Privacy

Nitro Cloud LTD
Akad. Mihail Arnaudov 3, Et. 3, 7005 Ruse, Bulgaria
Registered with the Bulgarian Commercial Register, UIC 207555451. VAT ID BG207555451.
Represented by its managing director, Bekir Özalp.
Email: [email protected]

For the accounts of bakery owners and team members, Nitro Cloud LTD is the controller. For the orders and requests a bakery receives from its customers, the bakery decides what happens with that data and is the controller; we store and process it on the bakery's behalf as its processor (Art. 28 GDPR).

• Account: email address, display name, preferred language.
• Sign-in: if you use Google or Apple, the identifier they give us for your account (and, for Apple, a token we keep only to revoke access when you delete the account). Email sign-in uses one-time codes; we do not store passwords.
• Sessions and, if you allow them, push notification subscriptions for your devices.
• Shop: shop name and web address, country, currency, time zone, shop address if you enter one, products, prices, photos, delivery settings, team membership.
• Notes you send us from a screen of the panel or app, including photos and voice recordings you attach.
• Terms acceptance: the time you accepted and the version of the terms.

When someone places an order or a cake request, the bakery receives what they enter: name, contact details (email and/or phone), delivery address where delivery is chosen, order choices and notes, photos they upload, and messages exchanged about the order. A location is shared in an order chat only when someone chooses to send it.

• To provide the service you signed up for: accounts, sign-in, shops, orders, messages and notifications (Art. 6(1)(b) GDPR, performance of a contract).
• To keep the service secure and prevent abuse, for example the bot check on sign-up forms, rate limits and security logs (Art. 6(1)(f) GDPR, our legitimate interest in a safe service).
• To keep records the law requires, such as accounting records (Art. 6(1)(c) GDPR).
• Push notifications only after you allow them on your device; you can switch them off at any time in the device or app settings.

We do not sell personal data, show advertising, or use third-party analytics or tracking. The only measurement we run is the self-hosted, cookieless analytics on the public pages of the website described below; the Butiq app contains no analytics.

To understand how the public pages of this website are used, we run Umami, an open-source analytics tool that we host ourselves at stats.arpclean.com. The server is operated by Nitro Cloud LTD in the EU, on the same infrastructure as our sister product ArpClean. No visit data is sent to Google Analytics or to any comparable third-party analytics or advertising network.

It runs only on the public website pages (home, features and this kind of information page). It does not run on the shop pages where customers place orders, in the panel or in the app.

Umami sets no cookies and stores nothing on your device; it only reads the opt-out flag umami.disabled described below. You are not given a persistent identifier and cannot be followed from this website to any other one.

For each page view we record the page address and title, the referring address, your browser, operating system, device type and screen size, the language your browser reports and the country the request came from. Your IP address is used only in transit, to derive that country and a visitor hash that is regenerated daily; it is not stored. We use the result solely to see which pages and which channels bring people to us. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in understanding and improving our website.

How to opt out. We honour your browser's "Do Not Track" setting: if it is enabled, nothing is recorded. You can also switch measurement off permanently by opening your browser's developer console on butiq.shop and running localStorage.setItem('umami.disabled', 1). Any content blocker that blocks stats.arpclean.com has the same effect.

Butiq runs on servers we operate in a data centre in Amsterdam, the Netherlands (EU). The database, file storage, cache and our mail server are self-hosted there. The following services receive personal data only as far as needed for their task:

• OpenAI (United States), and Anthropic (United States) as an alternative: shop text such as product descriptions and chat messages is sent to translate content, suggest product drafts and assist with replies. Under their API terms this data is not used to train their models.
• Resend (United States): delivers the emails we send, such as sign-in codes and order messages.
• Cloudflare (United States): sits in front of the website, protects it against attacks and runs the bot check on sign-up forms.
• Expo (650 Industries, United States), Apple and Google: deliver push notifications to the app; your browser's push service delivers web notifications.
• Google and Apple, when you choose to sign in with them.
• Payment providers such as Stripe or Mollie: payments go through the bakery's own account with the provider, which is responsible for the payment data. Butiq does not hold card or bank credentials.

Where data goes to the United States, the transfer relies on the EU Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.

• Sign-in codes expire within minutes; sessions end when you sign out or when they expire.
• Accounts, shops and orders are kept while the account or shop exists. Deleting an account anonymises it as described on the account deletion page.
• Data of a closed shop, order history and audit records are kept for as long as needed for the purposes above and for the limitation periods set by law, and for longer only where needed to deal with a legal dispute. On request we delete what we are not required to keep.
• Encrypted backups are kept for 14 days and then deleted.

Connections are encrypted, payment provider keys are stored encrypted, each shop's data is separated from other shops at database level, and backups are encrypted.

Butiq is a tool for businesses and is not directed at children. Bakery accounts are for adults acting for their business.

You can ask for access to your data, a copy of it, correction, deletion or restriction, and you can object to processing based on our legitimate interest. Bakery owners and team members can delete their account in the app under account settings. For everything else write to [email protected]; we answer within one month. Customers of a bakery may also contact that bakery directly, since it decides about their order data.

You also have the right to complain to a supervisory authority, in particular the one where you live. Ours is the Bulgarian Commission for Personal Data Protection (cpdp.bg).

We update this page when the service changes. The date at the top shows the current version; important changes are announced in the panel or by email.