Privacy Policy.

1. Who is responsible

The data controller is [COMPANY — TBD: Canadian or Portuguese entity], reachable at [email protected]. This policy covers sillboard.ad and the Sillboard applications at sillboard.cloud. [If the entity is outside the EU/UK, an EU/UK representative will be named here.]

2. What we collect, and why

When	Data	Why (purpose and basis)	Where it is processed
You join the newsletter	E-mail address, what you said you were interested in, where you signed up, subscription status, an unsubscribe token	To send the welcome note and occasional updates you asked for (consent; you can withdraw it with one click)	Our database on Cloudflare D1; e-mail sent through Resend
You pre-order a screen	E-mail, optional name, the screen, how you paid, amounts, order status, Stripe’s session and payment identifiers, a claim token	To fulfil, confirm, refund and ship your order and keep accounting records (contract; legal obligation)	Cloudflare D1; order e-mails through Resend
You pay	Card details and billing address go to Stripe; we receive the outcome, the last four digits and identifiers	Payment and refunds (contract)	Stripe (stripe.com/privacy)
You create a host, scanner or partner account	E-mail, password hash or Google sign-in identifier, role, screens, payouts, shipping address for hardware rewards, verification scans	To run the Service and pay you (contract)	Cloudflare D1 and R2
You visit the site	Google Analytics 4: pseudonymous identifier in a cookie, pages viewed, device and rough location	To count visits and see which pages work (legitimate interest / consent where required; a notice is shown)	Google (policies.google.com/privacy)
You submit a form	Cloudflare Turnstile checks your browser and gives us a one-time token with your IP address; we verify the token and discard it	To keep bots out of the store and the list (legitimate interest)	Cloudflare (cloudflare.com/privacypolicy)
Any request	Server logs with IP address and user agent, briefly, for rate limiting and security	Security (legitimate interest)	Cloudflare Workers

3. Cookies

Google Analytics sets _ga and _ga_* cookies for up to two years. The small notice at the bottom of the site tells you so; dismissing it stores a flag in your browser’s local storage (sb.notice) so it does not come back. The store remembers a referral code in local storage (sb.ref) if you arrived through a referral link. Sign-in on sillboard.cloud uses a session cookie. You can block or delete cookies in your browser; the site works without them. To opt out of Google Analytics everywhere, Google offers a browser add-on.

4. Who else sees it

Only processors acting on our instructions: Cloudflare (hosting, database, storage, bot check), Stripe (payments), Resend (e-mail delivery), Google (analytics; sign-in if you choose it). We do not sell personal data and we do not share it with advertisers. Advertisers on the network see screen locations and aggregate counts, never who scanned or who hosts.

5. Where it goes

Our providers operate globally; Cloudflare, Stripe, Resend and Google process data in the United States and elsewhere under standard contractual clauses or equivalent safeguards. [Transfer mechanism to be confirmed with the entity decision.]

6. How long we keep it

• Newsletter: until you unsubscribe, then the address is deleted or anonymised within 30 days.
• Pre-orders and payments: for the life of the order and the accounting retention period required by law (typically six to ten years for financial records).
• Accounts: while the account exists; delete it and personal data goes within 30 days, except what accounting law requires.
• Analytics: Google Analytics retains event data for 14 months by default.
• Backups: nightly, kept 30 days.

7. Your rights

You can ask to see, correct, delete or export your data, object to or restrict processing, and withdraw consent at any time, by writing to [email protected]. We answer within a month. You can complain to your data protection authority (in the EU, the authority of your country; in the UK, the ICO; in Canada, the Office of the Privacy Commissioner or your provincial commissioner). To leave the newsletter, use the link in any note or the unsubscribe page.

8. Children

The Service is for adults. We do not knowingly collect data from anyone under 16; tell us and we will delete it.

9. Changes

We will post changes here and update the date at the top. If a change matters to something you have already given us, we will e-mail you.