Privacy Policy
Last updated: October 17, 2026
In these documents, “GetMyData”, “we”, “us” and “our” refer to the operator of the GetMyData service at getmydata.io. You can reach us at any time: for requests and orders at service@getmydata.io, and for support, billing, refunds and privacy questions at support@getmydata.io.
This Privacy Policy explains how we collect, use, store and share personal information when you use our website and our email-based service (the “Service”), and the rights you have. By using the Service you acknowledge this policy.
1. Data controller
The data controller is the operator of the GetMyData service. Privacy contact: support@getmydata.io. Data protection officer: not appointed (not required for our type and scale of processing).
2. Information we collect
2.1 Information you give us
- Email address and the language you used on our website. We do not use accounts or passwords.
- Your requests and correspondence: the description of the data you need and everything you write to us by email.
- Consent choices: whether you agreed to receive tips and offers, and when.
- Order and payment information: what you ordered, the price, payment status and the name, email and country you entered at checkout, as reported to us by our payment partner. We never receive or store your full card number — card data is handled by our payment processor (see section 5).
2.2 Information collected automatically
- Device and network: approximate country (derived from your connection), browser type, and time of requests. Your IP address is processed by our hosting and bot-protection provider to protect our forms; we do not store it in our database.
- Checkout return visits: when a payment page sends you back to our site, we log the address parameters it adds (such as an order reference and payment status), your country, browser type and referring page, to troubleshoot payment issues.
- Service logs: request times, errors and performance data.
3. How we use your information and our legal bases
| Purpose | Legal basis |
|---|---|
| Verifying your email and providing the Service (samples, quotes, delivery) | Performance of a contract / steps at your request before a contract |
| Billing and payment processing | Performance of a contract |
| Customer support | Performance of a contract / legitimate interests |
| Service notices (order updates, billing, policy changes) | Legitimate interests |
| Security, bot protection and fraud prevention | Legitimate interests |
| Improving the Service | Legitimate interests |
| Legal, tax and accounting obligations | Legal obligation |
| Tips and offers by email (only if you ticked the box) | Your consent |
We may aggregate or de-identify data for statistics; such data cannot identify you.
Our AI agent. Your messages are read and answered by an AI agent. To do this, their content is processed by third-party AI model providers acting on our behalf. A human operator may review conversations to check quality, handle complaints, or when you ask to speak to a person. We do not use your messages to train AI models.
4. Cookies and similar technologies
| Type | Purpose | Can be turned off |
|---|---|---|
| Strictly necessary | Bot protection on our sign-up forms (Cloudflare Turnstile) | No |
| Functional | Remembering your language choice (“lang” cookie) | Yes, via your browser settings |
| Analytics | None — we do not use analytics tools | — |
| Marketing | None — we do not use advertising or tracking cookies | — |
Cloudflare Turnstile is provided under the Cloudflare Privacy Policy.
5. Sharing and disclosure
We do not sell your personal information, including “selling” or “sharing” as defined by laws such as the CCPA/CPRA. We share information only as follows:
- Service providers bound by confidentiality and data-processing terms: website hosting, database, storage and bot protection (Cloudflare); email delivery (Resend); AI model providers that process message content; and the cloud data-collection platform used to gather publicly available web data for your request (Apify). We only send them what they need to provide their service.
- Payment processing: payments are processed by our Merchant of Record and authorized reseller, Waffo Pancake (“Waffo”), which acts as the seller of record and handles checkout, taxes, invoices and refunds. Payment card data is processed exclusively by Waffo’s PCI-DSS compliant payment processing and is never stored on our servers. Where a checkout page states that it is provided by Creem, Creem acts as Merchant of Record for that purchase in the same way. Each Merchant of Record handles your payment information under its own privacy policy, shown at checkout.
- Legal and regulatory requirements: when required by law, court order or a lawful request from a competent authority.
- Business transfers: if the Service is transferred to a new operator, we will tell you in advance and the new operator must continue to protect your information.
- With your consent for any other purpose.
6. Security
- All traffic to our website is encrypted in transit (TLS/HTTPS).
- Data is stored with an established cloud provider; credentials and keys are stored as encrypted secrets.
- Access is restricted to the operator on a least-privilege basis.
- Download links for delivered files expire after 7 days.
- Our sign-up forms are protected against automated abuse.
If a security incident affects your personal information, we will notify you and, where required, the relevant authority without undue delay and, where feasible, within 72 hours of becoming aware of it.
7. How long we keep information
| Data | Retention | Afterwards |
|---|---|---|
| Unverified sign-ups | 30 days | Deleted automatically |
| Verified email address and conversations | While you use the Service and up to 24 months after your last contact | Deleted or anonymised |
| Marketing consent records | While you are subscribed, plus 24 months as proof of consent | Deleted |
| Order and transaction records | As required by tax and accounting law, typically up to 7 years | Deleted |
| Delivered result files | 7 days | Deleted from our storage |
| Checkout return and security logs | 12 months | Deleted |
8. Your rights
Write to support@getmydata.io to exercise any of these rights. We respond within 30 calendar days.
| Right | What it means |
|---|---|
| Information | Know what data we collect and how we use it |
| Access | Get a copy of your personal information |
| Rectification | Correct inaccurate or incomplete information |
| Erasure | Ask us to delete your data, subject to legal exceptions |
| Restriction | Ask us to pause processing in certain cases |
| Portability | Receive your data in a machine-readable format |
| Objection | Object to processing based on legitimate interests or for marketing |
| Withdraw consent | Withdraw consent at any time, without affecting earlier processing |
If you believe we have not handled your data properly, you may complain to the data protection authority where you live.
9. Marketing emails and unsubscribing
We send tips and offers about the Service only if you ticked the box to agree. You can unsubscribe at any time with the link in every such email, or by writing to us. Unsubscribing does not stop emails that are necessary for your own requests and orders, such as samples, quotes, delivery and billing messages.
10. International transfers
Our providers operate infrastructure in several countries, including the United States and the European Union, and Cloudflare operates a global network. Where personal information is transferred across borders, we rely on safeguards such as the European Commission’s Standard Contractual Clauses included in our providers’ data-processing terms, adequacy decisions where available, and transfers only to providers offering an equivalent level of protection.
11. Children
The Service is intended only for people aged 18 or over. We do not knowingly collect information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it promptly.
12. Third-party links and services
Our website and deliveries may contain links to third-party websites, including the public websites that data was collected from. This policy covers only information we collect. We are not responsible for the practices of third parties; please read their policies.
13. Changes to this policy
For material changes we will notify you by email at least 15 days before they take effect and update the “Last updated” date above. Continued use after the effective date means you accept the updated policy.
14. Contact
- Privacy and support: support@getmydata.io
- Requests and orders: service@getmydata.io
- Website: getmydata.io
- We monitor these mailboxes every day and usually reply within 2 business days.