Privacy Policy
Effective date: 2 November 2026
This Privacy Policy explains what personal data HYFOS collects, why, who it is shared with, and what rights you have.
HYFOS is operated by VIRAL IDEAS Ltd. It is registered in Bulgaria under UIC 206670721, at 10 Petko D. Petkov Street, Nadezhda, 1231 Sofia, Bulgaria ("we", "us"). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR).
Contact: privacy@hyfos.com
1. The short version
- We collect only what we need to run your account: your email address, your password (stored encrypted by our authentication provider), your plan, the themes you follow, and the in-app notifications we show you about them.
- We do not sell your data.
- We do not show ads.
- We do not use advertising or tracking cookies. We count visits with Cloudflare Web Analytics, which sets no cookies.
- We do not send your personal data to AI models.
- Card payments are handled entirely by Stripe. We never see your card number.
- You can delete your account at any time from Settings.
2. What we collect
Account data
- Email address and password. You give us these when you register. The password is stored only in encrypted (hashed) form by our authentication provider. We cannot read it.
- When you created the account.
When you register, your password passes through our server to our authentication provider; we do not store or log it. To check that a new password has not appeared in a known data breach, our server sends the first five characters of a scrambled fingerprint of it to the Have I Been Pwned service; the password itself is never sent to that service.
Subscription data
- Your plan (Free or Pro).
- Whether you pay monthly or yearly.
- When it changed.
- When a paid period ends.
- The customer and subscription identifiers Stripe assigns to you.
We do not receive or store your card details.
Your activity in the platform
- The themes and sub-themes you choose to follow.
- The in-app notifications we show you about what you follow and about analyses you request, and whether you have read them.
When you request an analysis of a company, we record the request with your account, to apply your plan's monthly limit and to notify you when it is ready. If you delete your account, your requests are no longer linked to you.
When something in the platform fails while you are using it, we record what failed and that it affected your account, so we can fix it and contact you about it if needed. These records are kept for 30 days and are deleted with your account.
Feedback
When you send feedback from inside the platform, we receive by email:
- your message;
- its category;
- your account email address, so that we can reply.
Feedback messages are not stored in our platform database. To limit how many messages one account can send, we keep a record that your account sent feedback and when, without its content; this record is deleted after 24 hours.
Sign-up and password reset emails
To limit how many sign-up and password reset emails can be requested, we keep a scrambled fingerprint of the email address and of the IP address each request came from, and when it was made. A fingerprint cannot be turned back into the address. These records are deleted after 24 hours.
Limits on reading
To protect the data in HYFOS from automated copying, we count how many pages your account opens. For this we keep a record of what your account opened and when; this record is deleted after 24 hours. If your account reaches a limit, we keep a record of which limit, when, and how many times, for 30 days. If the pattern suggests automated copying, we may suspend paid access for the account and will tell you how to contact us. If we suspend paid access, we keep a record of when it was suspended and restored. This record is kept while your account exists and is deleted with it.
Emails you send us
If you write to support@hyfos.com or privacy@hyfos.com, we receive your message and email address.
Technical data
Our web server records standard technical logs for security and troubleshooting:
- IP address;
- browser type;
- date and time;
- the page requested.
Log lines about your account — for example when you sign up, reset your password or delete your account, or when an action fails or is refused — can also include your account identifier. Server logs are deleted automatically after at most 30 days. We do not use these logs to profile you.
What we do not collect
- Your name.
- Your address.
- Your phone number.
- Your location (beyond what an IP address implies).
- Any special categories of data.
3. Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating and running your account, signing you in, resetting your password | Account data | Performance of a contract (1)(b) |
| Providing the Pro plan and handling payments, cancellations and refunds | Subscription data | Performance of a contract (1)(b) |
| Keeping accounting and tax records of payments | Subscription and payment records | Legal obligation (1)(c) |
| Showing the themes you follow | Follows | Performance of a contract (1)(b) |
| Notifying you, inside the platform, of new events, theses, bottlenecks, sub-themes and fund flows for what you follow, and when an analysis you requested is ready | Follows, notifications | Performance of a contract (1)(b) |
| Recording your requests for company analyses, to apply your plan's monthly limit and to notify you when an analysis is ready | Your account identifier, the company and the time of the request | Performance of a contract (1)(b) |
| Replying to feedback and support requests | Feedback, emails | Legitimate interest in supporting users (1)(f) |
| Limiting how many feedback messages one account can send | Your account identifier and the time you sent feedback | Legitimate interest in security (1)(f) |
| Limiting how many sign-up and password reset emails can be requested | Fingerprints of the email address and IP address, and the time of the request | Legitimate interest in security (1)(f) |
| Protecting the Service from automated copying | Your account identifier, what your account opened and when, and the limits it reached | Legitimate interest in security (1)(f) |
| Protecting the service against abuse and fixing errors | Technical data | Legitimate interest in security (1)(f) |
We send you only account emails: signup confirmation and password reset. We do not send marketing or notification emails.
4. Who we share it with
We use the following service providers ("processors"). They process data only on our instructions.
| Provider | What it does for us | Where |
|---|---|---|
| Supabase | Database and user authentication | European Union (Ireland) |
| DigitalOcean | Hosting of the platform | European Union (Germany) |
| Stripe | Payment processing, subscriptions, invoices | EU and United States |
| Resend | Delivery of account emails and of feedback messages to us | United States |
| Cloudflare | All traffic to and from the platform passes through Cloudflare, which protects it from attacks and delivers it, keeping copies of static files such as images and scripts. Cloudflare also runs the security check on the sign-in, sign-up and password reset pages (Cloudflare Turnstile), to tell people apart from automated abuse, and Cloudflare Web Analytics, which counts visits and page speed without cookies. It sees your IP address and technical information from your browser and device. | United States and Cloudflare's global network |
| Cloudflare and Google (Gmail) | Forwarding and receiving emails sent to our support@ and privacy@ addresses | United States |
Stripe. Stripe acts as an independent controller for some of the data it collects at checkout, such as fraud prevention and its own legal obligations. Its own privacy policy applies to that data.
Transfers outside the EU. Where a provider processes data outside the European Economic Area, the transfer relies on appropriate safeguards. These are the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.
AI providers. HYFOS uses AI models to analyse public company information: regulatory filings and news. No personal data of users is sent to these models.
We do not sell, rent or trade your personal data. We disclose it to authorities only where the law requires us to.
5. Cookies and similar technologies
We use only what is necessary for the platform to work, and no advertising or tracking cookies. Two scripts from Cloudflare run on our pages. The first is Cloudflare's security check, loaded on the sign-in, sign-up and password reset pages; it is strictly necessary to protect those pages, and Cloudflare may set its own strictly necessary cookies for it, described in Cloudflare's Turnstile Privacy Addendum. The second is Cloudflare Web Analytics, loaded on every page: it counts visits and measures how quickly pages load, without setting cookies, storing anything in your browser or following you across other websites. For that reason, we do not show a cookie banner.
| Name | What it does | How long it lasts |
|---|---|---|
sb-…-auth-token | Keeps you signed in. | Until you sign out, at most 400 days |
hyfos_recovery | Lets the new-password page open only for a visitor who arrived from the password reset email. | 15 minutes |
hyfos-sidebar-collapsed | Remembers whether you collapsed the side menu. It is set only when you click it. | 1 year |
hyfos:nav-trail (session storage, not a cookie) | Remembers the breadcrumb trail that led you to each page you open, so that Back and a reload show the same trail. Kept only in this browser tab. | Deleted when you close the browser tab |
If we ever add a technology that is not strictly necessary, we will update this policy. Where the law requires it, we will ask for your consent first.
6. How long we keep it
- Account, subscription, follows and notifications data: until you delete your account. Deletion removes it immediately.
- Payment and invoice records: kept by Stripe and in our accounting records for the period Bulgarian accounting and tax law requires (currently up to 10 years). This applies even after your account is deleted.
- Feedback and support emails: kept in our mailbox for as long as needed to handle your request. They are deleted on request.
- Server logs: up to 30 days, then deleted automatically.
- Records of what your account opened: 24 hours.
- Records of limits reached: 30 days.
- Records of suspended paid access: while the account exists.
- Records that your account sent feedback: 24 hours.
- Records of sign-up and password reset email requests: 24 hours.
7. Deleting your account
You can delete your account at any time in Settings → Delete account.
What is deleted
- Your email address.
- Your password.
- Your plan record.
- The themes you follow, and your notifications.
These are deleted from our platform immediately and permanently.
What happens to an active subscription. If you have an active paid subscription, it is cancelled at the same moment. See the Terms of Service for what happens to the remaining paid period.
What remains. Payment records remain with Stripe and in our accounting, as described in section 6.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- correct it if it is wrong;
- delete it (see section 7);
- restrict or object to its processing;
- receive it in a portable format.
To use any of these rights, write to privacy@hyfos.com from the email address of your account. We answer within one month.
You also have the right to complain to a data protection authority. In Bulgaria this is the Commission for Personal Data Protection (www.cpdp.bg). You may also complain to the authority in the EU country where you live.
9. Security
- Connections to HYFOS are encrypted (HTTPS).
- Passwords are stored only in hashed form.
- Access to the platform database is restricted by access rules at the database level.
- Card data never reaches our servers.
No system is perfectly secure. If a breach affects your personal data, we will inform you and the authority as the law requires.
10. Children
HYFOS is not intended for anyone under 18. We do not knowingly collect data from minors.
11. Changes to this policy
If we change this policy, we will publish the new version on this page with a new effective date. If a change is material, we will tell you before it takes effect, for example by email or by a notice in the platform.