Privacy policy
Last updated: [date — PLACEHOLDER]
1. Who we are
pagenull is run by {{OPERATOR_NAME}}, a private individual, {{OPERATOR_ADDRESS}} (“pagenull”, “we”). It is not a company. Contact for privacy matters: privacy@pagenull.dev. Full details are in the legal notice.
This policy covers our website and our dashboard, where we are the controller. For documents and data you send through the API, we act as your processor under our data processing agreement.
2. What we process and why
| Data | Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|
| Email, password hash | Providing your account | Contract (6(1)(b)) | Until account deletion |
| API key hashes, monthly render counts | Providing and billing the service | Contract (6(1)(b)) | Until account deletion |
| Request metadata (key id, time, endpoint, status, size, duration) | Usage reporting, abuse prevention, troubleshooting | Legitimate interests (6(1)(f)) | 30 days |
| Saved templates (encrypted) | Rendering them on request | Contract (6(1)(b)) | Until you delete them |
| Campaign tags from the sign-up link (utm_*) | Measuring which channels bring customers | Legitimate interests (6(1)(f)) | Until account deletion |
| Your plan and the Creem customer and subscription ids | Matching payments to your account | Contract (6(1)(b)) | Until account deletion |
| Billing and tax records | Payment records and tax compliance | Legal obligation (6(1)(c)) | [Retention period for a private individual’s tax records — confirm with an accountant] |
| Pixel events, hashed email (only if you accept ad cookies) | Measuring our Facebook/Instagram ads | Consent (6(1)(a)) | Until consent is withdrawn; Meta’s own retention applies |
Documents you render (HTML, URLs, template data, output files) are processed in memory and not stored, and there is no option to store them.
3. Cookies and similar technologies
Two strictly necessary cookies (your login and your cookie choice), and Meta’s advertising cookies only if you accept them. Every one is listed in the cookie notice.
4. Recipients
We use the providers listed on our sub-processors page. We don’t sell personal data.
Paid plans are sold through Creem (Estonia, EU), a merchant of record: Creem is the seller of the subscription, runs the checkout, takes the payment, charges VAT and issues the invoice. We send Creem your account email and an internal user id; the name, billing address, payment details and VAT ID you enter at checkout go to Creem, not to us. Creem processes them under its own privacy policy. We never see card numbers.
5. International transfers
[Hosting region: confirm once the provider is chosen.] Where a provider processes data outside the EEA (e.g. Meta, or a provider Creem uses to process card payments), the transfer relies on [the EU–US Data Privacy Framework / Standard Contractual Clauses — PLACEHOLDER, confirm per provider].
6. Your rights
You can access, correct, export and delete your data, object to processing based on legitimate interests, and withdraw consent at any time. Export and deletion are self-service in Account & data. For anything else, email privacy@pagenull.dev. You can complain to the Bulgarian Commission for Personal Data Protection (CPDP, cpdp.bg) or your local supervisory authority.
7. Security
See privacy & security for the technical measures in plain language.
8. Changes
We’ll email account holders about material changes at least 30 days before they apply.