Ibbukkja Privacy Notice

1. Controller and contact

For public signup, account administration, service security and our own billing records, the controller is Nathley, a sole proprietor at 109 barumabara court, MGR Alfred mifsud, Birkirkara, Malta, VAT number 32953510. Contact [email protected] for privacy questions or rights requests.

For personal data a service business enters about its clients, workers and sites, that company normally decides why and how it is used and is the controller; Ibbukkja acts as its service provider/processor under its instructions.

2. Data we process

Signup and account data: name, work email, password hash, passkey public credentials, verification state, organisation, roles and policy versions accepted.
Operational tenant data: customer contacts, property addresses and access instructions, staff assignments, schedules, job notes and photos, invoices and client-portal records.
Service and security data: session identifiers, timestamps, audit records, rate-limit fingerprints derived from email, token or IP, and limited request/network metadata.
Subscription data: plan, Stripe customer/subscription identifiers, checkout and webhook state. Ibbukkja does not receive full card details.
Communications: transactional delivery status and support correspondence.
Marketing and advertising data: if you allow advertising cookies, a record of which Ibbukkja pages you visit and when, sent to Meta through the Meta Pixel, together with Meta’s own browser identifiers (the _fbp and _fbc cookies). If you then create an account with Ibbukkja in the same browser, our server also tells Meta that an account was created and sends with it: your email address in hashed form (SHA-256, so Meta receives a fixed-length code rather than the address itself), the IP address and browser details (user agent) of the request that created the account, Meta’s _fbp and _fbc identifiers if your browser holds them, the Meta click identifier of the advert you followed if we recorded one, and an event reference used so the same sign-up is not counted twice. When you start a trial, we record the advertising campaign that brought you to us (the utm_source, utm_medium, utm_campaign, utm_term and utm_content values in the link you followed) with your company’s account and, if you allowed advertising cookies, Meta’s click identifier (fbclid) from that link.

Ibbukkja does not ask customers to store health, biometric or other GDPR special-category data. Passkeys remain on your authenticator; Ibbukkja stores only the public credential needed to verify them. Customers should not place special-category information, payment-card data or identity documents in the service.

3. Purposes and legal bases

To take signup steps, create accounts and provide the service: steps toward and performance of our B2B contract.
To authenticate users, isolate tenants, prevent abuse, keep audit records and protect systems: our legitimate interests in secure and reliable operation.
To maintain billing, tax and business records and respond to lawful requests: legal obligations.
To send verification, invitation, password-reset and invoice messages: contract performance and legitimate service administration.

We do not use signup acceptance as consent to marketing and do not add promotional mailing in this pilot.

Advertising measurement. We run adverts on Facebook and Instagram. With your consent (GDPR Art. 6(1)(a) and the ePrivacy rules on cookies), we use the Meta Pixel on our public website and Meta’s Conversions API from our server to measure which adverts lead to visits, sign-ups and free trials, and to let Meta show our adverts to people more likely to find Ibbukkja useful. We also keep the campaign details of the link that brought you here. The Meta Pixel never loads before you choose, never loads if you refuse, and never runs inside the Ibbukkja app, the client portal or any page showing your business data. Our server sends Meta a sign-up event only if the browser you used to create the account had accepted advertising cookies. You can withdraw consent at any time from “Cookie settings” at the bottom of every public page. Withdrawing stops any further pixel or server events from that browser; it does not affect measurement that happened before.

Campaign details without cookies. If you do not consent, we still record the campaign values (utm_*) of the link you followed when you start a trial, but only if they are still in the page address when you submit the signup form. Nothing is stored on your device to do this, and we never record Meta’s click identifier without your consent. Our legal basis is our legitimate interest in knowing which marketing channels bring us customers (Art. 6(1)(f)). These are campaign labels, not personal identifiers, and are kept only with the account that was created.

4. Recipients and providers

Access is limited to authorised users and providers needed to operate Ibbukkja. These currently include Resend for transactional email, Stripe for subscription billing, Cloudflare Turnstile for bot and abuse checks, and hosting, PostgreSQL, encrypted off-site backup and private object-storage infrastructure. Ibbukkja uses Google Maps Platform for mapping, address checking and route assistance. Using those features sends the property and stop addresses involved, and related planning details such as appointment windows and service durations, to Google. Customer names, staff home-address records, job notes and photos are not sent. A tenant may also direct information to invited staff or clients.

If you allow advertising cookies, Meta Platforms Ireland Limited receives the information described in section 2, through the Meta Pixel in your browser and, when you create an account, through the Conversions API from our server. For that collection and transmission, Ibbukkja and Meta are joint controllers; Meta’s own use of the data, including matching the hashed email address to Meta accounts, is governed by Meta’s privacy policy. Meta may transfer data outside the EEA; see Meta’s policy for the safeguards it relies on.

Some providers may process information outside Malta or the EEA. Where GDPR requires it, transfers must use an adequacy decision or appropriate safeguards such as standard contractual clauses. Contact us for current provider and safeguard details.

5. Retention

Unverified signup records expire after 24 hours and expired or consumed records are removed after a seven-day cleanup period.
Delivered or exhausted encrypted transactional outbox entries are eligible for cleanup after 30 days.
Active account and tenant data is retained while the service is provided. A locked subscription records a 90-day retention deadline, but deletion is not automatic and may be delayed for export, disputes, security, backups or legal obligations.
Rate-limit windows are short-lived and cleaned after they are no longer needed; raw signup IP addresses are not stored as policy-acceptance evidence.
Your cookie choice is remembered for 6 months in a first-party cookie (sz_consent), after which we ask again.
If you consent, the campaign details of the link you followed are kept on your device for 30 days in a first-party cookie (sz_attribution), deleted as soon as you withdraw consent.
Campaign details recorded with an account are kept while the account exists and are deleted with it.
Meta’s cookies (_fbp, _fbc) are set only with consent and are deleted from our domain when you withdraw it. Meta keeps the data it received under its own retention policy.
Ibbukkja does not keep a separate copy of what it sends to Meta through the Conversions API. The sign-up event reference is held only in your browser tab until the trial-started page has sent it, and is then deleted.

6. Security

Ibbukkja uses password hashing, HTTP-only sessions, email verification, encryption for sensitive email outbox payloads, private file storage, short-lived file links, role checks, database row-level security, signed billing webhooks and server-enforced tenant and subscription boundaries. No method is completely risk-free; please report concerns promptly.

7. Your rights

Subject to GDPR conditions and exceptions, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier processing. We may need to verify your identity and distinguish information controlled by Ibbukkja from tenant data controlled by your service provider.

You may complain to Malta’s Information and Data Protection Commissioner (IDPC) or another competent supervisory authority.

8. Cookies and similar technologies

Ibbukkja’s public website uses the following cookies and browser storage:

__Host-sz_session: keeps you signed in. Set when you sign in; lasts 30 days or until you sign out.
__Host-sz_portal_business: the booking page of the business whose portal you last signed in to by email link, so a later visit to the portal can send you back there to sign in. Set when you use a sign-in link; lasts 6 months.
sz_consent: remembers your cookie choice. Set when you choose; lasts 6 months.
sz_attribution: the campaign that brought you here. Set only with consent; lasts 30 days.
_fbp, _fbc: Meta advertising measurement. Set by Meta only with consent; up to 90 days.
sz_start_trial_sent:<id> (local storage): stops one trial being counted twice. Set only with consent, when you start a trial.
sz_complete_registration_event (session storage): holds the sign-up event reference between email verification and the trial-started page, so Meta counts one sign-up rather than two. Set only with consent; deleted once used, when you withdraw consent, or when the tab is closed.

The session cookie, the booking page cookie and your consent choice are strictly necessary and do not need consent. Everything else is used only after you choose “Accept”, and you can change your choice at any time from “Cookie settings” at the bottom of every public page.

9. Automated decisions, children and changes

Ibbukkja does not make decisions producing legal or similarly significant effects solely by automated processing. Turnstile automatically assesses abuse signals to decide whether a signup challenge succeeds, but a failed challenge only prevents that request.

The service is B2B and not directed to children. We will version material changes to this notice and request renewed acknowledgement where appropriate.