Legal documents

Privacy Policy

Version v2.0 · effective 16 October 2026

Controller (data controller): Daniil Polinovskyi, natural person (private individual), Norway, Moss
Data-protection contact: [email protected]

Who the Controller is. The Controller is a natural person (a private developer), not a company. This does not set aside GDPR: the "personal/household purposes" exemption (GDPR Art. 2(2)(c)) does not apply, because the Service is publicly available.

Applicable law. The Controller is located in Norway, which is part of the EEA, so the processing of personal data is governed by the GDPR (Regulation (EU) 2016/679), as implemented by the Norwegian Personal Data Act (Personopplysningsloven). If the Service is used by a person in Ukraine, the Law of Ukraine "On Personal Data Protection" also applies (Section 16).

This document describes what data we collect, on what basis, how we store and protect it, to whom we transfer it, and how you can exercise your rights under the GDPR.

1. General provisions

1.1. This Policy applies to all data the Controller receives through the Service: the web application (Flutter Web) on the domain myfunction.app, the public profile pages myfunction.app/s/…, and related server components.

1.2. Under the GDPR, the Controller acts as the data controller; the service providers engaged act as data processors on the Controller's behalf (Section 7).

1.3. Processing is carried out only to the extent minimally necessary to operate the Service (the minimisation principle, GDPR Art. 5(1)(c)).

2. Key concepts

Personal data — information about an identified or identifiable person (GDPR Art. 4).
Controller — the entity that determines the purposes and means of processing.
Processor — the entity that processes data on the Controller's behalf.
User — a registered person. Roles: Seeker and Specialist.
Public profile — a publicly accessible Specialist page at myfunction.app/s/<slug>.

3. What data we process

3.1. Account data

Email — login and service emails (sign-up confirmation, access recovery).
Password — not stored in plain text; an irreversible hash is stored (Supabase Auth).
Technical identifier of the user and session information.

3.2. Profile data

Role (seeker/specialist), display name, avatar, country and region, onboarding status.
For a Seeker: the selected category/field of interest.
For a Specialist: category, headline, description, city; contacts (phone, email, Telegram — optional); portfolio (images and captions); public profile address.

3.3. What we do not collect

The Controller does not request precise geolocation, contacts, or access to the camera and gallery, except where the User themselves uploads an image of their own choice. Card payment details are not passed directly to the Controller.

3.4. Technical data and security

Request logs (access/rate-limit log): the fact and time of a request, service identifiers — for abuse protection.
Anti-bot check (Cloudflare Turnstile) when public pages are opened.
Standard technical information sent by the browser when accessing the site.

3.5. Data that becomes public (important)

When a Specialist publishes their profile, the following data becomes available to any internet visitor on the page myfunction.app/s/<slug> and in the card inside the app: name, city, category, avatar, headline and description; contacts (phone, email, Telegram) if the Specialist provided them; portfolio images and captions (via temporary signed links).

Do not publish data you do not want to disclose publicly. Contacts are shown to third parties only after the profile is published. The legal basis is your consent, which you can withdraw by unpublishing.

4. Purposes and legal bases (GDPR Art. 6)

Purpose	Data	Basis (Art. 6)
Registration, sign-in, account management	email, password (hash), id	consent; contract — (a),(b)
Profile and onboarding	profile, role, region	contract — (b)
Publishing a Specialist profile	public fields, contacts, portfolio	consent — (a)
Catalog and specialist search	public fields	contract — (b)
Service and transactional emails	email	contract — (b)
Security, abuse and spam prevention	access log, anti-bot data	legitimate interest — (f)
Service improvement	anonymised statistics	legitimate interest — (f)

Where the basis is consent, you may withdraw it at any time (this does not affect the lawfulness of processing before the withdrawal).

5. Special categories and profiling

5.1. The Controller does not request special categories of data (GDPR Art. 9: health, ethnicity, religious and political views, etc.). Please do not place them in public profile or portfolio fields.

5.2. The Controller does not use automated decision-making (GDPR Art. 22). The catalog/search consists of simple filter-based queries.

6. Cookies, local storage, and cache

The session is stored in secure local storage (Supabase token); it is cleared on sign-out or when site data is cleared.
The web version uses a service worker and cache for fast startup — these are application files, not your data.
Cloudflare Turnstile may set technical cookies.
Strictly necessary cookies/storage are used on the basis of legitimate interest. Analytics/marketing cookies — only after consent (ePrivacy / Norwegian Ekomloven).

7. Transfers to processors and third parties

The Controller engages processors on its behalf (GDPR Art. 28), with a DPA in place:

Supabase — database (PostgreSQL), file storage (avatars, portfolio), authentication, service emails. Hosting region — Europe (EEA).
Cloudflare (Pages / Turnstile) — site hosting and delivery, attack protection.
Payment provider (planned: Stripe) — subscription payments. As of the date of this version, payments are not enabled and no data is transferred to the Payment provider; the terms will be reflected here before payments launch.

The Controller does not sell personal data. Transfers are possible only to the processors above, on a lawful request from public authorities, or with the User's consent.

8. Transfers outside the EEA (Chapter V)

Data is stored on servers within the EEA (including the Supabase database hosting region — Europe). The Controller does not carry out targeted transfers of personal data outside the EEA. If in the future a processor places servers outside the EEA, the transfer will be carried out only where appropriate safeguards exist (adequacy / SCC 2021/914).

9. Data storage and protection

Row-level access control (Row Level Security): you can view and change only your own data.
Access to the contacts and portfolio of other profiles is restricted at the database level and open only for published profiles.
TLS/HTTPS encryption in transit.
Uploaded images are restricted by type and size (images only; avatar/portfolio — up to 5 MB).
Secrets are stored on the server and are not sent to the client.

10. Retention periods (Art. 5(1)(e))

Account and profile data — until the account is deleted.
Public data — until it is unpublished or the account is deleted.
Security logs (access log) — up to 30 days.
After account deletion, data is deleted/anonymised within up to 30 days, except where required by law.

11. Account deletion and the right to erasure

The User may delete the account themselves: "Settings → Delete account". The profile, contacts, portfolio, uploaded files, and sign-in data are irreversibly deleted. This implements the right to erasure (GDPR Art. 17).

12. Your rights under the GDPR

access to data (Art. 15);
rectification (Art. 16);
erasure — the "right to be forgotten" (Art. 17);
restriction (Art. 18);
portability (Art. 20);
objection (Art. 21);
withdrawal of consent (Art. 7(3));
not to be subject to automated decisions (Art. 22 — not used).

A response to a request is provided within 1 month (may be extended up to 3 months).

Right to lodge a complaint:
Norway — Datatilsynet (datatilsynet.no) · another EEA country — your local supervisory authority · Ukraine — see Section 16.

13. Minors

The Service is intended for persons aged 16 and over. The age of 16 is chosen by the Controller as the minimum threshold (in Norway the basic "digital age of consent" is 13, GDPR Art. 8). Data of persons below the threshold is not knowingly collected; if identified, it is deleted.

14. Changes to this Policy

A new version is published on this page with a date and takes effect upon publication unless otherwise stated. The Controller aims to notify of material changes through the Service.

15. Contact

Controller: Daniil Polinovskyi, natural person, Norway, Moss
Data-protection email: [email protected]

16. Ukraine

16.1. If the Service is used by a person in Ukraine, the Law of Ukraine "On Personal Data Protection" No. 2297‑VI additionally applies.

16.2. Data-subject rights: to know the composition of the data; to obtain access; to request modification/deletion; to withdraw consent; to contest processing.

16.3. The supervisory authority in Ukraine is the Ukrainian Parliament Commissioner for Human Rights (Ombudsman for personal data protection).

16.4. Data is processed on servers within the EEA (see the data-location section). If applicable Ukrainian law requires additional measures (for example, database localisation), the Controller will adopt them and reflect them in this Policy.

This document is a standard template adapted to the actual data processing and does not constitute legal advice. Before publication — review by a lawyer (GDPR / personopplysningsrett).