Privacy Policy
Last updated
Blue Ocean Digital OÜ processes personal data on SinceThen.co under the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act. This policy explains what we collect, why, and the rights you have.
1. Controller
Blue Ocean Digital OÜ, Kiriku 6, 10130 Tallinn, Estonia. Phone +372 669 2044, email privacy@sincethen.co. We have not appointed a data protection officer, as we are not required to; all privacy questions go to the email above.
2. Data we process, why, and on what legal basis
| Category | Examples | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Server logs | IP address, browser, device, pages visited, time of request | Deliver the site, keep it secure, detect abuse | Legitimate interest, Art. 6(1)(f) | Up to 30 days, longer only if needed to investigate an incident |
| Account data | Name, email, password (hashed), settings such as your circle's time zone and schedule | Provide your account and the service | Contract, Art. 6(1)(b) | Until you delete your account |
| Circles and invitations | Circle names and photos; the email addresses of people invited to a circle, and whether they have joined | Run your circle and send the invitations you ask us to send | Contract, Art. 6(1)(b); for people who are invited but have no account, legitimate interest, Art. 6(1)(f) | Until the circle is deleted, the invitation is removed, or the invited person deletes their account |
| Content you add | Answers, photos, song links, questions, follow-up questions and answers | Provide the service you use and share it with the members of your circle | Contract, Art. 6(1)(b) | Answers, photos, song links and follow-ups: 60 days after the newsletter they appear in is sent, or sooner if you delete them, the circle is deleted, or you delete your account. Questions: until the circle is deleted or you delete your account |
| Emails we send | Recipient email address, which email was sent and when, whether it was delivered; unsubscribe and bounce records | Deliver questions, reminders, newsletters and account emails; stop emailing people who unsubscribed or whose address bounces | Contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) | Delivery records 90 days; unsubscribe and bounce records for as long as we send email, so we do not email you again |
| Communications | Emails and support messages | Answer your request | Contract or legitimate interest, Art. 6(1)(b)/(f) | Up to 3 years after the last contact |
| Cookies and embedded players | Your sign-in session and cookie choice; with your consent, cookies and device identifiers set by embedded music players | Keep you signed in; with your consent, play songs inside SinceThen.co | Strictly necessary storage: legitimate interest, Art. 6(1)(f); embedded players: consent, Art. 6(1)(a), under § 102 of the Estonian Electronic Communications Act | See the Cookie Policy |
Newsletters are emailed to the members of your circle. When we remove answers and photos from SinceThen.co, copies already delivered to members' inboxes stay with them, and we cannot delete those. Photos in those emails are loaded from our servers through links that expire, so they do not stay in the inbox copy.
When you invite someone to a circle, you give us their email address. We use it only to send them the invitation and the circle's emails, and each email lets them unsubscribe.
We do not sell personal data and do not use it for automated decisions that have legal or similarly significant effects on you.
3. Who receives your data
We share data only with service providers that process it on our behalf under a data processing agreement (Art. 28 GDPR):
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, sign-in, photo storage, server functions and account emails (sign-up confirmation, password reset) | Data stored in Frankfurt, Germany (EU); company based in the USA |
| Vercel Inc. | Website hosting and content delivery | USA, with servers worldwide |
| Resend | Sending invitations, questions, reminders and newsletters | USA (North Virginia) |
The members of a circle see what is shared in that circle, such as names, answers, photos and songs.
When a reply includes a song, its artwork is loaded from the music service's servers (Spotify, Apple Music, Deezer or YouTube), which receive your IP address. If you accept marketing cookies, the song plays in an embedded player from that service, which may set its own cookies. These services act as independent controllers under their own privacy policies.
We also disclose data to authorities, courts or advisers where the law requires it, or to a buyer in the event of a merger or sale of the business.
4. Transfers outside the EEA
Vercel, Resend and the music services named above may process data in the USA, and Supabase is a US company although your data is stored in the EU. We transfer data only where the European Commission has issued an adequacy decision (including the EU–U.S. Data Privacy Framework for certified companies) or where Standard Contractual Clauses and any needed additional safeguards are in place. You can ask us for a copy of these safeguards.
5. Your rights
You have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict how we process it (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interest, and to direct marketing at any time (Art. 21);
- withdraw consent at any time, without affecting processing that took place before (Art. 7(3)).
To use these rights, email us at the address in section 1. We reply within one month and may ask you to confirm your identity. You can also delete your account yourself in Settings.
6. Complaints
You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee, or to the supervisory authority in your EU country of residence or work.
7. Security
We use encryption in transit (TLS) and access controls to protect your data. No system is fully secure, so we also keep the amount of data we collect to what the service needs.
8. Children
SinceThen.co is not directed at children under 13, the age of digital consent in Estonia. We do not knowingly collect their data; if you believe a child has given us data, contact us and we will delete it.
9. Changes
We may update this policy when our service or the law changes. We will post the new version here with its date, and notify account holders by email of material changes.