BurnlyticsBack to home

Privacy Policy

Last updated: August 4, 2026

This Privacy Policy explains how Jiří Dočkal, a self-employed individual (sole trader) registered in the Czech Republic, Company ID (IČO) 05438861, with registered address at Lužánecká 1887/8, 602 00 Brno, Czech Republic ("we", "us") collects and processes personal data when you use Burnlytics (the "Service"). We are the data controller for the processing described here.

1. Data we collect

  • Account data: email address, password (stored hashed by our authentication provider), and optional display name.
  • Financial planning data: the assumptions, revenue, expense, and headcount figures you enter. These are business forecasts you control; we recommend not entering personal data of identifiable individuals (e.g. use roles instead of employee names).
  • Billing data: subscription status and a customer reference held by our payment processor, Stripe. We never store your full card details.
  • Technical data: server logs (IP address, request metadata) retained briefly for security and debugging.
  • Product analytics: usage events (for example saving assumptions or starting checkout), page views, and error reports, processed by PostHog (EU cloud) to understand product adoption and reliability. When you are signed in, events may be linked to your account id and email.

2. Purposes and legal bases

  • Providing the Service (contract performance): account management, storing your forecasts, billing.
  • Security and abuse prevention (legitimate interest): authentication, logging, rate limiting.
  • Product improvement (legitimate interest): measuring feature usage and onboarding drop-off via PostHog so we can improve the Service. You may object to this processing by contacting us (see Contact below).
  • Service communications (contract performance): transactional emails such as email confirmation, password reset, and billing notices. We do not send marketing emails without your consent.

3. Cookies

The Service uses strictly necessary cookies for authentication session cookies set by our auth provider (Supabase).

We also use PostHog for product analytics. The browser SDK may set first-party analytics cookies or similar storage to distinguish sessions and measure page views. We do not use advertising or cross-site tracking cookies. If you require a consent banner under applicable law for analytics cookies, contact us and we will adjust the implementation; we may also rely on server-side events that do not depend on analytics cookies.

4. Processors and data transfers

We share data only with processors needed to run the Service:

  • Supabase — authentication and database hosting.
  • Stripe — payment processing.
  • Vercel — application hosting and logs.
  • PostHog — product analytics (EU region: eu.posthog.com).

Where these providers process data outside the EU/EEA, transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision (e.g. the EU–US Data Privacy Framework).

5. Retention

We keep your data for as long as your account exists. When you delete your account (Settings → Account → Delete account), your account data and all forecasts are deleted immediately from our production database; residual copies in encrypted backups expire on the backup rotation schedule. Billing records are retained as required by tax and accounting law.

6. Your rights

Subject to applicable law (including the GDPR if you are in the EU/EEA), you have the right to access, rectify, delete, and receive a copy of your personal data, to restrict or object to processing, and to lodge a complaint with a supervisory authority. You can exercise deletion yourself in the app; for other requests contact us at jiri.dockal5@gmail.com.

7. Security

Data is encrypted in transit (TLS) and at rest by our hosting providers. Access to production systems is restricted and authenticated. No method of transmission or storage is 100% secure, but we work to protect your data using industry-standard measures.

8. Changes

We may update this policy from time to time. Material changes will be announced by email or in-app notice before they take effect.

9. Contact

Privacy questions and requests: jiri.dockal5@gmail.com.