Legal

Privacy Policy

How we collect, use and protect your personal data. Compliant with the GDPR (EU 2016/679).

Last updated: July 20, 2026

1. Data Controller

Kweedee Ltd, 4 Sydenham Mews, Bray, Co. Wicklow, Ireland. Company registration number: 734723.

Contact: contact@kweedee.com

2. Data We Collect

We only collect what is needed to deliver our service.

• Identification data: first name, last name, email, phone, company name.
• Login data: your password, stored as a bcrypt hash. We never store it in clear text and cannot read it.
• Billing data: Stripe customer reference, payment history, subscription status. No card details are ever stored on our servers. They are handled exclusively by Stripe.
• Content you send us: text, photos and documents submitted with your monthly update requests.
• Proof of consent: the date, version and IP address recorded when you accept our terms or our cookie banner.

3. Legal Basis

• Performance of a contract (Art. 6.1.b GDPR): account creation, website design and hosting, update requests, subscription management.
• Legal obligation (Art. 6.1.c GDPR): keeping invoices and accounting records.
• Legitimate interest (Art. 6.1.f GDPR): account security, fraud prevention, customer support.
• Consent (Art. 6.1.a GDPR): analytics cookies only. You can withdraw it at any time.

4. Processors

We use the following processors, all contractually bound to comply with the GDPR:

• Stripe Payments Europe Ltd (Irlande) processes payments and generates invoices.
• Resend sends our transactional emails. Our sending domain is hosted in Ireland (eu-west-1).
• Cloudflare R2 stores the files you send with your update requests. The bucket is private and set to EU jurisdiction: your files never leave the European Union.
• Railway hosts the application and the database.
• Vercel hosts the public website.
• Google Ireland Ltd audience measurement, subject to your consent.
• Microsoft Ireland Operations Ltd session analysis, subject to your consent.

Some of these providers may process data outside the European Union. Such transfers are covered by the EU-US Data Privacy Framework and by the European Commission standard contractual clauses.

5. Retention Periods

• Account data: for the duration of the contract, then 3 years after our last contact.
• Invoices and accounting records: 10 years, as required by law.
• Update request files: for the duration of the subscription, then 12 months.
• Cookie consent records: 6 months, after which the banner asks you again.

6. Your Rights

Under the GDPR you have the right to access, rectify, erase, restrict, object to and port your data. Write to contact@kweedee.com and we will answer within 30 days.

Some of these rights are directly available from your client area: viewing and editing your data, and cancelling your subscription.

You also have the right to lodge a complaint with the supervisory authority. In Ireland, this is the Data Protection Commission (dataprotection.ie).

7. Security

Passwords are hashed with bcrypt. All traffic is encrypted over HTTPS. Files stored on Cloudflare R2 sit in a private bucket and are only reachable through time-limited signed links. Access to the administration area is restricted and password protected.

8. When We Act as a Processor

For our clients websites, the data entered by visitors (for example through contact forms) is processed on behalf of the client, who is the data controller. In that context Kweedee acts as a processor within the meaning of Article 28 of the GDPR. The applicable commitments are set out in our Data Processing Addendum (DPA).

9. Cookies and Trackers

No tracker is loaded before you consent. On your first visit, a banner asks for your choice. Until you accept, no analytics script is loaded. Refusing is as easy as accepting, and you can change your mind at any time via the "Manage cookies" link at the bottom of every page.

Strictly necessary

These make the site work. They require no consent and cannot be disabled.

• kweedee_consent (local storage): remembers your cookie choice. Duration: 6 months.
• kweedee_lang (local storage): remembers the language you picked. Duration: persistent.
• kweedee_token (local storage, client area only): your session token. Duration: 30 days.

Analytics, subject to your consent

These tools are only loaded if you accept them. They tell us which pages are read and where visitors get stuck. They serve no advertising purpose, and your data is never sold or shared commercially.

• Google Analytics 4 (Google Ireland Ltd). Cookies _ga and _ga_TD78RGHXPZ. Duration: 13 months. Measures visits and pages viewed. Your IP address is anonymised before storage.
• Microsoft Clarity (Microsoft Ireland Operations Ltd). Cookies _clck, _clsk and CLID. Duration: up to 12 months. This tool records your session: your clicks, scrolls and mouse movements are replayed as an anonymous film so we can find where our pages fail. Input fields (passwords, contact details, payment details) are masked and never recorded.

Transfers outside the European Union

Google and Microsoft may process some data in the United States. Such transfers are covered by the EU-US Data Privacy Framework and by the European Commission standard contractual clauses. If you refuse analytics, no data is sent to them.

Proof and duration of your consent

Your choice is recorded and time-stamped, together with the version of the banner it relates to. It is kept for 6 months, after which the banner asks you again. If we add a new analytics tool, your previous consent is invalidated and the question is asked again.

This document is written in English, which is the authoritative version.