Privacy policy

1. Who is responsible

Byte Bunny S.L.U. is the controller of the personal data described in this policy. Our registration details and postal address are on the legal notice page. For anything about your data write to privacy@bunnyown.com.

2. Data we process as a controller

• Account and workspace data — name, email address, the company you represent, your role, sign-in events, your language and theme, and what you do in the dashboard. Basis: performing the contract with the business you represent (art. 6(1)(b) GDPR) and our legitimate interest in keeping the service secure (art. 6(1)(f)).
• Billing data — billing contact, invoices, payment status. Card details are entered on our payment provider's pages and never reach us. Basis: the contract and our legal obligations to keep accounting records (art. 6(1)(c)).
• Acceptance records — which version of the terms you accepted, when and from which IP address. Basis: our legitimate interest in being able to prove the contract.
• Visitors of bunnyown.com — we run our own, cookieless analytics: pages viewed, referrer, country, browser type, with no identifier that follows you across sites. Basis: legitimate interest in understanding how the site is used. The only cookies we set are the ones needed to keep you signed in and to remember your language and theme; there is no advertising or tracking cookie, so there is no cookie banner.
• Email you send us — the message and address, to answer you. Basis: legitimate interest, or the contract when you are a customer.

3. Data we process for our customers

When you book, enquire, pay or write through a website a business runs on BunnyOwn, that business is the controller of your data and we process it on its behalf under our Data Processing Agreement. Ask that business first; we forward any request we receive to them and help them answer it.

4. Who receives data

Our service providers, each bound by a data-processing contract: Hetzner Online GmbH (hosting, Germany and Finland), Cloudflare, Inc. (DNS, delivery and protection; data processing addendum and EU–US Data Privacy Framework certification), Stripe Payments Europe, Ltd. (payments, Ireland) and Resend, Inc. (email; standard contractual clauses). Public authorities when the law obliges us. Nobody else, and never for their own marketing.

5. How long we keep data

Account and workspace data for the term of the contract and 30 days after, then it is deleted (backups expire within a further 30 days). Invoices and accounting records for six years, as Spanish commercial law requires. Acceptance records for as long as the account exists. Analytics data is aggregated and holds no identifier. Email correspondence for two years.

6. Your rights

You may ask us for access to your data, its rectification or erasure, restriction of processing, portability, and you may object to processing based on legitimate interest. Write to privacy@bunnyown.com; we answer within one month. You may also complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es), or the authority of your own country.

7. Security

Data is encrypted in transit and at rest, isolated per customer, backed up daily, and accessible only to named operators with a need to access it. Sign-in is handled by a dedicated identity provider; we never see your password.

8. Changes to this policy

When this policy changes materially we publish the new version here with its date and email every account holder. Earlier versions stay readable on this page. The English text is the binding version.