (HTTPS/TLS) - Secure authentication mechanisms - Regular security audits and updates - Access controls and monitoring - Secure hosting infrastructure While we strive to protect your data, no method of transmission over the internet is 100% secure.

11. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us at hello@favlista.com.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "last updated" date. We encourage you to review this policy periodically.

13. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or significantly affects you (GDPR Article 22). Analytics data is used only for aggregate statistics and service improvement, and does not result in automated decisions about individual users.

14. Contact Us

If you have any questions about this privacy policy or our data practices, please contact us at: Email: hello@favlista.com Piotr Ciechowicz Schmohlstr. 2 13086 Berlin, Germany