Privacy notice

Controller and privacy contact

FIXLAYER is developed under the OLVERTH brand by Iadema Studio OÜ, Estonian registration number 16768134. Registered office as listed in public company records: Valge tn 13, Kesklinna linnaosa, Tallinn, Harju maakond, 11415, Estonia. Privacy and account requests: olverthsolutions@gmail.com.

Information processed

For optional email/password registration, FIXLAYER uses the email address, verification state, an account identifier, salted one-way password verifier (never your plaintext password), session-token hashes, one-time security link hashes and anti-abuse attempt information. Google sign-in, if chosen, provides an account identifier and email. Your free browser audit does not require registration.

For active or test billing features, FIXLAYER may record Stripe customer identifiers, subscription and invoice references, plan status, purchased-check balances, audit request metadata, summary findings, timestamps and data fingerprints. Stripe handles payment details in its own payment environment; FIXLAYER does not directly store complete card numbers. Security and support requests can also create email correspondence and access or error logs. Please do not submit passwords, secrets, payment-card data or identifiable third-party financial records.

Why data is used

Account registration, sign-in, account recovery and requested features are generally processed to take steps before a contract or perform a contract (GDPR Article 6(1)(b)); security, fraud prevention and service integrity may involve legitimate interests (Article 6(1)(f)), subject to applicable rights; invoices and accounting records may be retained to fulfil applicable legal obligations (Article 6(1)(c)). Enquiries are used to respond to the request, not to automatically enrol you in unrelated marketing lists. No marketing email subscription is implied by opening a FIXLAYER account. Any future marketing purposes and lawful bases must be disclosed and activated separately. Further legal-basis review is required before any commercial Live release.

Free browser audits and cloud processing

Free CSV/JSON audits are designed to process selected datasets in your browser rather than intentionally upload raw file contents to FIXLAYER. Hosting providers may still process request metadata, technical security data or ordinary access logs. When separately enabled, paid cloud audits instead transmit selected input to FIXLAYER server code on Cloudflare; the code is designed to process input transiently and retain summary metadata, counts and fingerprints rather than complete input files. This feature is currently paused in the Preview pending dedicated paid-audit testing. Use synthetic or properly anonymised data during beta evaluation.

Authentication, email and security

Brevo delivers verification, account setup and password-reset emails with the recipient address and a short-lived security link. Cloudflare Turnstile checks for automated abuse. Google supplies account authentication details only if you choose Google sign-in. Verification links currently expire after 24 hours; password reset links after 30 minutes; signed-in sessions may have a validity period of up to 30 days, subject to logout or revocation. Expiration does not itself mean corresponding database records have been deleted. The implementation hashes session and email-action tokens in D1; account password reset revokes previously created sessions.

Who is responsible for business datasets?

Iadema Studio OÜ acts as a data controller for FIXLAYER user accounts, authentication and service support records, subject to an updated commercial compliance review. Where a business customer lawfully supplies records about third parties specifically for server-side diagnostic processing, the parties may have controller/processor obligations; these require an executed and appropriately scoped Data Processing Agreement before accepting such real-world datasets. The Preview is restricted to synthetic or appropriately anonymized data.

Payments, merchant of record and transaction support

FIXLAYER Live is not yet collecting real payments. If a future purchase uses Stripe Managed Payments, Link/Stripe may appear as the actual merchant of record and process transaction billing and refund support, whereas direct Stripe Payments would use a separately verified seller arrangement. Stripe, Link and their processors may independently retain transaction, tax, invoice, dispute and support records according to their roles and applicable obligations. FIXLAYER retains limited identifiers and entitlement events for access control and financial reconciliation, not raw card credentials.

Providers and international transfers

Service providers include Cloudflare (site, Workers, D1 and Turnstile), Brevo (transactional email), Google (optional sign-in and correspondence) and Stripe (test billing and, if later authorised, paid services). Tally may handle separately requested early-access enquiries. Provider processing may involve international transfers or service subcontractors. The applicable contracts, data locations and legal safeguards must be reviewed before handling customer datasets or launching Live billing; we do not assume every service keeps data exclusively in the European Union.

Data retention

For enquiries that do not become engagements, a previous beta operational target was deletion within 90 days of the last relevant contact, subject to legal exceptions. This is not a blanket retention or automatic-deletion guarantee for accounts, invoices, logs or security records. Authentication link validity is described above, while account, usage, invoice, session, token-record, backup and provider-log deletion schedules need a documented and tested retention procedure. Records necessary for applicable accounting or legal obligations may need to be preserved longer.

Account security and retention controls

Depending on the service and legally applicable retention schedule, some account records must remain after cancellation for invoices, fraud-prevention records, disputes or mandatory financial history. Session validity, password reset and email verification time limits are not database deletion deadlines. Security-related event logs, encrypted backups and provider records may have separate retention periods. A final commercial schedule specifying each category, backup destruction and rights-handling process remains subject to operational certification.

Your rights and access to account data

Where applicable, you may request access, correction, erasure, restriction, portability or object to processing, and complain to a competent data-protection authority. Contact olverthsolutions@gmail.com. We may verify your identity to protect the account. Signed-in users can request a limited account snapshot through the FIXLAYER interface/API; this is not a complete statutory data-access, deletion or portability workflow and may omit additional provider records. Requests requiring fuller access or erasure are handled individually subject to legal obligations and technical verification.

Beta limits, children and updates

FIXLAYER beta is intended for professionals and is not designed for children. Do not upload special-category or sensitive personal information for testing. Diagnostic findings are not financial or legal determinations. We will update the effective notice when products, processors or legal obligations change materially. This current text should not be read as a fully approved set of terms for paid Live services.