Privacy notice

Effective date: October 1, 2026. Provided pursuant to Article 13 of Regulation (EU) 2016/679 ("GDPR").

1. Data controller

The data controller is Stanislav Fedorov, the independent developer of EzOrderFlow ("the Service"), reachable at privacy@ezorderflow.com. The Service is operated from Italy.

2. Data processed, purposes and legal bases

The Service processes the minimum data required to deliver and protect the website:

• Server access logs. When your browser requests a page or API resource, the web server records your IP address, the date and time of the request, the requested resource, and the response status. This data is used solely to operate, secure and troubleshoot the Service, including abuse prevention. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention: up to 30 days, after which log files are rotated and deleted.
• Aggregated page counters. The server counts how many times each public page is served per calendar day, stored as plain totals (date, page, count) with no identifier attached. No extra data is collected to produce these counts. Legal basis: legitimate interest in understanding whether the project is used (Art. 6(1)(f) GDPR). The totals are public at /api/site-stats.
• Browser storage. Chart settings, the watchlist, drawings, and your disclaimer acknowledgment are stored in your browser's localStorage. This information is strictly necessary for the Service to remember your preferences, resides only on your device, is never transmitted to the server, and can be deleted at any time through your browser's site-data controls. Because it is strictly necessary and never leaves your device, no consent mechanism is required (Recital 66 and Art. 5(3) of Directive 2002/58/EC).
• Voluntary tips. Tips are processed by Ko-fi or PayPal on their own sites; on Ko-fi's free plan payments settle through PayPal. Card or bank details are submitted to the payment provider and never reach this server; the Service receives only transaction metadata such as amount and status. Legal basis: performance of the transaction at your request (Art. 6(1)(b) GDPR) and legitimate interest. Their processing is governed by their own notices: ko-fi.com/privacy and paypal.com privacy. Stripe may be added later; this notice will be updated before it is enabled.
• Correspondence. If you contact the controller by email, the message and any replies are processed to handle your request (Art. 6(1)(f) GDPR) and retained for the duration of the correspondence.

3. Data the Service does not process

• No cookies of any kind are set; accordingly no consent banner is required.
• No third-party analytics, advertising, fingerprinting, or tracking scripts run on the Service.
• No user accounts, newsletters, or marketing lists exist.
• No automated decision-making or profiling is performed.
• Personal data is never sold, rented, or disclosed to third parties except as described in Section 4.

4. Recipients and international transfers

Access logs are stored on a rented virtual server operated by the hosting provider acting as processor. Ko-fi and PayPal process tips on their own sites; as international providers they rely on the transfer mechanisms described in their own privacy notices. No other third party receives your data.

5. Your rights

Under Articles 15-21 GDPR you may request access to, rectification or erasure of, restriction of, or portability of your personal data, and you may object to processing based on legitimate interest. Requests can be sent to privacy@ezorderflow.com. In practice the Service holds almost no identifiable data: localStorage contents exist only on your device and are controlled entirely by you.

You also have the right to lodge a complaint with the competent supervisory authority, in Italy the Garante per la Protezione dei Dati Personali, or with the authority of your country of residence.

6. Security

The Service is delivered over HTTPS and is designed to hold as little personal data as possible. No method of transmission or storage is completely secure; residual risk cannot be excluded.

7. Changes to this notice

This notice may be updated when the Service's data practices change. The effective date at the top reflects the current version; material changes will be announced on the website.