Privacy Policy

1. Who is responsible for your data

The data controller is D+Studio EOD (UIC/EIK 207432908). For any privacy question or to exercise your rights, contact contact@reallyfinal.app.

2. What we collect

• Account data: your name and email, handled through our authentication provider when you create an account to get paid.
• Files and transfer details: the files you upload, any note you add, the price you set, and the recipient link.
• Payment data: processed by Stripe. We receive transaction metadata (amount, status, payout records) but never store full card numbers.
• Technical and usage data: IP address, device/browser information, and logs needed to run and secure the service.

3. Why we use it, and our legal bases

• To provide the service: store and deliver your transfers (performance of a contract, GDPR Art. 6(1)(b)).
• To process payments and payouts (contract, and legal obligations such as accounting and tax).
• To keep the service secure and prevent fraud and abuse (legitimate interests, Art. 6(1)(f)).
• To communicate with you about your transfers and account.
• To comply with legal obligations we are subject to.

4. Your files

Files are stored within the European Union, encrypted in transit and at rest, and are accessible only via the transfer link. They are automatically deleted 30 days after the transfer is created.

5. We do not train AI on your content

We do not use your files, notes, or transfer content to train machine learning or AI models, and we do not sell your personal data.

6. Service providers (sub-processors)

We rely on a small set of providers to run reallyfinal. They process data on our behalf under data-processing agreements:

• Clerk: authentication and account management.
• Stripe: payment processing and payouts.
• Cloudflare R2: encrypted file storage (EU).
• Resend: transactional email.
• Vercel: application hosting and delivery.
• Neon: managed database.

7. International transfers

Some providers above are based outside the EU/EEA. Where personal data is transferred internationally, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

8. How long we keep data

• Transfer files: 30 days, then automatically deleted.
• Account data: for as long as your account is active, then deleted within 90 days of closure.
• Payment and tax records: retained for the period required by applicable accounting and tax law (generally up to 10 years).

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent where processing is based on consent.

To exercise any of these, contact us at contact@reallyfinal.app. You also have the right to lodge a complaint with the data protection authority in your country of residence.

10. Cookies

We use only the cookies needed to run the service, for example, the session cookies our authentication provider sets to keep you signed in. We don’t use advertising or cross-site tracking cookies.

11. Children

reallyfinal is not intended for anyone under 18, and we don’t knowingly collect their data.

12. Changes

We may update this policy; the “last updated” date above reflects the current version. Material changes will be communicated where appropriate.