Privacy Policy

Last updated: January 2025

Data Controller Information

Bookmarkjar
Email: privacy@bookmarkjar.com
Legal Contact: legal@bookmarkjar.com

1. Introduction

Welcome to Bookmarkjar's Privacy Policy. We respect your privacy and are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and Portuguese data protection laws.

This Privacy Policy explains:

• What personal data we collect and why
• How we use, process, and store your data
• Your rights regarding your personal data
• How to contact us about privacy concerns

Important: You must be at least 18 years of age to use our Service. We do not knowingly collect or process personal data from individuals under 18.

2. Legal Basis for Processing

Under GDPR Article 6, we process your personal data based on the following legal grounds:

• Contract Performance (Article 6(1)(b)): To provide our bookmark management services
• Legitimate Interest (Article 6(1)(f)): To improve our Service, prevent fraud, and ensure security
• Consent (Article 6(1)(a)): For optional features like marketing communications
• Legal Obligation (Article 6(1)(c)): To comply with legal requirements (tax, accounting, law enforcement)

You have the right to withdraw consent at any time where we rely on consent as the legal basis.

3. Information We Collect

3.1 Account and Profile Data

We collect when you create an account:

• Email address (required for account creation and communication)
• Name and profile information (optional, if provided)
• Password (stored as encrypted hash, never in plain text)
• Profile picture (if uploaded or synced from OAuth providers)
• Account preferences and settings

Legal Basis: Contract performance, consent

3.2 Authentication Data from Third-Party Services

When you connect social authentication (OAuth):

• Google: Email, name, profile picture
• Discord: Username, email, profile picture
• Twitter/X: Username, profile picture, email (if available)
• GitHub: Username, email, profile picture
• Reddit: Username

We only access data you explicitly authorize during the OAuth flow.

Legal Basis: Consent, contract performance

3.3 Bookmark Data

We collect and store:

• URLs and titles of bookmarks you save
• Metadata: Description, author, publication date, site name
• Content: Full text content of bookmarked pages (for search and AI processing)
• Images: Screenshots, thumbnails, and media from bookmarked content
• Tags and categories you create
• Notes and annotations you add
• Sync data from integrated services (Twitter likes, GitHub stars, Reddit saves)
• Organization: Folders, collections, sharing settings

Legal Basis: Contract performance, legitimate interest

3.4 Integration Data

When you connect third-party integrations:

• Access tokens and refresh tokens (encrypted)
• Integration metadata: Username, account ID, last sync timestamp
• Synced content: Bookmarks from Twitter, GitHub, Reddit, Instagram, YouTube
• OAuth session data: State, code verifier, expiration

Legal Basis: Consent, contract performance

3.5 Usage and Analytics Data

We automatically collect:

• Browser information: Type, version, user agent
• Device information: Operating system, device type, screen resolution
• IP address: For security, fraud prevention, and geolocation (country-level)
• Pages visited: URLs accessed within our Service
• Time and date of access
• Referral source: How you arrived at our Service
• Feature usage: Which features you use and how often
• Session data: Duration, actions performed
• Error logs: Technical errors and debugging information

Legal Basis: Legitimate interest (service improvement, security, fraud prevention)

3.6 AI Processing Data

For AI-powered features, we process:

• Bookmark content: Sent to OpenAI/Google AI for summarization and tagging
• Search queries: Processed for semantic search
• Chat messages: Sent to AI providers for conversational features
• Token usage: Amount of AI processing consumed

Note: AI providers (OpenAI, Google) may temporarily process your data according to their own privacy policies. We use business-tier services with data processing agreements where available.

Legal Basis: Contract performance, legitimate interest

3.7 Payment and Subscription Data

We collect (via Stripe):

• Billing information: Name, email, country
• Payment method details: Handled entirely by Stripe (we never see full card numbers)
• Transaction history: Subscription status, invoices, payment dates
• Tax information: VAT numbers (if provided)

Stripe is our payment processor and handles sensitive payment data. We receive only transaction confirmations and subscription status.

Legal Basis: Contract performance, legal obligation

3.8 Communications Data

When you contact us:

• Email correspondence: Support requests, inquiries
• Feedback and surveys: If you choose to participate
• Marketing preferences: Newsletter subscriptions (opt-in only)

Legal Basis: Consent, contract performance, legitimate interest

4. How We Use Your Information

We use your personal data to:

4.1 Provide Core Services

• Create and manage your account
• Store and organize your bookmarks
• Sync bookmarks from integrated platforms
• Enable search (keyword and semantic)
• Process AI features (tagging, summarization, chat)
• Deliver real-time notifications
• Provide browser extension functionality
• Offer API access (Pro users)

4.2 Improve and Develop the Service

• Analyze usage patterns to improve features
• Identify and fix bugs and technical issues
• Conduct A/B testing and experimentation
• Develop new features and functionality
• Optimize performance and user experience

4.3 Communicate with You

• Send service-related notifications (account, security, updates)
• Respond to support requests and inquiries
• Send subscription and billing information
• Notify of Terms or Privacy Policy changes
• Send marketing communications (only if you opt in)

4.4 Security and Fraud Prevention

• Detect and prevent fraud, abuse, and security threats
• Verify account ownership
• Enforce our Terms of Service
• Protect against unauthorized access
• Maintain system integrity

4.5 Legal Compliance

• Comply with legal obligations (tax, accounting)
• Respond to lawful requests from authorities
• Protect our legal rights and interests
• Enforce contracts and policies

5. Data Sharing and Third-Party Services

We do not sell your personal data. We share data only as described below:

5.1 Third-Party Service Providers

We use the following services to operate:

AI Processing:

• OpenAI (United States) - AI summarization, tagging, chat
• Google AI (United States) - AI features and processing
• Privacy Policies: OpenAI, Google

Payment Processing:

• Stripe, Inc. (United States) - Payment processing, subscription management
• Privacy Policy: Stripe Privacy

Search and Indexing:

• Meilisearch (Self-hosted or managed) - Search functionality
• Privacy Policy: Meilisearch

Storage:

• Amazon S3/Cloudflare R2 (United States/Global) - Media and file storage
• Privacy Policies: AWS, Cloudflare

Background Jobs:

• BullMQ (United States) - Background jobs and scheduled tasks
• Privacy Policy: BullMQ Privacy

Monitoring and Error Tracking:

• Sentry/GlitchTip - Error monitoring and debugging
• Privacy Policy: Varies by provider

Social Platform APIs:

• Twitter/X, GitHub, Reddit, Instagram, YouTube - OAuth authentication and bookmark syncing
• Data accessed only with your explicit permission
• Privacy Policies: Respective platform policies apply

5.2 Data Processing Agreements

For services that process personal data on our behalf, we have data processing agreements (DPAs) in place where required by GDPR Article 28, ensuring appropriate safeguards.

5.3 Cross-Border Data Transfers

Some of our service providers are located in the United States and other countries outside the European Economic Area (EEA). We ensure adequate safeguards for cross-border transfers through:

• EU-US Data Privacy Framework (where applicable)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with GDPR-compliant terms

Under GDPR Article 46, these mechanisms ensure your data receives adequate protection when transferred outside the EEA.

5.4 Legal Disclosures

We may disclose personal data when:

• Required by law, regulation, or legal process
• Requested by law enforcement or government authorities
• Necessary to protect our rights, property, or safety
• Necessary to protect users' rights, property, or safety
• In connection with corporate transactions (merger, acquisition, asset sale)

5.5 Public Information

Bookmarks you explicitly mark as "public" or share publicly may be visible to other users or third parties. You control the privacy settings of your content.

6. Data Retention

6.1 Active Accounts

We retain your personal data while your account is active and for as long as necessary to provide services.

6.2 Retention Periods

• Account data: Retained while account is active
• Bookmarks: Retained while account is active or until you delete them
• Deleted bookmarks: Removed immediately or within 24 hours
• Integration tokens: Retained while integration is active
• Usage analytics: Aggregated and retained for up to 2 years
• Backup copies: Retained for up to 90 days for disaster recovery
• Legal/financial records: Retained as required by law (typically 7–10 years for tax purposes)

6.3 Account Deletion

When you delete your account:

• Personal data is deleted within 30 days
• You have 30 days to export your data before permanent deletion
• Backups may retain data for up to 90 days before complete removal
• Legal/financial records retained as required by law

6.4 Inactive Accounts

Accounts inactive for 3 years or more may be deleted after notice to your registered email address.

7. Data Security

7.1 Security Measures

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit: TLS/SSL for all data transmission
• Encryption at rest: Database and file storage encryption
• Access controls: Role-based access, principle of least privilege
• Authentication: Strong password requirements, OAuth support, optional 2FA
• Monitoring: Security monitoring, intrusion detection, logging
• Regular updates: Security patches and software updates
• Secure development: Code reviews, security testing
• Data minimization: We collect only necessary data
• Pseudonymization: Where appropriate for analytics

7.2 Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms:

• We will notify the Portuguese Data Protection Authority (CNPD) within 72 hours
• We will notify affected users without undue delay
• Notifications will include nature of breach, potential consequences, and mitigation measures

7.3 Your Responsibilities

You are responsible for:

• Keeping your password secure
• Not sharing account credentials
• Using strong, unique passwords
• Maintaining security of your devices
• Regularly reviewing account activity

Note: While we implement robust security measures, no method of transmission or storage is 100% secure. You use the Service at your own risk.

8. Cookies and Tracking Technologies

8.1 What We Use

We use cookies and similar technologies:

Essential Cookies (Required for service operation):

• Session cookies: Maintain login state
• Authentication tokens: Verify identity
• Security cookies: Prevent CSRF attacks, detect fraud

Functional Cookies (Enhance functionality):

• Preferences: Remember settings, language, theme
• Feature flags: Enable/disable features for testing

Analytics Cookies (Help us improve):

• Usage analytics: Track feature usage, page views
• Error tracking: Identify and debug issues

Third-Party Cookies:

• Stripe: Payment processing
• OAuth providers: Social authentication
• Analytics tools: Service improvement

8.2 Cookie Management

You can control cookies through:

• Browser settings: Most browsers allow you to refuse cookies
• Opt-out tools: Some third-party cookies can be disabled
• Our settings: Manage non-essential cookies in account preferences

Note: Disabling essential cookies will prevent you from using the Service.

8.3 Do Not Track

We honor Do Not Track (DNT) browser signals where technically feasible.

9. Your Data Protection Rights

Under GDPR and Portuguese data protection law, you have the following rights:

9.1 Right of Access (Article 15)

You can request:

• Confirmation of what personal data we process
• Access to your personal data
• Information about processing purposes, categories, recipients

How to exercise: Email privacy@bookmarkjar.com or use account export feature

9.2 Right to Rectification (Article 16)

You can request correction of inaccurate or incomplete data.

How to exercise: Update in account settings or email privacy@bookmarkjar.com

9.3 Right to Erasure / "Right to be Forgotten" (Article 17)

You can request deletion of your personal data when:

• Data no longer necessary for original purpose
• You withdraw consent (where consent was the legal basis)
• You object to processing (and no overriding legitimate grounds exist)
• Data processed unlawfully
• Required by legal obligation

How to exercise: Delete account in settings or email privacy@bookmarkjar.com

Exceptions: We may retain data if required by legal obligation or to establish/defend legal claims.

9.4 Right to Restriction of Processing (Article 18)

You can request we limit processing when:

• You contest the accuracy of data (during verification)
• Processing is unlawful but you prefer restriction to deletion
• We no longer need data but you need it for legal claims
• You object to processing (pending verification of legitimate grounds)

How to exercise: Email privacy@bookmarkjar.com

9.5 Right to Data Portability (Article 20)

You can request your data in a structured, commonly used, machine-readable format (JSON, CSV) and have it transmitted to another controller.

How to exercise: Use account export feature or email privacy@bookmarkjar.com

9.6 Right to Object (Article 21)

You can object to processing based on legitimate interests or for direct marketing purposes.

How to exercise: Email privacy@bookmarkjar.com or unsubscribe from marketing emails

9.7 Rights Related to Automated Decision-Making (Article 22)

We do not use automated decision-making or profiling that produces legal or similarly significant effects. AI features are assistive tools, not automated decisions.

9.8 Right to Withdraw Consent

Where processing is based on consent, you can withdraw consent at any time.

How to exercise: Disconnect integrations in settings, unsubscribe from emails, or email privacy@bookmarkjar.com

9.9 Right to Lodge a Complaint

You have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD):

Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1º
1200-651 Lisboa, Portugal
Phone: +351 213 928 400
Email: geral@cnpd.pt
Website: www.cnpd.pt

9.10 Response Time

We will respond to rights requests within 30 days (may be extended by 2 additional months for complex requests).

9.11 Verification

We may request additional information to verify your identity before fulfilling rights requests.

10. AI and Automated Processing

10.1 AI Features

We use third-party AI services (OpenAI, Google AI) to provide:

• Automatic tagging: Suggest tags based on bookmark content
• Summarization: Generate brief summaries of articles
• Semantic search: Understand meaning of search queries
• Chat assistant: Answer questions about your bookmarks

10.2 How AI Processes Your Data

• Your bookmark content is sent to AI providers via API
• Processing occurs in real-time, typically not stored by providers (business tier)
• AI-generated outputs (tags, summaries) are stored in our database
• You can delete AI-generated content at any time

10.3 AI Accuracy Disclaimer

AI-generated content may be:

• Inaccurate, incomplete, or misleading
• Biased based on training data
• Inappropriate or unexpected

You should verify important information independently. AI features are assistive tools, not authoritative sources.

10.4 Opt-Out

You can disable AI features in account settings. This will:

• Prevent new AI processing
• Retain previously generated AI content (unless you delete it)
• Not affect manual tagging or organization

11. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from anyone under 18.

If we become aware that we have collected data from someone under 18:

• We will delete the account and associated data
• We will take steps to prevent future access

If you believe we have collected data from someone under 18, please contact privacy@bookmarkjar.com immediately.

12. International Data Transfers

Bookmarkjar is based in Portugal (EU), but we use service providers in the United States and other countries.

When transferring data outside the EEA, we ensure:

• Adequacy decisions: Transfers to countries deemed adequate by EU Commission
• Standard Contractual Clauses: For transfers to countries without adequacy decisions
• Data Processing Agreements: GDPR-compliant terms with processors
• Additional safeguards: Technical measures (encryption, access controls)

You have the right to request information about safeguards in place for your data transfers.

13. Changes to This Privacy Policy

13.1 Notification of Changes

We may update this Privacy Policy from time to time. When we make changes:

For Material Changes:

• We will notify you via email at least 30 days in advance
• We will update the "Last updated" date
• We will provide a summary of changes

For Minor Changes:

• We will update the "Last updated" date
• Continued use constitutes acceptance

13.2 Review

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

14. Business Transfers

If Bookmarkjar is involved in a merger, acquisition, asset sale, or bankruptcy:

• Your personal data may be transferred to the successor entity
• You will be notified via email and prominent notice on our Service
• The new entity will be bound by this Privacy Policy (or you'll be notified of changes)
• You have the right to delete your account before the transfer

15. Data Protection Officer

For privacy-related questions or concerns, contact:

Email: privacy@bookmarkjar.com Legal Contact: legal@bookmarkjar.com Postal Address: Bookmarkjar
Rua do Comércio, 100
1200-080 Lisbon, Portugal

16. Additional Information for EEA/EU Users

16.1 Legal Framework

This Privacy Policy complies with:

• GDPR (EU Regulation 2016/679)
• Portuguese Law 58/2019 (GDPR implementation)
• ePrivacy Directive (2002/58/EC)

16.2 Data Controller

Bookmarkjar is the data controller for your personal data.

16.3 Data Protection Authority

The CNPD (Comissão Nacional de Proteção de Dados) is the supervisory authority for Portugal.

16.4 EU Representative

As we are established in the EU (Portugal), we do not require a separate EU representative.

17. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data:

Privacy Inquiries: privacy@bookmarkjar.com Legal Matters: legal@bookmarkjar.com Support: support@bookmarkjar.com Data Subject Rights: privacy@bookmarkjar.com Response Time: We aim to respond to all inquiries within 5 business days.