What we do with your data.
This policy explains what we do with personal data when you buy a membership or use ExhalePLR.
Who is responsible
The data controller is ExhalePLR, registered address [REGISTRERAD ADRESS — fylls i], company registration number [ORG.NR — när bolaget är registrerat]. Privacy questions: support@exhaleplr.com.
What we process, and why
- Your e-mail address and password — to create your account and let you sign in. Necessary to perform our contract with you.
- Purchase and subscription details — plan, status, renewal and end dates, and the Stripe customer and subscription identifiers. Necessary to perform the contract and to meet accounting obligations.
- Use of the service — sign-ins, page views, checkout starts and downloads. Our legitimate interest in operating the service, spotting abuse of download links and understanding what members actually use.
- Support messages — to answer you, and to keep a record of what was agreed.
We do not sell personal data, and we do not use it for automated decisions that produce legal effects.
Card details
We never receive your card number. Payment is entered on Stripe's own checkout page, and we are told only the outcome, your e-mail address and the identifiers we need to link a payment to an account.
Who processes data on our behalf
- Supabase — accounts, authentication and the database. Hosted in the EU (London region).
- Stripe — payment processing and subscription management, as an independent controller for its own compliance purposes.
- Cloudflare — storage and delivery of the library files.
- Vercel — hosting of the website and the member portal.
Some of these providers are established outside the EU/EEA. Where data is transferred, it is covered by the European Commission's standard contractual clauses or an adequacy decision.
How long we keep it
Account and entitlement data is kept for as long as your membership exists and then for as long as needed to handle disputes. Records that accounting law requires us to keep are kept for seven years. Activity logs are kept while they remain operationally useful and are then deleted.
Your rights
You may ask for a copy of your data, correction of it, deletion, restriction, portability, or object to processing based on legitimate interest. Write to support@exhaleplr.com. If you are unhappy with how we respond you can complain to Integritetsskyddsmyndigheten (IMY), the Swedish data protection authority.
Cookies
See the Cookie Policy.