GDPR Privacy Notice (Articles 13 & 14)
Privacy Policy
Effective Date: November 14, 2026 · Data Controller: IDEALAPPS LLC
1. Data Controller Identity & Contact Details
This Privacy Policy explains how IDEALAPPS LLC (Tax ID: 420435997), acting as Data Controller under Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), collects, uses, stores, and protects your personal data.
2. Personal Data We Collect
- Identity & Contact Data: First name, last name, email address, phone number, company name, tax identification number, postal billing address (street, city, state, country), and preferred currency.
- Authentication & Security Data: Hashed password, security stamp, email verification status, temporary Email 2FA codes, and WebAuthn passkey public keys.
- Billing & Payment Data: Active and historical subscriptions, invoice snapshots, payment records, transaction references, and—when paying via Flitt recurring card processing—your masked card reference and an encrypted recurring payment token (rectoken). We never store raw card numbers or CVV codes.
- Support & Task Data: Custom task requests, support tickets, messages, and file attachments uploaded by you or your sub-accounts.
- Consent & Audit Logs: Timestamps of your acceptance of our Terms of Service and Privacy Policy (terms_accepted_at, privacy_accepted_at), cookie consent choices, IP addresses, and security/account activity logs.
3. Purposes & GDPR Legal Bases for Processing
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Account registration, service provisioning, invoicing, payments, and support tickets | Art. 6(1)(b) Contract Performance |
| Statutory tax accounting, financial recordkeeping, and compliance obligations | Art. 6(1)(c) Legal Obligation |
| Security audit logging, IP rate limiting, fraud prevention, and session integrity | Art. 6(1)(f) Legitimate Interests |
| Optional functional preferences (e.g., theme storage) and optional diagnostics | Art. 6(1)(a) Consent |
4. Recipients & Third-Party Sub-Processors
We share personal data only as necessary to deliver billing services and fulfill legal obligations with carefully vetted processors:
- Payment Gateways: Flitt (card payment processing and optional recurring card tokenization), PayPal (when selected for invoice settlement), and banking institutions (for Bank Transfer settlement).
- Transactional Communications: Email delivery and SMS notification providers used exclusively for verification links, 2FA security codes, password resets, invoices, and service/ticket notifications.
5. International Data Transfers & Safeguards
Because we operate across jurisdictions including Georgia and work with international payment and communication providers, personal data may be transferred outside the EEA or UK. Where a destination country is not covered by an adequacy decision, we safeguard transfers using European Commission Standard Contractual Clauses (SCCs) alongside encryption in transit and at rest.
6. Data Retention Schedule
- Tax & Accounting Records (Invoices & Payments): Retained for 7 years from the end of the financial year in which the transaction occurred to satisfy statutory tax and accounting obligations.
- Account Profile, Sub-Accounts, Support Tickets, Attachments, Passkeys & Sessions: Retained while your account remains active and permanently deleted upon verified account deletion or erasure request, except where retention is required by law.
- Security & Consent Audit Logs: Retained for fraud defense and compliance verification in accordance with statutory limitation periods.
7. Cookies & Local Browser Storage
Strictly necessary cookies are essential for authentication, session security, CSRF protection, and tracking your consent choice. If you decline strictly necessary cookies, all application cookies, active sessions, and local browser storage are deleted immediately and interactive portal features are locked.
| Name | Category | Purpose & Retention |
|---|---|---|
| billing-session | Strictly Necessary | Encrypted session identifier maintaining sign-in state and security stamp (Session). |
| XSRF-TOKEN | Strictly Necessary | Protects form submissions and Livewire requests against CSRF attacks (Session). |
| billing_cookie_consent | Strictly Necessary | Stores your cookie preference selection in cookie and localStorage (1 year). |
| billing_theme | Functional (Optional) | Remembers Light/Dark display preference in localStorage when Functional cookies are enabled. |
8. Security Measures
We protect personal data using encrypted sessions, cryptographic password hashing, encrypted storage of recurring payment tokens, optional Email 2FA, WebAuthn passkeys, private attachment storage, strict HTTP security headers, and automated session invalidation upon credential changes.
9. Your Rights Under GDPR (Articles 15–22)
Subject to statutory conditions, you have the right to:
- Access & Portability: Request a copy of your personal data in a structured, machine-readable format.
- Rectification: Correct inaccurate data directly in your Profile or by contacting us.
- Erasure (“Right to be Forgotten”): Request deletion of your account and personal data, subject to 7-year statutory tax record retention.
- Restriction & Objection: Restrict processing or object to processing based on legitimate interests.
- Withdraw Consent: Withdraw cookie or optional consent at any time via Cookie Preferences without affecting prior lawful processing.
- Lodge a Complaint: Submit a complaint to your local EU/EEA Data Protection Supervisory Authority or the Personal Data Protection Service of Georgia.
To exercise any GDPR right, please contact us at hello@idealapps.ge.