Privacy Policy

This Privacy Policy explains how FurniTag ("we", "us", "our") — operated by Baseflow Technology OÜ (registry code 17438321, Estonia) — collects, uses, and protects your personal data when you visit furnitag.com (this site) or use the FurniTag service at app.furnitag.com.

We comply with the EU General Data Protection Regulation ("GDPR") and the UK Data Protection Act 2018. If you are based outside these jurisdictions, equivalent local rules apply where they offer stronger protection.

1. Data we collect

Visitors to furnitag.com

• Aggregate, anonymous analytics via Umami, which we run on our own server in Germany: page, referrer, country, browser and device type. No cookies, no cross-site tracking, and your IP address is not stored.
• Contact form submissions — when you submit the form on /contact, we receive your name, email, and the message you wrote. A Cloudflare Turnstile token is used to verify you are a human; Turnstile does not set cookies on this site.

Customers of the FurniTag service

If you sign up at app.furnitag.com, the Privacy Policy of the FurniTag service governs the data you submit there (product photos, generated 3D models, billing details). That policy is available inside the dashboard.

2. How we use your data

• To respond to your contact-form message.
• To understand which pages are useful (Umami aggregate metrics only).
• To detect and block automated abuse (Turnstile token validation).

3. Legal basis for processing

• Contact form: Article 6(1)(b) GDPR — performance of pre-contractual steps at your request.
• Umami analytics: Article 6(1)(f) GDPR, our legitimate interest in operating and improving the site. No cookies are set, so no consent is required.
• Turnstile: Article 6(1)(f) GDPR — our legitimate interest in preventing automated abuse.

4. Who we share data with

We do not sell your data. We use the following processors, each bound by a Data Processing Agreement and operating in regions with adequate protection (EU/EEA, UK, or under valid SCCs):

• Vercel Inc. — hosting (Frankfurt region for EU traffic).
• Hetzner Online GmbH: the server in Germany that runs our analytics (Umami) and the FurniTag API.
• Resend Inc. — transactional email delivery for contact-form responses.
• Cloudflare Inc. — Turnstile bot challenge for the contact form.

5. Data retention

Contact-form submissions are retained in our email inbox for up to 24 months for follow-up purposes, then deleted. Umami analytics are kept in aggregate form that does not identify you.

6. Your rights

Under GDPR you have the right to:

• Request a copy of the personal data we hold about you (right of access).
• Correct inaccurate data (right to rectification).
• Request deletion of your data (right to erasure / "right to be forgotten").
• Restrict or object to processing.
• Request a portable copy of your data.
• Withdraw consent at any time (where consent is the legal basis).
• Lodge a complaint with your local supervisory authority.

To exercise any of these rights, email [email protected]. We respond within 30 days.

7. International transfers

Data is processed in the EU and US. Transfers to US-based processors (Vercel, Resend, Cloudflare) rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework where applicable.

8. Security

We use HTTPS everywhere, encrypt data in transit, and minimise the personal data we collect in the first place. Cloud infrastructure (Vercel, our email provider) maintains industry-standard ISO 27001 and SOC 2 certifications.

9. Changes to this policy

If we make material changes, we will revise the "Last updated" date at the top of this page and, where appropriate, notify you by email.

10. Contact

Data controller: Baseflow Technology OÜ (registry code 17438321, Estonia). Data protection enquiries: [email protected]. General contact: /contact.