1. Controller and contact
The controller is BBS EDB EOOD (BBS EDB Ltd.), UIC 204840908, VAT BG204840908, with its registered office at 11 Cherni Vrah Blvd., ap. 1, 1421 Sofia, Bulgaria. Contact the controller about your data at privacy@befonow.com, using the subject «Privacy BEFONOW».
2. Data collected and its sources
- Registration: email, username, language, minimum-age confirmation and separate choices for Terms, Privacy and marketing. First and last name, city, country, account type, phone and profession are requested only after registration, in your profile, and remain optional. Your password is sent to the authentication service, not stored in the BEFONOW profile database.
- Content: Before/After photos, titles, descriptions and categories you upload; Ask How questions, messages and account-related interactions.
- Choices and requests: marketing preferences, acknowledgement of this notice, acceptance of terms, document version, language and date; support, reporting and privacy requests.
- Technical data: information needed for connection and security, sessions and preferences. The site also records usage counts with language and service area; these event records contain neither a user identifier nor an IP address.
- Data comes from you, your use of the service and authentication providers. Other users may include you in photos or messages: contact us to exercise your rights.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage accounts, publish transformations, provide messages and service notifications | Performance of the contract and requested features — GDPR Art. 6(1)(b) |
| Secure the service, prevent abuse, handle reports and improve the service with aggregate counts | Legitimate interest in service security and operation — Art. 6(1)(f), balanced against your rights |
| Handle privacy rights, authority requests and applicable obligations | Legal obligation — Art. 6(1)(c) |
| Send BEFONOW news and promotional communications | Separate, optional consent — Art. 6(1)(a), withdrawable at any time |
4. Required and optional data
Required fields are used to create and manage an account; you cannot complete registration without them. Public pages can be visited without registering. Photos are needed only if you choose to publish a transformation. Marketing is optional: refusing or withdrawing consent does not prevent you from using BEFONOW. Acknowledging this notice is not blanket consent to every processing purpose.
5. Public photos, profiles and messages
Published transformations can be seen by unregistered visitors. Photos, descriptions and the author’s name can be shared by link and indexed by search engines. Avoid uploading personal details you do not want to make public, and check the rights and permissions of identifiable people.
Uploaded files are retained as supplied and may contain metadata, including location. Remove this information before uploading if you do not wish to share it. Do not use the service to publish other people’s health or other special-category data without a valid legal basis.
Messages are intended for conversation participants and processed for delivery, support and security. They are not end-to-end encrypted. Email notifications may include the sender’s name and transformation title.
6. Recipients and providers
The operator and authorised persons access data for the purposes described here. Technical providers process data needed for their services. Public content is also accessible to visitors; messages to their recipients. Information is disclosed to authorities when legally required.
| Provider | Service and data involved |
|---|---|
| OpenAI / Sites | Hosted platform infrastructure, site data and sign-in-provider identity when used |
| Cloudflare | Site delivery, security, database and image storage |
| Supabase | Email/password authentication and, when selected, Google or Apple; credentials, identifiers and account-management data |
| Resend | Email delivery, recipient and sent notification content |
7. Transfers outside the EEA
Providers may process data outside the European Economic Area, including in the United States and Singapore. Their processing agreements provide European Commission standard contractual clauses for restricted transfers; adequacy decisions apply where relevant. The documents are linked below. Contact the controller for information about recipients, locations and a copy of the safeguards applicable to your data.
8. Retention and deletion
| Data | Retention criterion |
|---|---|
| Account and profile | During the account’s lifetime and as needed to handle closure, applicable obligations or disputes |
| Photos and transformations | While published or needed for the requested feature; after a deletion request, only for documented legal, security or rights-protection needs |
| Messages | To provide the conversation; deletion also considers other participants’ rights and applicable retention obligations |
| Choices, reports and privacy requests | To handle requests and document choices and compliance, within applicable legal or rights-protection periods |
| Technical data and usage counts | As needed for security, diagnosis and service evaluation; genuinely anonymised counts may be retained as statistics |
The «Delete account» command sends a confirmation email. After confirmation, deletion is automatically scheduled for 30 days later. During the cooling-off period you can cancel it from Profile. At the deadline, the authentication account and linked data are removed, except where data must be retained for legal obligations, security or protection of rights. Third-party copies and search-engine caches may require separate action.
9. Your rights and how to exercise them
Where GDPR Articles 15–22 apply, you can request access, correction, deletion, restriction and portability, object to processing and withdraw consent without affecting previous processing. Use the personal-area controls or email the controller with your request and account email. Only information needed to verify your identity may be requested.
A response is normally provided within one month. For complex or numerous requests, this can be extended by two further months, with reasons communicated within the first month. You may complain to the competent supervisory authority, including the Italian Garante or Bulgaria’s Commission for Personal Data Protection.
10. Children and automated processing
The service is intended for people aged at least 16. Do not publish children’s photos without necessary permissions. Parents or guardians can report accounts or content requiring review to the controller.
AI translation of user text is not enabled in the current configuration. Editorial AI illustrations are prepared examples, not automatic processing of uploaded user photos. BEFONOW does not use solely automated decisions with legal or similarly significant effects on people.
12. Updates
The version appears on this page and is recorded for new registrations. Before enabling AI translation, new analytics, new data uses or profiling tools, we will update this notice and, where necessary, a separate user choice.