Privacy Notice

1. Introduction

This Privacy Notice explains how Happenstance ("we", "us", "our") collects, uses, and protects your personal data in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

We are committed to protecting your privacy and giving you control over your personal information.

Data Controller:
Epode Studio
Frejavägen 3, 222 70 Lund, Sweden
Org.nr: 199602203532
Email: hello@happenstance.click
DPO: hello@happenstance.click

2. What Data We Collect

2.1 Account Information

When you create an account, we collect:

• Name: Your full name
• Email address: For account access and communication
• GitHub account data: Username, avatar, and email (if you sign in via GitHub OAuth)
• Organization details: Company name, team member information

2.2 Billing Information

For paid subscriptions:

• Payment information: Processed and stored by Paddle (our payment processor), not by us
• Billing address: Required for VAT compliance
• Invoice details: Transaction history and receipts

Important: We never see or store your credit card details. All payment processing is handled securely by Paddle in compliance with PCI DSS standards.

2.3 Analytics Data You Collect

When you use our service to track analytics on your applications, we process:

• Event data: User interactions, button clicks, page views
• Hashed IP addresses: One-way encrypted for privacy (GDPR-compliant)
• User agent strings: Sanitized to remove identifying information
• Session data: Anonymized session identifiers
• Error logs: Stack traces and error messages

You are the data controller for analytics data collected from your users. We act as a data processor, storing and processing this data on your behalf.

2.4 Technical Data

We automatically collect:

• Log data: API requests, response times, error codes
• Device information: Browser type, operating system (non-identifying)
• Cookies: Session cookies for authentication (see Section 8)

2.5 Communication Data

When you contact us, we collect:

• Support tickets and correspondence
• Feedback and survey responses

3. Legal Basis for Processing

Under GDPR, we process your personal data based on:

4. How We Use Your Data

We use your personal data to:

• Provide services: Account management, analytics processing, API access
• Billing: Process payments, issue invoices, manage subscriptions
• Communication: Send service updates, security alerts, and support responses
• Improvement: Analyze usage patterns to improve our platform (anonymized)
• Security: Detect and prevent fraud, abuse, and security threats
• Legal compliance: Meet tax, accounting, and legal obligations
• Marketing: Send product updates and offers (with your consent; you can opt-out anytime)

5. Data Sharing and Transfers

5.1 Third-Party Service Providers

We share data with trusted processors who help us operate our services:

5.2 International Transfers

Some of our service providers are located outside the European Economic Area (EEA). When we transfer data internationally, we ensure:

• Adequacy decisions under GDPR (e.g., transfers to countries with adequate data protection)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Additional safeguards where necessary (encryption, access controls)

5.3 Other Disclosures

We may disclose your data if:

• Required by law or legal process
• Necessary to protect our rights, property, or safety
• In connection with a merger, acquisition, or sale of assets (with notice to you)

6. Your Rights Under GDPR

As an EU data subject, you have the following rights:

To exercise your rights: Contact us at hello@happenstance.click or use our privacy dashboard.

7. Data Retention

We retain your data for as long as necessary to provide services and comply with legal obligations:

We automatically delete data according to these schedules. You can request earlier deletion (subject to legal requirements).

8. Cookies and Tracking

We use cookies to provide and improve our services:

You can control cookie settings in your browser. Disabling essential cookies may affect service functionality.

9. Security Measures

We implement industry-standard security measures to protect your data:

• Encryption: AES-256 encryption at rest, TLS 1.3 in transit
• Access controls: Role-based access, multi-factor authentication
• Hashing: Bcrypt for API keys, SHA-256 for IP addresses
• Monitoring: 24/7 security monitoring and intrusion detection
• Audits: Regular security audits and penetration testing
• Backups: Daily encrypted backups with 30-day retention
• Incident response: 72-hour breach notification (GDPR Art. 33)

10. Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at hello@happenstance.click.

11. Changes to This Notice

We may update this Privacy Notice to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Email notification (for significant changes)
• In-app notification
• Updating the "Last Updated" date

Continued use of our services after changes constitutes acceptance. If you do not agree, you may close your account.

12. Contact Us

For privacy-related questions or to exercise your rights:

Swedish Supervisory Authority:
Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection)
Website: www.imy.se
Phone: +46 8 657 61 00
Email: imy@imy.se

You may also find other EU data protection authorities at: https://edpb.europa.eu/about-edpb/board/members_en