← Back to AppIt Studio

Privacy Policy

Last updated: August 10, 2026

Effective date: August 18, 2026

Who controls your information

Appit Studio, Boris Rumenov 9, Sofia, Bulgaria, is the controller for information processed through appitstudio.com. Contact us at support@appitstudio.com.

Information we process

  • Contact information you submit to our newsletter or support.
  • Purchase and subscription records provided by Stripe.
  • Technical security data such as IP address, browser, and request details.
  • Optional analytics, attribution, and experience identifiers when permitted.

We do not receive your full payment-card number. Stripe processes payment details under its own privacy terms.

Why we use it

We process information to perform our contracts, provide support, operate and secure the website, comply with law, send requested newsletters, and—with permission where required—measure website performance, marketing attribution, and usability.

Services and event ownership

Stripe is the authoritative payment processor. DataFast connects to Stripe for revenue reporting; AppIt Studio does not emit a second browser or custom payment event. For server-created Teams Checkout Sessions, permitted DataFast visitor and session identifiers may be supplied to Stripe as metadata for reconciliation.

DataFast provides first-party, cookie-mode website analytics, including returning-visitor and journey measurement. Google Tag Manager may deliver Google Analytics or other approved measurement tags, Hotjar may provide heatmaps or session replay on approved public routes, and LnkFlow provides campaign attribution. Whether each optional service runs depends on the trusted regional context and your choices described below. Beehiiv processes newsletter subscriptions. UserWay provides the accessibility widget as necessary accessibility functionality; it is not used as an analytics, attribution, or advertising service.

A successful Beehiiv subscription can create one application-owned newsletter_subscribed goal and one LnkFlow lead. Those events use the provider subscriber identifier, not your email address.

Attribution and checkout

Before Attribution storage is allowed, LnkFlow does not persist journey identifiers. When it is allowed, including under the non-strict regional default, LnkFlow may retain first-party journey identifiers for up to 90 days.

The six AppIt Studio bundle Payment Links are shared with product websites and are not automatically decorated. A permitted opaque click reference can be passed only to the server-created Teams Checkout Session.

Your privacy choices

The website obtains country context from Cloudflare only when the signal arrives through a trusted Cloudflare proxy or carries the configured secret origin authentication. We do not infer location from your time zone, locale, browser language, or another client-supplied country value.

In the EEA, United Kingdom, Switzerland, and other regions configured for strict opt-in, DataFast, Google Tag Manager/Google Analytics, LnkFlow persistent storage, and Hotjar remain off until you grant the relevant permission. Rejecting or withdrawing Analytics stops DataFast and clears its applicable cookies.

In a known region outside that strict list, DataFast Analytics and LnkFlow Attribution storage are enabled by default for journey and campaign measurement. Google Tag Manager/Google Analytics and Hotjar remain off until you explicitly allow their Analytics or Experience purpose.

If the trusted country signal is missing, invalid, a Tor code, or cannot be trusted, only DataFast Analytics is enabled by default and the privacy banner remains visible. LnkFlow persistence, Google Tag Manager/Google Analytics, and Hotjar stay off until you allow them.

Global Privacy Control suppresses every optional service and regional default. Use “Privacy Choices” in the footer at any time to accept, reject, customize, or withdraw a purpose. Rejection or withdrawal stops covered loaders and persistence and clears applicable first-party cookies.

Retention, transfers, and security

We keep information only as long as needed for the purpose, contractual obligations, accounting, dispute resolution, and applicable law. Privacy choices expire after 182 days and consent records are retained for up to 730 days. DataFast's current cookie-mode script sets its visitor, first-seen, and visit-count cookies for up to 365 days and its session cookie for 30 minutes; provider-side analytics retention follows the approved DataFast account settings. LnkFlow attribution cookies are configured for up to 90 days. Providers may process information outside the EEA using their applicable contractual safeguards. We use encryption in transit, access controls, and data minimization, but no online system is risk-free.

Your rights

Depending on your location, you may request access, correction, deletion, restriction, portability, or objection; withdraw consent; and complain to a supervisory authority. Email support@appitstudio.com to make a request.