Privacy policy
Last updated:
This policy explains how Worbee EOOD handles personal data on metribay.com and in Metribay Cloud at app.metribay.com. We collect what we need to run the service, and nothing for advertising.
Who is responsible
Worbee EOOD, Alexander Stamboliyski street 7, Bankya 1320, Sofia District, Bulgaria. UIC 206543923, VAT ID BG206543923. Privacy contact: rob@worbee.com
This website
metribay.com sets no cookies and runs no analytics or tracking scripts. Cloudflare delivers the site and processes technical request data, such as your IP address and browser details, to serve and protect it. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
Your Metribay account
When you sign up, we process your name, email address, password (stored only as a hash), two-factor settings, workspace memberships and invitations. We use this to provide the service and send emails you need, such as verification, password resets and invitations. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
The app uses only essential cookies: a session cookie, a security token and, if you choose it, a “remember me” cookie. They’re needed for sign-in and protection, so no consent banner is required.
Connected tools and metrics
To show your metrics, we store the credentials you enter for each tool, encrypted, and the numbers we collect. These are aggregate counts, such as daily visitors or clicks. Metribay doesn’t collect data about individual visitors to your websites.
Payments
Paddle is our reseller and Merchant of Record. Paddle processes your payment and billing details as an independent controller under its own privacy policy: www.paddle.com/legal/privacy. We receive your subscription status, plan, country and a customer reference. We never see your full card details.
Logs and security
We don’t keep web server access logs for the app. Application errors are logged without request bodies or credentials and rotate automatically. We use encryption in transit and at rest for credentials, limit access to production systems and protect operator access with two-factor authentication.
Who receives data
Hetzner Online GmbH hosts the app and database in its data centre in Finland.
Cloudflare, Inc. provides the network in front of the app, DNS and hosting for this website.
Paddle.com Market Ltd handles checkout, payments, invoices and taxes as Merchant of Record.
Zoho Corporation delivers the app’s emails.
Professional advisers and authorities, only where the law requires it.
We don’t sell personal data or share it for advertising.
Transfers outside the EU
Some providers may process data outside the EU, for example Cloudflare in the United States and Paddle in the United Kingdom. We rely on the EU-US Data Privacy Framework, the EU adequacy decision for the UK, or Standard Contractual Clauses.
How long we keep data
We keep account data while your account exists. If you ask us to delete your account, we delete it within 30 days. Database backups roll over after 14 days. Billing records are kept as long as tax and accounting law requires.
Your rights
You can ask for access to your data, correction, deletion, restriction, a portable copy, or object to processing based on legitimate interest. Email rob@worbee.com. We answer within one month.
You can also complain to a data protection authority, such as the Bulgarian Commission for Personal Data Protection (www.cpdp.bg) or the authority where you live.
Changes
If this policy changes in a way that matters, we’ll update the date above and tell account owners by email.