This policy explains how SizeBack (“we”, “us”) handles personal data when you use sizeback.com, the SizeBack web app and the @sizeback_bot Telegram bot. We collect as little as we need to send you alerts.
Who is responsible
The controller of your personal data is the operator of SizeBack. Contact: privacy@sizeback.com.
What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address; name and Google account ID if you continue with Google | Your account, login, alerts and account notices | Contract (Art. 6(1)(b)) |
| Telegram user ID, username and first name, if you connect Telegram or use the bot | Sending alerts on Telegram | Contract |
| Products, sizes, price targets and alert settings you choose | Checking stock and prices and sending alerts | Contract |
| Plan, Stripe customer and subscription IDs, billing status | Managing your paid plan | Contract; legal obligation for accounting records (Art. 6(1)(c)) |
| IP address and technical data in short-lived security records (rate limits, bot checks) | Preventing abuse and keeping the service secure | Legitimate interest (Art. 6(1)(f)) |
| Usage events (pages and features used), only if you accept analytics cookies | Understanding how SizeBack is used and improving it | Consent (Art. 6(1)(a)) |
We never receive or store your card details; Stripe handles payments. We do not sell your data and do not use it for advertising.
Who processes data for us
- Cloudflare: hosting, database, bot protection (Turnstile) and email forwarding.
- Resend: sending emails (EU region).
- Stripe: payments, invoices and fraud prevention. Stripe is an independent controller for some payment data; see stripe.com/privacy.
- Google: “Continue with Google” sign-in, only if you use it.
- Telegram: delivering bot messages, only if you connect Telegram.
- PostHog (EU hosting): product analytics, only with your consent.
Some of these providers are based in the United States or may process data there. Transfers rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
Cookies
- Necessary:
dp_sessionkeeps you logged in (30 days);dp_consentstores your cookie choice (6 months); Cloudflare Turnstile may set a cookie to tell people from bots. - Analytics (optional): PostHog cookies (
ph_…), set only after you accept analytics.
Change your choice at any time under “Cookie settings” at the bottom of every page.
How long we keep data
- Account data and watches: until you delete your account.
- Login links and codes: at most one day. Login sessions: 30 days.
- Queued alert messages: deleted 7 days after sending.
- Billing records: as long as accounting law requires (up to 10 years), kept by Stripe and us.
- Analytics events: up to 12 months.
Your rights
You can ask for a copy of your data, correct it, delete it, receive it in a portable format, object to processing based on legitimate interest, and withdraw consent at any time. Email privacy@sizeback.com from the address of your account and we will answer within one month. You can also complain to your data protection authority; in Lithuania this is the State Data Protection Inspectorate (vdai.lrv.lt).
Changes
If we change this policy in a way that matters, we will tell you by email before the change takes effect.