Privacy Policy

1. Data Controller

KlaviyoDirectory is operated by ONBOARD SUCCESS OÜ, a company registered in Estonia. For any questions or requests relating to your personal data, please contact us at hello@klaviyodirectory.com.

2. Data We Collect

We collect and process the following categories of personal data:

• Contact form submissions: name, email address, and any message content you provide when reaching out to us.
• Listing applications: business name, contact email, website URL, location, description, and service specialties submitted via our directory listing form.
• Payment data: billing information processed by Stripe for featured listing subscriptions. We do not store card details on our servers — all payment data is handled directly by Stripe, Inc.

3. Legal Basis for Processing

We process your personal data on the following legal bases under the GDPR:

• Contract performance (Art. 6(1)(b)): Processing is necessary to fulfil the service you have requested — including publishing your listing and managing your subscription.
• Legitimate interests (Art. 6(1)(f)): We process contact form data and listing information to operate and improve our directory service. These interests are not overridden by your rights and freedoms.
• Legal obligation (Art. 6(1)(c)): We may retain certain billing records to comply with applicable tax and accounting laws.

4. Data Retention

We retain personal data only for as long as necessary:

• Contact form submissions: up to 1 year from the date of submission, unless ongoing communication requires longer retention.
• Listing applications and directory entries: for the duration of your listing plus 6 months after removal, unless you request earlier deletion.
• Billing and payment records: up to 3 years to comply with Estonian accounting and tax regulations.

5. Third-Party Processors

We share data with trusted third-party service providers only where necessary to deliver our service:

• Stripe, Inc. — payment processing for featured listing subscriptions.
• Supabase — database hosting for listing and form data.
• Vercel — website hosting infrastructure.

We do not sell your personal data to third parties.

6. Your Rights

Under the GDPR, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests.
• Right to restrict processing: request that we limit how we use your data.

To exercise any of these rights, email hello@klaviyodirectory.com. We will respond within 30 days. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at www.aki.ee.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. All data is transmitted over HTTPS and stored using access-controlled infrastructure.

8. Changes to This Policy

We may update this privacy policy from time to time. The current version will always be available at this URL with the date of the last update noted at the top.

9. Contact

For any privacy-related questions: hello@klaviyodirectory.com