Customer & Website Privacy Notice
Which notice do you need? This one covers the people who buy, deploy or evaluate Ydentifi — the named contact at a customer, or someone signing up for a free licence. If you are a person using the authenticator app because your employer or bank asked you to, you want the app privacy notice instead. We hold nothing about you at all.
Who is responsible
Ydentifi Ltd., a company registered in the Republic of Bulgaria under number 208962261, with its registered office at Todor Aleksandrov No. 46, floor 2, 2700 Blagoevgrad, is the controller of the personal data described below. Contact: privacy@ydentifi.io.
What we hold, and what we deliberately do not
A paid licence is issued only to a business: a company, another legal person, or an individual registered as a sole trader. For a paid customer we hold: a contact email address, the organisation name and its registered legal name, the company registration or VAT number it declares, a reference to the payment record held by our payment processor, and the licence records for that organisation. Support correspondence is kept for as long as it is useful and then deleted.
We do not check a registration or VAT number against any register. The licence states it as it was declared. The one exception is a VAT number given for a reverse-charge invoice, which we may confirm with the tax authority.
A company's registration number identifies the company rather than a person. Where the customer is a sole trader, it may also identify them, and we treat it as personal data in that case.
A free licence may be issued to a business or to an individual. For a free licence we hold the email address, whether the licensee is a business or an individual, the name and identifier it declares, its country, and the licence record itself. All of these except the licence record were given when the licence was requested, and the licence key states them as given.
What we do with a free-licence email address, and nothing else. It is used to send the activation code that completes a licence request, notices about the account, such as a replaced API key, and security notices about the software and the Ydentifi Authenticator app. It is not used for product improvement, for marketing, for analytics, or to build a support corpus. Nothing is asked of you in return for a free licence beyond the particulars given when it is requested.
Two things we do not hold, by design:
- Card and billing details. These stay with Stripe. Our systems keep only a reference, not a
copy, so a breach of ours exposes no payment data.
- Anything about your users. You self-host. We have no access to your deployment and no route to
the people authenticating against it — you are the controller of that data, not us.
Why we hold it
| Data | Purpose | Lawful basis |
|---|---|---|
| Contact email, organisation name | Issuing your licence; sending security notices about the software and the app | Performance of a contract |
| Legal name, payment reference | Invoicing, tax and statutory accounting | Legal obligation |
| Company registration or VAT number | Recording who holds a paid licence; invoicing and tax | Performance of a contract; legal obligation |
| Licence records | Enforcing licence terms; answering support questions | Legitimate interests |
| Support correspondence | Answering you | Legitimate interests |
Where we rely on legitimate interests, the interest is running a licensing business and supporting the people who use it. You can object — see below.
Who else sees it
Stripe, for payments and tax calculation. Our email provider, to deliver activation codes, account notices and security notices. Our accountant, for statutory filings. Our hosting provider, which stores the licensing records.
We do not sell personal data, do not share it for advertising, and have no advertising relationships to share it with.
Transfers outside the EU
Stripe processes some data in the United States under the safeguards required by the GDPR. Everything else stays within the EU.
How long we keep it
Licence and contact records for the life of the relationship and then for as long as a claim could still be brought. Invoicing and accounting records for the period Bulgarian law requires, which is longer than we would otherwise keep them. Support correspondence, until it stops being useful.
Your rights
You may ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to processing based on legitimate interests, or ask for it in a portable form. Write to privacy@ydentifi.io and we will respond within one month.
If you are unhappy with how we have handled it you can complain to the Bulgarian Commission for Personal Data Protection (КЗЛД), or to the supervisory authority where you live.
Some records we cannot delete on request — invoices, for instance, which we are required to keep. We will tell you when that is the reason.
Automated decisions
None. Nothing about your licence, your access or your account is decided automatically in a way that produces legal effects for you, and we do not profile you.
The website
This site sets no cookies and stores nothing in your browser — see the cookie notice. Our server processes the technical information any web server receives in order to serve a page; it is not used to build a profile of you.
If you type an address into the demo, our server looks it up with OpenStreetMap's Nominatim service, which receives the address you typed. Your browser does not contact Nominatim.
Changes
Changes to this notice are published on this page, with a new version number and date.