Privacy Policy
Effective date: 28 September 2026 Last updated: 28 September 2026
The short version. Being public is the point of Expenshit. Your display name, the amount you paid and anything you choose to add to your profile are shown to the world. Everything else, such as your email, your payment details and your IP address, stays private and is used only to run the Service, keep it safe and meet our legal obligations. We don't sell your data. You can make your profile anonymous at any time.
1. Who is responsible for your data
The controller of your personal data is HAYDAR ® STUDIO, 47 rue Vivienne, 75002 Paris, France ("Expenshit", "we", "us").
For anything related to privacy, contact hello@haydar.studio.
2. Public vs. private: know what you're showing
| Public: anyone can see it | Private: only we (and our service providers) see it |
|---|---|
| Display name | Email address |
| Amount paid (total and per payment) | Account login details |
| Rank and payment dates | Billing name, country and postcode |
| Country (if shown) | Payment method details (held by Stripe; we see only the card brand, last 4 digits and expiry date) |
| Photo (optional) | IP address, device and browser information |
| Message / "Why did you waste it?" (optional) | Checkout consents (age, withdrawal waiver, Terms) |
| Social links (optional) | Emails you send us |
Before you add something to your profile, remember that it is public. Search engines may index it, and other people can screenshot and share it. Once someone else has copied something, we cannot recall it.
3. What we collect and why
| Data | Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Email, account details, billing details | Creating your account, processing payments, delivering your Object and Certificate, sending receipts | Performance of a contract |
| Display name, amount paid, rank, dates | Showing your Listing on the leaderboards, which is the core of what you bought | Performance of a contract |
| Photo, message, social links | Showing them on your Listing, because you chose to add them | Performance of a contract. You can remove them at any time |
| IP address, device data, payment risk signals | Preventing fraud, card testing and abuse, and keeping the Service secure | Legitimate interests (security and fraud prevention) |
| Checkout consents and delivery records | Proving your consent and delivery if there is a dispute or chargeback | Legitimate interests; legal obligation |
| Transaction records | Tax, accounting and anti-money-laundering obligations | Legal obligation |
| Usage analytics (pages viewed, clicks on profiles) | Understanding how the Service is used, and showing aggregate view and click statistics | Consent, where required (via our cookie banner); otherwise legitimate interests |
| Marketing emails | Sending you news, if you opt in | Consent. You can withdraw it at any time |
| Messages you send us | Answering you | Legitimate interests; performance of a contract |
We do not use your data for automated decision-making that has legal or similarly significant effects on you, apart from automated fraud screening at checkout. If a payment is blocked, you can contact us and ask a person to review it.
4. Who we share data with
We share personal data only with service providers that help us run the Service, under contracts that require them to protect it:
- Stripe (payment processing and fraud prevention). Stripe acts as an independent controller for some payment data. See stripe.com/privacy.
- Lovable Cloud and our infrastructure providers (hosting and data storage)
- Our transactional email provider (receipts and service emails)
- Our analytics provider (aggregate usage statistics, where enabled)
We may also disclose data where the law requires it, to protect our rights or users' safety, or as part of a merger or sale of the business, in which case the new owner will remain bound by this policy.
We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
5. International transfers
Some of our providers are located outside your country, including in the United States. Where we transfer personal data outside the EU/EEA or the UK, we rely on an adequacy decision (such as the EU–US Data Privacy Framework, where the provider is certified) or on Standard Contractual Clauses approved by the European Commission, together with any additional safeguards needed.
6. How long we keep data
| Data | How long |
|---|---|
| Public Listing (name, photo, message, links) | Until you anonymise or delete it, or until your account is closed |
| Transaction records | For as long as French tax and accounting law requires |
| Checkout consent and delivery records | For the transaction period plus the chargeback window (up to 18 months) |
| Fraud and security logs | Up to 12 months, unless needed for an ongoing investigation |
| Support emails | Up to 24 months after the issue is closed |
| Marketing preferences | Until you unsubscribe |
7. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- delete your data (see the note below);
- restrict or object to certain processing, including processing based on legitimate interests;
- data portability, meaning you can receive your data in a machine-readable format;
- withdraw consent at any time, without affecting processing already carried out;
- complain to a data protection authority, in particular in the country where you live or work.
A note on deletion. You can delete your photo, message and links at any time in your account settings. You can also make your Listing anonymous: your entry will then show as "Anonymous Idiot", with only the amount and date visible. We cannot fully erase transaction records that the law requires us to keep, and payments you made continue to count in aggregate totals (such as the global counter) without identifying you.
To exercise your rights, email hello@haydar.studio. We reply within one month. We may ask you to verify your identity first.
California residents: You have the right to know, delete and correct your personal information, and to opt out of its sale or sharing. We do not sell or share personal information as defined by the CCPA/CPRA. We will not discriminate against you for exercising your rights.
8. Cookies
We use:
- strictly necessary cookies to keep you logged in, secure checkout and prevent fraud (including cookies set by Stripe). These do not need consent;
- analytics cookies only with your consent, where the law requires it. You can change your choice at any time using the "Cookie settings" link in the footer.
We do not use advertising or cross-site tracking cookies.
9. Security
We use industry-standard measures to protect your data, including encryption in transit (HTTPS), access controls and PCI-DSS-compliant payment processing through Stripe. No system is perfectly secure. If a data breach is likely to put your rights at risk, we will notify you and the relevant authorities as the law requires.
10. Children
The Service is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you think a minor has used the Service, contact hello@haydar.studio and we will delete their data and refund the purchase in line with our Refund Policy.
11. Changes to this policy
We may update this policy from time to time. We will notify you of material changes by email or on the Service before they take effect.
12. Contact
HAYDAR ® STUDIO 47 rue Vivienne, 75002 Paris, France hello@haydar.studio