Privacy

Biscuit is run by one person, me. I am the controller of your personal data under the GDPR and the Spanish data protection law (LOPDGDD): Yannick Garcia Del Estad, NIF Y4497965F, Calle Cristo de la Vera Cruz 25, 41808 Villanueva del Ariscal, Sevilla, Spain. Email: yannick at getbiscuit.dev.

When you buy. Polar runs the checkout and sends me your name, email, country and order details. I never see your card. I use them to give you the templates, help you if something goes wrong and keep the records the law asks for. Legal basis: our contract, and my legal obligations.

When you unlock the code. Your licence key, or your Polar customer number, is saved in a cookie in your browser and checked with Polar, so the code stays open for you. Legal basis: our contract.

When you email me. Your email address, your name if you give it, and what you write. I use them to answer you. Legal basis: my legitimate interest in replying, or steps before a contract if you are asking about a purchase.

When you visit. My hosting provider, Netlify, logs technical data such as your IP address, browser and the pages requested, to keep the site running and secure. Legal basis: my legitimate interest in a working, safe site.

I do not sell your data, use it for advertising or make automated decisions about you. I only email you about your order, or when you write to me.

Cookiebot asks for your consent on your first visit. Google Analytics runs only if you accept Statistics, and your light or dark choice stays in your browser. The cookie policy lists every cookie and how to change your choice: https://getbiscuit.dev/cookies

The checkout runs on Polar’s own pages, which use their own cookies under Polar’s policy.

• Polar (Polar Software, Inc.), which sells Biscuit on my behalf as Merchant of Record. Polar handles payment, tax and invoices as an independent controller under its own privacy policy: https://polar.sh/legal/privacy
• Netlify (Netlify, Inc.), which hosts this site, Zoho Mail (Zoho Corporation B.V., EU data centre), which handles my email, Cookiebot (Usercentrics A/S), which records your cookie choice, and Google (Google Ireland Limited), which runs the analytics if you accept them. All process data only on my instructions.
• Public authorities, only when the law requires it.

Polar and Netlify are based in the United States, and Google may move analytics data there. Transfers rely on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

• Order records: six years, as Spanish tax and commercial law requires.
• Emails: as long as needed to help you, then deleted within two years.
• Hosting logs: kept by Netlify for a short time, then deleted.
• Analytics: kept by Google for 14 months, then deleted.

You can ask to access, correct or delete your data, to restrict or object to how I use it, and to get a copy in a portable format. Where I rely on your consent, you can withdraw it at any time. Write to me at yannick at getbiscuit.dev. I reply within one month.

If you think I got something wrong, you can complain to the Spanish Data Protection Agency (AEPD): https://www.aepd.es

Biscuit is a tool for website owners and is not meant for anyone under 14. I do not knowingly collect their data.

If this policy changes, I will update this page and the date above. If a change affects buyers in a meaningful way, I will email them.