Privacy Policy

1. Introduction

theuxbites ("we", "our", or "us") is committed to protecting your data. This Privacy Policy ("Policy") informs you about how we collect, use, store, and protect your personal data when you use theuxbites services.

This Policy has been prepared in compliance with the European Union's General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.

2. Data Controller

Data Controller: David Rozsa (Individual Entrepreneur)
'theuxbites' is a trading name of David Rozsa ('we', 'our' or 'us'), an individual entrepreneur established in Austria
VAT ID (UID): ATU80686134
Trade authority: Bezirkshauptmannschaft St. Johann im Pongau
Place of business: Austria (full address available on request)
Email: hello@theuxbites.com
Website: theuxbites.com

3. What Data Do We Collect?

3.1. Account Data

• Email address
• Name, which you enter at sign-up or which comes from your Google account if you sign in with Google
• Password, which goes directly to our authentication provider and is stored only as a one-way hash
• Profile photo, if you upload one
• If you sign up after following a link in one of our blog posts, which post it was

3.2. Usage Data

• Technical data processed whenever you use the site: IP address, browser and operating system, the page requested and the time of the request
• A record of the audits and analyses you run (what, when and for which web address), which we use to apply your plan's limits
• With your consent only: page-view statistics (see section 7)

3.3. Audit and Project Data

• Web addresses of the websites you audit, and the results and reports we produce for them
• Text we extract from those pages to analyse them, such as headings, visible copy, buttons and links
• Projects you create (name and domain), and any description of a business you add to a project
• Screenshots you upload for screen or flow analysis, and their file names
• The AI-generated analyses of all of the above

Screenshots can show other people's personal data. Please upload only screenshots you are entitled to share.

3.4. Payment Data

Payment data (credit card number, expiration date, etc.) is processed directly through the Stripe payment platform. We do not store or have access to full credit card details.

• Stripe Customer ID
• Subscription status
• Billing information (name, address, if provided)
• Payment history

4. How Do We Use Your Data?

We use your data for the following purposes:

• Service Provision: Creating and managing your account, running website audits, and storing your projects and reports
• AI-Assisted Analysis: Producing the AI-generated parts of the service you use: explanations of findings, the Copy & Messaging review, screen and flow analysis, Business Intelligence and project reports (see section 6.4)
• Payment Processing: Subscription management and billing
• Communication: Sending account emails, such as sign-up confirmation and password reset
• Security: Preventing abuse through rate limiting, and detecting fraud and security issues
• Development: Improving our service, including seeing which of our blog posts lead to sign-ups
• Legal Obligations: Compliance with legal requirements
• Analytics: Only with your consent, understanding how visitors use the site with Vercel Web Analytics

5. Legal Basis

Under GDPR, the legal basis for data processing is:

• Contract Performance (Art. 6(1)(b) GDPR): Providing the service you signed up for, including the audits and AI analyses you run, payments and account emails
• Consent (Art. 6(1)(a) GDPR): Web analytics. You can withdraw your consent at any time
• Legal Obligation (Art. 6(1)(c) GDPR): For example, keeping accounting records
• Legitimate Interest (Art. 6(1)(f) GDPR): Keeping the service secure, preventing abuse, and seeing which blog posts lead to sign-ups

6. Data Storage, Security and Recipients

6.1. Where Data Is Stored

Your account, projects, reports and uploaded files are stored with Supabase in its EU region in Stockholm, Sweden. The website and its server functions run on Vercel in the United States (Washington, D.C.), so the data in each request passes through servers there. Website audits run on a worker hosted by Railway in Amsterdam, the Netherlands.

6.2. Security Measures

To protect data, we implement the following measures:

• SSL/TLS encryption for all data transmission
• Password storage using bcrypt hashing
• Regular security audits and updates
• Restricted access to data
• Regular data backups

6.3. Who Receives Your Data

We use the following service providers to run theuxbites. Each receives only the data needed for the purpose listed.

• Supabase — account data, projects, reports and uploaded files, for sign-in, the database and file storage. Stored in the EU (Stockholm, Sweden).
• Vercel — every request to the site, including your IP address and the data you submit, for hosting and server functions; with your consent, also web analytics. United States.
• Stripe — your email address, user ID, subscription details and the payment details you enter on Stripe's checkout page, for payments and subscriptions. Stripe also processes data in the United States.
• Google Cloud (Gemini models) — text extracted from the pages you audit; for Business Intelligence, the domain and pages of the business analysed and any description you add; and the findings you ask us to explain. Used to produce the Copy & Messaging review, Business Intelligence and explanations of findings. The models run in the EU, and Google may keep this text in an encrypted cache in the EU for up to 24 hours. Business Intelligence also searches the web with Google Search, which is processed outside that regional commitment; Google keeps logs of those search queries for up to 3 days.
• Google (Sign in with Google) — if you choose to sign in with Google, Google confirms your identity and shares your email address and name with us. For your Google account itself, Google is an independent controller.
• Anthropic (Claude models) — screenshots you upload, screen and project names, and summaries of your audits, to produce screen analysis, flow analysis and project reports, and as a backup for explanations of findings. Stored in the United States.
• Railway — the web addresses you audit and your user ID, to run website audits in a browser. Hosted in the EU (Amsterdam); Railway is a US company.
• Loops — your email address, user ID and a one-time link, to send account emails. United States.
• Firecrawl — web addresses of pages on a website being analysed, and nothing about you, to find and read that site's pages for Business Intelligence. United States.
• Upstash — your user ID, or your IP address when you check whether an email address is registered, for rate limiting. Upstash is a US company.
• Sanity — if you download a file from our blog, it is delivered from Sanity's servers, which see your IP address.
• Authorities — when we are required to by law.

The websites you audit receive ordinary page visits from our audit systems. We do not send them any information about you.

6.4. AI Processing

The AI-generated parts of theuxbites run on models from Google (Gemini) and Anthropic (Claude), under our own prompts. We do not use your data to train AI models, and under their business terms neither Google nor Anthropic trains its models on the data we send. AI output is not used to make decisions about you. Our AI transparency statement explains exactly which parts of the service are AI-generated.

7. Cookies and Similar Technologies

You can change your choice at any time in Cookie settings, which is also linked in the footer of every page.

7.1. What We Store in Your Browser

• Essential: Sign-in session cookies from our authentication provider, a cookie that remembers whether the app sidebar is open, and local storage for your cookie choice, colour theme and a dashboard cache. These are needed for the site to work.
• Sign-up source: If you follow a link from one of our blog posts, the browser tab remembers which post until you sign up. It is kept in session storage, which is deleted when you close the tab.
• Analytics: Only with your consent (see 7.2).

We do not use marketing or advertising cookies.

7.2. Analytics

If you consent, we load Vercel Web Analytics. It records page views — the page address, referrer, approximate location (country, region and city), operating system, browser and device type — without cookies, and recognises a visit by a hash of the request that is discarded after 24 hours. Before a page address is sent, we remove everything in it except campaign parameters, so sign-in links and payment confirmations never reach it.

8. Your Rights

You have the following rights regarding your data:

8.1. Right of Access

You may request information about what personal data we process.

8.2. Right to Rectification

You may request correction of inaccurate data.

8.3. Right to Erasure ("Right to be Forgotten")

You can delete your account yourself in your account settings. This immediately deletes your account, profile, projects, reports, uploaded screenshots and profile photo, and cancels any active subscription. Section 9 describes what may remain afterwards.

8.4. Right to Restriction of Processing

You may restrict processing of your data under certain circumstances.

8.5. Right to Data Portability

You may request your data in a structured, commonly used format.

8.6. Right to Object

You may object to processing of your data under certain circumstances.

8.7. Right to Withdraw Consent

You may withdraw your consent to data processing at any time if consent was the legal basis for processing.

To exercise your rights, please contact us at hello@theuxbites.com.

9. Data Retention

• Account, projects, reports and uploaded files: Kept while your account exists, until you delete them. Deleting a project deletes its reports and screenshots; deleting your account deletes everything listed in section 8.3 immediately.
• Records of the audits and analyses you ran: Kept while your account exists, and deleted with it.
• Payment and billing records: Kept by Stripe, and by us for as long as tax and accounting law requires (in Austria, generally seven years).
• Copies held by our providers: Data our providers process is deleted under their own retention periods. For example, Anthropic deletes data sent through its API within 30 days unless it is flagged for a policy violation, Google may keep the text we send to Gemini in an encrypted cache in the EU for up to 24 hours (never used to train its models), and Google keeps Google Search query logs for up to 3 days. Hosting providers keep technical logs for a short period, and copies in routine backups remain until those backups expire.
• Legal Obligation: Longer where the law requires it.

10. International Data Transfers

Your data is stored in the EU, but several of our providers are based, or process data, outside the European Economic Area: in the United States (Vercel, Stripe, Anthropic, Railway, Loops, Firecrawl, Upstash, and Google for web search and Sign in with Google) and in Singapore (Supabase's contracting entity).

Where data goes to a country without an EU adequacy decision, the transfer relies on:

• the EU-U.S. Data Privacy Framework, for the providers certified under it: Google, Vercel, Stripe, Railway, Loops and Upstash; or
• the European Commission's Standard Contractual Clauses in the provider's data processing terms, for Anthropic and Supabase.

You can ask us about these safeguards at hello@theuxbites.com.

11. Children's Privacy

Our service is not intended for children under 16 years of age. If we become aware that we have collected data from a child under 16, we will immediately delete such data.

12. Changes to This Policy

We reserve the right to modify this Policy at any time. We will notify you by email of significant changes. Continued use of the Service after publication of changes constitutes acceptance of the modified Policy.

13. Right to Complain

If you believe we have violated your data protection rights, you may file a complaint with the competent data protection authority:

• Austria: Datenschutzbehörde (DSB) — our lead supervisory authority
• EU: The data protection authority of your member state

14. Contact

If you have questions about this Privacy Policy or data processing, please contact us:

David Rozsa (Individual Entrepreneur)
Trading as: theuxbites
Austria (full address available on request)
VAT ID (UID): ATU80686134
Email: hello@theuxbites.com
Website: theuxbites.com