Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Personal Data We Collect

2.1 Account Data (via OAuth)

We use third-party authentication providers (Google, GitHub) for account creation. We do not store passwords. When you sign in, we receive and store:

• Email address
• Name (as provided by the OAuth provider)
• Profile picture URL (from OAuth provider)
• OAuth provider identifier

2.2 Billing Data

• Subscription tier and status
• Transaction identifiers
• Invoice information

Note: Payment card details are processed directly by Stripe and never stored on our servers.

2.3 Technical Data

• IP address
• Browser type and version
• Device information
• Operating system
• Access times and dates

2.4 Usage Data

• Commands viewed and copied
• Starred/favorited commands
• Search queries
• Filter preferences
• Feature usage patterns

3. Cookies and Similar Technologies

We use cookies and similar technologies to provide, secure, and improve our Service. For detailed information about the cookies we use, their purposes, and how to manage your preferences, please see our Cookie Policy.

4. Legal Bases for Processing

We process your personal data based on the following legal grounds:

• Contract performance: To provide our services, manage your account, and process subscriptions.
• Legal obligation: For invoicing, accounting, and tax compliance.
• Legitimate interests: For security, fraud prevention, service improvement, and customer support.
• Consent: For analytics cookies and marketing communications (where applicable).

5. Data Recipients and Processors

We share your data with the following categories of recipients:

• Stripe, Inc. – Payment processing. Stripe processes payment card data directly; we do not store card details.
• Vercel Inc. – Hosting and infrastructure provider.
• MongoDB, Inc. – Database services.
• Vercel Analytics – Anonymous usage analytics.

6. International Data Transfers

Some of our service providers are based outside the European Economic Area (EEA), including in the United States. When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, including:

• EU-US Data Privacy Framework certification (where applicable)
• Standard Contractual Clauses approved by the European Commission

7. Data Retention

• Account data: Retained while your account is active and for 30 days after deletion request.
• Billing data: Retained for 10 years as required by Romanian tax law.
• Technical logs: Retained for up to 90 days.
• Usage data: Retained while your account is active; anonymized after account deletion.

8. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access: Request a copy of your personal data.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your data ("right to be forgotten").
• Right to restriction: Request limitation of processing.
• Right to data portability: Receive your data in a machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at contact@piece.mirachron.com. We will respond within 30 days.

9. Right to Complain

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Romanian supervisory authority:

10. Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL)
• OAuth-based authentication (no passwords stored on our servers)
• Secure token-based session management
• Access controls and authentication
• Regular security assessments
• Secure infrastructure with reputable providers

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes, we may also notify you by email.

12. Contact Us

For any questions about this Privacy Policy or our data practices, contact us at:

• Email: contact@piece.mirachron.com
• Website: https://piece.mirachron.com