Privacy Policy

The short version

This site is run by True Brew Birdie Ltd, a company in Cyprus (EU). Because we are established in the EU, the General Data Protection Regulation (GDPR) applies to everything we do with your data, wherever you live. This policy explains it in plain English.

• We collect what you give us at checkout (name, email, country and postcode) and what your browser sends (IP address, device, pages viewed). Payment details go directly to Stripe.
• We use the Meta advertising pixel. This site is a campaign landing page: the pixel runs for every visitor and there is no cookie banner. See section 5.
• We never sell your data for money. The ad pixel counts as "sharing" under California law. You can opt out at any time via Your choices.
• Contact us to access, correct, export or delete your data. We answer within 30 days.

1. Who is responsible

The data controller is:

True Brew Birdie Ltd
Gladstonos 12-14, 8046 Paphos, Cyprus
Registration HE 424693, VAT CY10424693Y
Director: Jan Kutschera

We have not appointed a data protection officer because we are not required to. Privacy questions go to the contact details above and are handled by the director personally.

2. What data we collect

Data you give us

• Contact data. First name, last name and email address, entered at checkout.
• Purchase data. What you bought, price, currency, country and postcode (for tax), refund history. Card numbers go directly to Stripe. We never see or store them.
• Communications. Messages you send us.

Data collected automatically

• Technical data. IP address, the country derived from it (used to preselect your country at checkout), browser, operating system, device type, language, referring URL.
• Usage data. Pages viewed, checkout started, purchase completed.
• Identifiers. The cookies and similar identifiers listed in section 6.

Data we receive from others

• Payment partner. Stripe (payment status, fraud signals, tax location).

3. Why we use your data and on what legal basis

GDPR requires a legal basis for each purpose. Here they are.

• Selling and delivering the product. Data: contact, purchase. Legal basis: contract (Art. 6(1)(b)).
• Processing payments, receipts, refunds and tax. Data: purchase, country, postcode, IP. Legal basis: contract; legal obligation (Art. 6(1)(c)) for tax and accounting.
• Measuring and optimising advertising, building audiences for ads. Data: identifiers, hashed email, usage, purchase events. Legal basis: legitimate interest (Art. 6(1)(f)), because this site is a campaign landing page (see section 5).
• Customer support and answering your messages. Data: communications. Legal basis: legitimate interest; contract.
• Security, fraud prevention, abuse detection, enforcing our terms. Data: technical, purchase. Legal basis: legitimate interest; legal obligation.

Where we rely on legitimate interest, we have balanced it against your rights. You can object at any time (see section 10). Providing data for a purchase is a contractual requirement.

4. Automated decisions and profiling

No decision with legal or similarly significant effect is made about you automatically. Meta may use the events we share with it to decide which ads to show you. That is profiling for advertising. Section 5 explains the legal basis and how to object.

5. Advertising and measurement

This site uses no analytics tool. It uses one advertising tool:

• Meta Pixel to measure which ads lead to purchases and to show you relevant ads on Meta's platforms. It runs in your browser on every page of this site and sends Meta event data (page view, checkout started, purchase, value) and technical data (IP address, browser, Meta's cookie identifiers). Meta acts as an independent controller for what it does with the data on its side.
• Meta Conversions API: not active yet. Once switched on, our server will also send Meta the purchase event with one-way hashes of your email address, name, postcode and country, so Meta can match it to its users. We will update this section before we switch it on.

Campaign landing page. This site is a page we run paid ads to. We do not show a cookie banner, and the measurement tool above runs for all visitors on the basis of our legitimate interest in knowing whether our advertising works. We limit the data to what is needed for attribution, and you can still object: use the platform opt-outs below or contact us. We are aware that supervisory authorities in some EU countries read the law more strictly, and we have chosen this approach knowingly.

Platform opt-outs. Meta ad preferences, Your Online Choices (EU), DAA opt-out (US).

6. Cookies and similar technologies

• __stripe_mid, __stripe_sid (set by Stripe). Fraud prevention during checkout. Lifetime: 1 year / 30 minutes. Essential.
• _fbp, _fbc (set by Meta). Ad attribution. Lifetime: 90 days. Marketing.
• Checkout entries in your browser's storage (set by us). They remember the state of your payment so that reloading the page neither loses nor repeats it, and so that a purchase is counted once. They are used only to confirm your payment with Stripe. Essential.

7. Who we share data with

We share personal data only with providers that help us run the business, under contracts that bind them to protect it, or where the law requires it. We do not sell personal data.

• Vercel. Website hosting, serverless functions. Location: USA (EU-US Data Privacy Framework).
• Cloudflare. Hosting of a copy of the sales and legal pages. Location: global (DPF).
• Stripe. Payments, tax calculation, receipts. Location: USA and Ireland (DPF).
• Meta Platforms. Advertising measurement and audiences. Location: USA (DPF).
• Google. Google Fonts: the fonts on this site load from Google's servers, which receive your IP address. Location: USA (DPF).

We may also disclose data to professional advisers (accountants, lawyers), to authorities where legally required, and to a buyer if the business is sold, in which case this policy continues to apply.

8. International transfers

We are in Cyprus. This site has no customer database of its own: your order is recorded with Stripe. Several providers process data in the United States. For those we rely on the EU-US Data Privacy Framework where the provider is certified (marked "DPF" above), and otherwise on the European Commission's Standard Contractual Clauses plus a transfer risk assessment. The UK and Swiss extensions of the DPF and the UK International Data Transfer Addendum cover transfers from those countries. You can request a copy of the safeguards.

9. How long we keep data

• Orders and payment records: 6 years after the end of the tax year (Cyprus tax law).

10. Your rights

Under GDPR (and the UK GDPR and Swiss data protection law) you can:

• Access the personal data we hold about you and get a copy.
• Correct inaccurate or incomplete data.
• Delete your data ("right to be forgotten"), unless we must keep it, for example invoices.
• Restrict processing while a dispute is resolved.
• Export the data you gave us in a machine-readable format.
• Object to processing based on legitimate interest, including any direct marketing, at any time.
• Withdraw consent at any time. This does not affect processing that already happened.
• Complain to a supervisory authority. Ours is the Office of the Commissioner for Personal Data Protection, Cyprus (dataprotection.gov.cy). You can also complain to the authority where you live, for example the ICO in the UK.

To use any of these rights, contact us (section 16) from the email address you used at checkout, or tell us how to verify it is you. We reply within 30 days and do not charge for reasonable requests.

11. Your choices

• Advertising. Use the platform opt-outs in section 5, or contact us to object.
• Cookies. You can block or delete cookies in your browser settings. The checkout still works without the Meta cookies.

12. Additional information for US residents

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another US state with a comprehensive privacy law, the following applies in addition to the rest of this policy.

Categories collected. Identifiers (name, email, IP address, cookie IDs, hashed email); customer records (purchase history, billing details); commercial information; internet activity (pages viewed, clicks); approximate geolocation. Sources: you, your device, and the partner in section 2. Purposes: section 3.

Selling and sharing. We do not sell personal information for money. We do "share" identifiers, internet activity and commercial information with Meta for cross-context behavioral advertising. We do not knowingly share the data of anyone under 16. Opt out via the platform opt-outs in section 5 or by contacting us. We do not use or disclose sensitive personal information beyond what is needed to provide the service you asked for.

Your rights. You can request to know what we collect, correct it, delete it, receive a portable copy, opt out of sharing and targeted advertising, and limit the use of sensitive personal information. We will not discriminate against you for exercising these rights. We verify requests by matching the email address you used at checkout; an authorised agent must provide your written permission. We respond within 45 days and can extend once by another 45 days. If we deny a request you can appeal by replying to our decision.

Retention is described in section 9. We do not engage in profiling that produces legal or similarly significant effects.

13. Additional information for other regions

• United Kingdom. The UK GDPR gives you the rights in section 10. We have no UK establishment; contact us at the details below. The ICO is at ico.org.uk.
• Australia. We handle personal information in line with the Australian Privacy Principles. Complaints can go to the OAIC (oaic.gov.au) if we cannot resolve them.
• Canada. We comply with PIPEDA. You may contact the Office of the Privacy Commissioner of Canada.
• Brazil. Under the LGPD you have the rights to confirmation, access, correction, anonymisation, portability, deletion and information about sharing. Our director acts as the contact point (encarregado).
• Switzerland. The revised Federal Act on Data Protection applies. Transfers abroad rely on the Swiss-US DPF or recognised standard contractual clauses.
• New Zealand, Singapore, Israel, UAE and elsewhere. You have at least the rights of access and correction under local law, and we honour the GDPR rights in section 10 for everyone.

14. Security

All traffic is encrypted (HTTPS). Payment card data never touches our servers: it goes straight to Stripe. Our secrets are access-controlled. No system is perfectly secure. If a breach affects your data we will inform you and the authorities as the law requires.

15. Children and changes to this policy

Our products are for business owners and are not directed at anyone under 18. We do not knowingly collect data from minors. If you believe a minor has given us data, contact us and we will delete it.

When we add a new tool or provider we update this page and the effective date at the top. Previous versions are available on request.

16. Contact

True Brew Birdie Ltd
Gladstonos 12-14, 8046 Paphos, Cyprus
Phone: +357 95953180
Full company information