DRAFT — PO validation required (D-7) before publication.
Document revision: v1.2 (draft).
Privacy Policy
MySmartBusiness — SaaS platform published by TANARIEL EOOD
Last updated: [PUBLICATION DATE]
1. Data controller
The controller of the personal data described in this policy is:
TANARIEL EOOD Single-member limited liability company incorporated under Bulgarian law EIK: 206851287 — VAT no.: BG206851287 Registered office: bd James Bourchier 99, floor 2, apartment 5, Lozenets district, 1407 Sofia, Bulgaria Manager: Mr DEVAUX Jean-Bernard Hubert Raoul Data protection contact: privacy@mysmartbusiness.eu
Dual role. TANARIEL EOOD acts as the data controller for the data described in this policy (account, billing and Platform usage data). For the data that our clients process via the Platform concerning their own contacts and end customers (CRM records, members, email/SMS campaign recipients, review authors, etc.), the client is the data controller and TANARIEL EOOD acts as the data processor within the meaning of Article 28 of the GDPR; such processing is governed by our General Terms and Conditions (article "Protection of personal data").
2. Data collected
We collect the following categories of data:
a) Account and identification data — surname, first name, email address, password (hashed), language, time zone, telephone number where applicable, passwordless login credentials (WebAuthn keys/passkeys, magic links).
b) Professional and billing data — company name, address, country, tax / intra-EU VAT identification number, history of subscriptions, orders, invoices and payments. The card number and security code never pass through our servers: they are collected and stored exclusively by our payment provider Stripe, and we retain only a payment-method identifier and the last four digits. We do, however, retain the provider's full response for each payment, together with the notifications (webhooks) it sends us; those records contain, among other things, your name, email address and billing address as the provider returns them. Webhook logs are purged automatically (30 days once processed, 60 days otherwise); the response attached to a payment is kept with that payment.
c) Usage data and technical data — connection and activity logs, IP address, browser and device type, pages viewed, actions performed within the Platform, diagnostic and security data.
d) Communications — exchanges with support, notifications sent, communication preferences.
e) Approximate geolocation data — country/region inferred from the IP address, used for short-link routing and the associated click statistics. VAT is NOT calculated from this geolocation: it is based on the billing country you declare.
f) Domain-name searches — the searched name, requested number of suggestions, names excluded from suggestions and suggested results. A searched name may be personal data where it identifies a person. To generate AI-assisted suggestions, these elements are sent to OpenRouter and the model providers to which the request is routed (see section 4).
Special categories of data ("sensitive" data). We do not request any special category of data within the meaning of Article 9 of the GDPR: no field of the Platform asks for it, none of the purposes described in section 3 depends on it, and we build no profile from it. We cannot, however, guarantee that none passes through: the free-form content that you or your users enter or upload — files, the subject and body of emails and SMS, free-text fields on records — is transmitted and stored as-is, without any inspection of its nature. Where such data is present, it is processed solely within the scope of the service concerned and under the responsibility of whoever introduced it.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Account creation and management, provision of the Services | Performance of the contract (b) |
| Invoicing, collection, accounting | Performance of the contract (b) and legal obligation (c) |
| Calculation and collection of VAT, tax obligations | Legal obligation (c) |
| Platform security, prevention of fraud and abuse | Legitimate interest (f) |
| Customer support and communication relating to the service | Performance of the contract (b) |
| Improvement of the Services, aggregated internal statistics | Legitimate interest (f) |
| Information on developments in the Services and the Provider's offers | Legitimate interest (f), with a right to object at any time |
| Management of the affiliate programme (attribution, commissions) | Performance of the contract (b) |
| Compliance with authorities' requests and dispute management | Legal obligation (c) and legitimate interest (f) |
We never sell your personal data and do not use it for third-party advertising purposes.
4. Recipients and sub-processors
Your data is accessible to authorised staff of TANARIEL EOOD and to the providers listed below.
The data each provider receives depends on the service used and is detailed below. Legal roles differ according to the processing: processing on behalf of a controller under Article 28 of the GDPR must be distinguished from processing for which the provider determines its own purposes. A provider's registered office does not necessarily indicate where data is stored or accessed.
| Provider | Role | Data transmitted | Legal characterisation | Location and establishment | Transfers |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Hosting of the Platform and databases | All hosted data | Processor; data processing agreement accepted | European Union | Not applicable to hosting within the EU |
| Cloudflare (R2) | Storage of database backups | A full copy of the databases, in encrypted form: the data is encrypted on our servers before it is sent and the provider never holds the key | Processor, under the agreements applicable to the service | Bucket in a European Union region; other processing and access depend on the service terms | EU storage and encryption alone do not exclude every transfer; see section 5 |
| Stripe — Stripe Payments Europe, Limited for EEA accounts under its agreement | Collection of payments | Amount, currency, invoice number, internal invoice and client identifiers, receipt email address, and the billing identity (business name, street, city, postcode, country) | Mixed role: processor for carrying out the payment you request; independent controller for its own regulatory obligations (fraud prevention, legal and prudential requirements), for which it alone determines the purposes | EU / United States | See section 5 |
| Mailgun (Sinch) — its policy identifies Mailgun Technologies, Inc. | Sending of emails from the Client's modules: campaigns (MySmartMailing), journeys (MySmartJourneys) and membership card campaigns | Sender, recipient, the full subject and body of the message (HTML and text), attachments where present, reply-to address, attribution tags and open- and click-tracking instructions | Processor, under the agreements applicable to the service | EU endpoint api.eu.mailgun.net where configured; the effective region depends on the account and sending domain |
The sending region alone does not describe all access and transfers; see section 5 |
| Migadu-Mail GmbH (Migadu) | Email mailbox hosting (MySmartEmail module) | Domains, addresses, display names, aliases and destinations, send and receive permissions, mailbox passwords, email contents and attachments, and the metadata necessary for routing and storage | Processor for mailbox hosting, under the agreements applicable to the service | Registered office in Switzerland; data centres in France according to the provider's documentation. This is not an account-specific guarantee of all processing and access locations | Distinguish storage in France from any processing in Switzerland or elsewhere; see section 5 |
| Internet.bs (registrar — see Domain Name Registration Policy, Art. 1.3) | Domain name registration and management | For the contact roles accepted by the extension: first name, last name, organisation, email, telephone, full address, city, postcode, country and, depending on the extension, language or other eligibility data. The requester's IP address is also transmitted where available for registration | Internet Domain Service BS Corp. (Bahamas) and CentralNic Group PLC (United Kingdom) declare themselves joint controllers, rather than processors, for their own purposes | Bahamas / United Kingdom | See section 5 |
| Gandi SAS (registrar — see Domain Name Registration Policy, Art. 1.3) | Domain name registration and management | Contact details required for the operation: first name, last name or organisation, email, telephone, postal address and extension-specific eligibility data. Fields and roles transmitted are adapted to the registrar and registry; they are not necessarily identical to those sent to Internet.bs | Independent controller for its own registration and regulatory obligations | France | See section 5 for any onward recipients |
| — and the domain name registries | Allocation and publication of domain names | The same contact data, passed on by the registrar for the name concerned | Separate recipients, whose role and location depend on the extension requested (.com, .fr, .bg…) | Depending on the extension | See section 5 |
| TOPefekt s.r.o. (BulkGate) | Sending of SMS outside Bulgaria | Recipient's number, the full body of the message, sender name, tracking reference | Processor for sending; independent controller for retention required by its own legal obligations, according to its policy | Company established in the Czech Republic; onward routing by the destination country's operators | Depends on the routing chain and recipient's country; see section 5 |
| Mobica OOD (Мобика ООД), EIK 201937622 | Sending of SMS to Bulgaria (+359 numbers) | Recipient's number, the full body of the message, sender name, tracking reference | Processor for sending, under the agreements applicable to the service | Bulgarian company; gate.mobica.bg gateway and routing operators |
Establishment in Bulgaria alone does not describe the entire processing chain; see section 5 |
| OpenRouter, Inc. and model providers | AI-assisted generation of domain-name suggestions | Searched name (the part before the extension), requested number of suggestions and, depending on the request, up to 100 names excluded from suggestions; these names may identify a person. Registrant contact details and CRM contents are not part of these requests | OpenRouter routes requests to distinct model providers; their roles and processing for their own purposes depend on the applicable terms and agreements | Processing locations depend on routing and the model provider; the model's name alone does not establish them | See section 5; no guarantee of exclusively EU processing is given here |
| OpenAI | AI-assisted import of contacts into the CRM (MySmartClients module) | Full text of the document pasted by the Client (up to 50,000 characters), which usually contains the names, email addresses, phone numbers, addresses and other information of the Client's contacts, and the document type indicated. The extracted contacts are returned to the Platform | Processor, under the terms and data processing addendum applicable to the API account; retention of requests depends on those terms | OpenAI infrastructure; no EU-only location is guaranteed here | See section 5 |
| Microsoft (Azure AI Translator) | Machine translation of menu content (MySmartMenu module) | Full text of the menu content entered by the Client (menu name, description and footer, category and product names and descriptions, variant names), sent in batches only when a user of the Client triggers the translation. This text does not normally contain personal data, but may contain some if the Client enters it (for example a person's name or a telephone number). The translated texts are returned to the Platform and stored in the menu translations | Processor, under the Microsoft Products and Services Data Protection Addendum (DPA) applicable to the Azure account; according to the service's No-Trace policy, submitted texts are not written to persistent storage and are not used for training. Acceptance of these terms for the account remains to be verified before publication | Resource deployed in the Azure France Central region (Paris). Translation requests are sent to the service's Europe endpoint, which processes them in the Azure France Central or West Europe (Netherlands) regions, according to the Microsoft documentation. Contracting entity: Microsoft Ireland Operations Limited, under the Microsoft Customer Agreement applicable to the account | See section 5 |
| Hetzner Online GmbH (Object Storage) | Storage of uploaded files (MySmartFiles module) | The full content of the files, their name, a path containing your environment's identifier, and whether they are public or private | Processor | Nuremberg, Germany (EU) — nbg1 region |
Not applicable (EU) |
| European Commission (VIES) | Verification of intra-EU VAT numbers | VAT number and country code provided by the Client | Recipient; a European Commission service, which determines its own processing | European Union | Not applicable (EU) |
| Ploi (ploi.io) | Administration and deployment of the Platform's servers | No data is sent deliberately; the service has administrative (root) access to the servers and can therefore technically access all hosted data | Processor, under the terms applicable to the service | As set out in the provider's terms | See section 5 |
| Google (Web Risk, a Google Cloud service) | Reputation check of destination addresses (MySmartLinks module) | Complete destination address (domain, path and parameters) of a link or rule, when the Client creates, edits, duplicates or reactivates it, or during an audit of destinations. No data is sent when a visitor clicks | Processor, under the Google Cloud terms and data processing addendum applicable to the account | Google infrastructure; no EU-only location is guaranteed here | See section 5 |
| Google (Google Wallet) | Adding and updating membership cards in Google Wallet (MySmartMembership module) | Member's first and last name, card number, QR code token, card type, validity dates, number of visits used and remaining, card status, business name and logo, and the title and text of notifications sent to the card | Role under the Google Wallet API terms applicable to the account; Google also processes wallet data for its own purposes in its relationship with the member | Google infrastructure; no EU-only location is guaranteed here | See section 5 |
| Apple (Apple Wallet and Apple Push Notification service) | Updating membership cards added to Apple Wallet (MySmartMembership module) | The card (.pkpass file) is generated on our servers and downloaded by the member directly from the Platform. For each update, Apple receives the device push token and the card type identifier; the card content is not included in the notification | Role under the applicable Apple Developer Program terms; Apple also processes wallet data for its own purposes in its relationship with the member | Apple infrastructure; no EU-only location is guaranteed here | See section 5 |
Only one file-storage provider is active at a time. The Platform is technically able to address any S3-compatible object storage (currently Hetzner Object Storage) or DigitalOcean Spaces, but only one is configured and actually receives files; only that one appears in the table.
MaxMind is not a recipient of your data: geolocation is performed locally, against a GeoLite2 database downloaded periodically onto our servers. No visitor IP address is sent to MaxMind for that lookup.
Platform emails. Emails sent by the Platform itself (account creation, sign-in links, invoices, notifications) and review requests from the MySmartReviews module go through a mail server operated by TANARIEL EOOD; they do not pass through Mailgun.
Domain suggestions and AI models. OpenRouter is an intermediary distinct from the provider running the model. The model currently used is Mistral Nemo (mistralai/mistral-nemo), also the software default. That name establishes neither hosting by Mistral nor an EU location. The model may change; information about the model and affected data flows is then updated, and changes to recipients or processing remain subject to applicable information and processing-agreement obligations. According to OpenRouter's policy, retention periods and any reuse of requests by model providers vary with their terms and applicable settings. We do not present choosing a model as a guarantee of no retention, no reuse for training or no processing outside the EU.
Card numbers and security codes never pass through our servers. The payment form is made up of fields supplied and isolated by Stripe, and card data is sent directly from your browser to Stripe, without going through the Platform.
The data may also be disclosed to the competent authorities where required by law.
5. Transfers outside the European Union
Transfers outside the European Economic Area may involve processors as well as recipients acting as controllers for their own processing, including registrars and registries. Whether a transfer occurs depends on the entities receiving the data and the access made available to them; the registered-office country or storage region alone does not establish or exclude a transfer.
Chapter V of the GDPR provides, in particular, for the following mechanisms:
- a European Commission adequacy decision, where the destination country or organisation is actually within its scope;
- standard contractual clauses (SCC), where validly concluded for the transfer concerned, with any necessary supplementary measures.
This list describes possible legal mechanisms: it does not mean that SCC have been signed or that a certification covers every recipient in the table. For information about the recipients, countries and safeguards actually applicable to a service, or to request a copy of existing safeguards, write to privacy@mysmartbusiness.eu. Backup encryption is an additional security measure; it does not replace assessment of a transfer's conditions.
6. Retention periods
| Data | Period |
|---|---|
| Account and Tenant data (client environment) | Term of the contract, then 30 days after the effective termination date (J+30) for data retrieval; the active environment is then erased by the Provider, subject to statutory retention obligations |
| Archive of the environment taken before erasure | Restricted access, then deleted 30 days after erasure of the active environment |
| Daily encrypted database backups | Each backup is deleted 30 days after it is taken; data of an erased environment therefore remains in them for no more than 30 days after the erasure |
| Invoices and accounting records | 10 years (legal obligation) |
| Payment webhook logs | 30 days once processed, 60 days otherwise — purged automatically |
| Failed background jobs | 7 days — purged automatically |
| Magic links (passwordless sign-in) — email, IP address, browser | 30 days — purged automatically every day |
| Application technical logs (files) | 14 days, automatic rotation |
| Activity and sign-in histories recorded in the Platform | Currently kept with no automatic expiry |
| Click statistics for short links (MySmartLinks module): IP address and browser in hashed form, country, region, city, device type, operating system, browser, referring site, language | Depending on the Client's tier: 30 days, 90 days, 1 year or 2 years, then automatic deletion; no limit on the highest tier |
| Exchanges with support | Term of the contract + 3 years |
| Data relating to affiliate commissions | No automatic expiry is applied — see the note below |
| Strictly necessary cookies | Duration of the session or the limited period necessary for the function (see section 8) |
Erasure of a client environment. The starting point J is the effective termination date, rather than the date of the termination request. The Client has the following thirty days to retrieve its data. Once that period has elapsed, the Provider carries out the erasure: the active environment and its Client Data are deleted, and identifying data held outside that environment (account, subscription file, environment contact details) is anonymised. This erasure is an operation performed by the Provider after J+30, not an automatic process on a fixed date. An archive of the environment, taken just before erasure and stored separately with restricted access, is deleted thirty (30) days after the erasure; it is not used to continue the service. Invoices, payments and accounting records subject to a statutory obligation are retained for ten (10) years, limited to the data necessary for that obligation. Mandatory retrieval and switching rights, including those described in Article 10.4 of the General Terms, continue to apply according to their own time limits. To exercise your rights or obtain confirmation of erasure, write to privacy@mysmartbusiness.eu.
About affiliate commissions. Commission records can be neither edited nor deleted from our administration interface, and no automatic task erases them when your participation in the programme ends. They are retained together with the payment and credit entries they relate to, subject to the applicable statutory accounting and tax periods. You may request their erasure at privacy@mysmartbusiness.eu, within the limits of those obligations.
7. Your rights
In accordance with the GDPR, you have the following rights over your personal data:
- Right of access (Art. 15) — obtain a copy of your data;
- Right to rectification (Art. 16) — correct inaccurate or incomplete data;
- Right to erasure (Art. 17) — within the limits of statutory retention obligations, and subject to the domain-name reservation set out below;
- Right to restriction of processing (Art. 18);
- Right to portability (Art. 20) — receive your data in a structured and commonly used format;
- Right to object (Art. 21) — in particular to processing based on legitimate interest and to commercial communications;
- Right to withdraw your consent at any time, where processing is based on it, without affecting the lawfulness of prior processing.
Domain-name reservation. The data of a domain name's holder (the registrant) is passed to the registrar and then to the registry of the extension concerned, which retain it by virtue of the registration itself. For as long as the domain is active, that data cannot be erased in isolation: erasing it requires deleting the domain or transferring it to another holder, which is your decision to make. We therefore cannot guarantee erasure of that data on request alone without the fate of the domain being settled. Likewise, erasing your client environment deletes our local records but has no effect on those held by the registrar and the registry.
To exercise these rights, write to privacy@mysmartbusiness.eu, providing proof of your identity. We respond within one (1) month, extendable by two (2) months for complex requests.
You also have the right to lodge a complaint with a supervisory authority, in particular the Bulgarian Commission for Personal Data Protection (КЗЛД / CPDP — www.cpdp.bg) or the authority of your country of residence (e.g. the CNIL in France).
Note for end data subjects: if your data is processed by one of our clients via the Platform (e.g. you are a contact in a client's CRM or a campaign recipient), please address your request first to that client, who is the data controller. We will forward to our client any request received directly.
8. Cookies
The Platform uses exclusively strictly necessary cookies for its operation:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Maintaining the authenticated session | Session (expires after a period of inactivity) |
| CSRF token | Protection against request forgery | Session |
"Remember me" cookie (remember_…) |
Set only if you tick "Remember me" when signing in, to sign you back in automatically on later visits | 30 days, or until you sign out |
Besides cookies, the Platform stores some information in your browser's local storage (localStorage / sessionStorage), equally strictly necessary:
| Information | Purpose | Duration |
|---|---|---|
| Application session token | Keeping you signed in within the application | Until you sign out |
| Display preferences (language, theme, navigation) | Remembering your interface choices | Until you clear them |
| Scanner station session (Membership module) | Keeping a scanning station signed in on a shared device | 8 hours, renewed each time the page is opened, within an absolute limit of 30 days from the station's authentication; cleared when the station signs out, or on the first opening after either deadline |
| Form display marker (Emailing module) | Avoiding showing the same sign-up form twice during one visit | Lifetime of the tab |
Apart from the "remember me" cookie, which is set only if you explicitly ask for it, these cookies and items are essential to the provision of the service. No advertising, profiling or third-party tracking cookies are used. Should any non-essential cookies be introduced, they would be subject to your prior consent via a dedicated banner and this policy would be updated.
Email tracking. Tracking of email-campaign opens and clicks is enabled by default and depends on the client’s sending settings. Review-request emails currently include a tracking pixel that can record the opening of the message associated with its recipient. These trackers are distinct from the necessary cookies described above. The sending client is responsible for informing recipients and establishing the legal basis for its use: consent to receive marketing emails does not, by itself, constitute consent to tracking opens and clicks. Where separate consent is required under the rules applicable to the purpose pursued, it must be obtained before tracking and be capable of withdrawal. Default activation and campaign settings do not relieve the client of these obligations or prove each recipient’s consent.
For emails sent through Mailgun, tracked opens and clicks are recorded by Mailgun, including the recipient's IP address and browser, and then passed to the Platform.
Third-party resources. The Platform's fonts are hosted on our own servers: displaying them sends no data to any third party. Some pages, however, load display libraries from third-party content delivery networks, which therefore receive your IP address:
| Content delivery network | Pages concerned |
|---|---|
cdn.tailwindcss.com |
Public review pages, member portal, two-factor verification page |
cdn.jsdelivr.net |
Member portal, payment page |
ui-avatars.com |
Account dashboard and administration interface (default avatar, which also sends the initials of the name) |
The payment page also loads js.stripe.com, required by the payment provider listed in section 4.
9. Security
We implement appropriate technical and organisational measures (Art. 32 GDPR), in particular: encryption of communications (TLS), password hashing, strong authentication available (2FA, WebAuthn/passkeys), isolation of client environments (dedicated database per Tenant), daily backups, encrypted before transmission and kept outside the production infrastructure, within the European Union, logging, access control on the principle of least privilege.
In the event of a data breach likely to give rise to a risk to your rights and freedoms, we will notify the competent supervisory authority and, where applicable, the data subjects, in accordance with Articles 33 and 34 of the GDPR.
10. Amendments to this policy
We may update this policy to reflect legal, technical or Service developments. Any substantial amendment is notified to clients (email and/or notification within the Platform) before it takes effect. The date of the last update appears at the head of the document.
11. Contact
For any question relating to this policy or to the processing of your personal data:
TANARIEL EOOD — bd James Bourchier 99, fl. 2, ap. 5, Lozenets, 1407 Sofia, Bulgaria Email: privacy@mysmartbusiness.eu