How MyFileTracker processes personal data
MyFileTracker is the controller of personal data processed via this website and application. For privacy questions, contact us through the contact page.
We process account data (name, email, password hash), company and billing details, customer and order data you enter, app usage data, and payment data via Stripe. We do not store full card numbers.
We process data to provide the service (contract), for billing and support, to keep the platform secure (legitimate interest), and to meet legal duties such as accounting and Peppol.
We share data with processors that run the service: website and app hosting (Vercel), database, storage and sign-in (Firebase/Google Cloud), email (Resend), payments and subscriptions (Stripe) and electronic invoicing via Peppol (Billit). Invoices only go to the recipient via Peppol when you initiate that. We do not sell personal data.
Messages sent through our contact form are also passed to Thumbsupp, our internal operations tool, operated by Hakuna Matata BV (BE0793457228), the company behind MyFileTracker, for internal handling and bug triage. The message is sorted automatically using simple rules (for example question, bug report, feature request, sales or spam). Thumbsupp keeps only minimal metadata: the category, the length of the message, which form was used, a coarse email type (for example free provider or business address, never the address itself), whether a phone number was entered, any spam signals and a timestamp. Your name, email address and the text of your message are not stored there, with one exception: if your message is recognised as a bug report or feature request, we keep a copy with email addresses, phone numbers and links removed (up to 1,000 characters) as an internal task to fix the problem. To prevent abuse, we use a pseudonymised key derived from your IP address, kept for at most one hour; your IP address itself is never passed on. None of this is made public, and Thumbsupp does not send automated replies. Thumbsupp runs on Cloudflare and Google Cloud (Firebase). Legal basis: our legitimate interest in handling your request and preventing abuse.
We keep account and transaction data while your account is active and afterwards as long as legal retention rules (including tax law) require. You can request deletion; some records must be kept longer by law.
You have the right to access, rectify, erase, restrict, port and object to processing, as far as GDPR allows. You may also lodge a complaint with the Belgian Data Protection Authority or another competent supervisor.
We only use necessary cookies for session, language choice and security; no analytics or tracking cookies. We apply appropriate technical and organisational measures (encryption, access control, backups). No online service is risk-free.
We may update this privacy policy. The current version is always on this page. For material changes we will inform you where reasonable.