Privacy Policy

1. Controller and scope

The operator identified above is the controller for personal data used to operate Sharcio. This Policy covers visitors, creators, company representatives, customers, applicants and partners. Information comes from you, your use of Sharcio, authentication and payment services, and sometimes other users, for example through reports. External websites and services have their own privacy notices.

2. Account and authentication data

We process registration details such as name, email, authentication identifier, account type, onboarding state and account status. Supabase Auth manages email/password authentication, verification, recovery and sessions. Credentials and session tokens are not public profile fields. Information necessary to authenticate and secure an account is required to provide that account; optional profile information is not required just to browse public pages.

3. Sign in with Google

If you choose Google sign-in, Google and Supabase provide basic identity information: a Google account identifier, email address and verification state, and name and profile picture where supplied. The sign-in flow uses basic OpenID Connect identity access (openid, email and profile). We use it to create or recognize your account, support account-name and avatar information, and secure sign-in.

Sharcio does not request access to your Gmail messages, Google Drive files, contacts or calendar through this flow. Google handles your Google credentials. Adding a social-platform link is not authorization to read private platform data. You may manage Sharcio's connection in your Google account; disconnecting it does not itself erase Sharcio records or cancel subscriptions.

Manage your Google account connections

4. Profiles and public content

Profile and collaboration information may include names, biographies, country, categories, languages, rates, budgets, statistics, preferences, links and public contact information where supported. Company information can identify a sole trader or representative. Publication settings control normal public presentation. Public content is available to visitors and may be indexed, shared or copied outside Sharcio.

Your login email is distinct from contact information you choose to publish. Do not publish confidential information or personal data you lack authority to share. Hiding content later cannot guarantee recall of external caches or copies.

5. Images and media

Images, portfolios, galleries and supported uploads use Supabase Storage. We process files and associated descriptions and ordering to display content. Some media uses public buckets. Making a profile private, hiding content or closing an account does not necessarily invalidate previously known public media URLs or delete objects. Contact us about removal or erasure where needed.

6. Memberships and paid visibility

We keep plan, entitlement, purchase-target, activation, expiry and cancellation records for memberships, Top Boost, Highlight and Spotlight. Membership and promotional presentation may appear publicly with a profile or collaboration. Private authentication and financial records are not made public merely by a successful purchase.

7. Payments

Stripe processes platform payments. Sharcio retains references and necessary information about customers, subscriptions, purchases, amounts, currency, payment status, refunds and disputes. Full card numbers and card security codes entered on Stripe-hosted pages are handled by Stripe, not received by Sharcio's application forms. Financial evidence may remain necessary after closure for accounting, legal obligations and claims.

8. Payout onboarding

Eligible partners use Stripe Connect for payout setup. Stripe collects the identity, business and bank details requested on its hosted forms. Sharcio processes associated identifiers, onboarding/readiness status and necessary payout and transfer evidence. Completing onboarding does not itself establish payout eligibility or execute a payment.

9. Partner participation

Referral and Ambassador records may include application information, age confirmation, agreements, program status, referral codes and statistics. Partners may see information necessary to understand attributable customers and qualifying activity, including customer identity and payment or commission status, not passwords or complete card credentials. Separate eligibility and agreement rules apply.

10. Referral attribution

A valid referral visit may create a click record and a time-limited intent. Registration finalization may bind attribution to the new account for qualifying-payment reconciliation. Initial referral intents last 30 days; qualifying-payment rules use the customer's first 12 months after registration. Cookie expiry does not delete durable attribution or financial history.

11. Agreement and notice evidence

Applicable legal and partner workflows can retain version identifiers, presented content or its verification hash, timestamps and account-bound receipts to evidence what was communicated or agreed. Google authentication is not a substitute for such evidence. Privacy notice acknowledgement is not blanket consent to optional processing.

12. Commission and payout history

Qualifying payments, commissions, reversals, holds, payout reviews and transfers have separate evidence and reconciliation records. They support accuracy, fraud prevention, accounting and disputes. Account closure or departure from a program does not automatically erase or rewrite financial, attribution or agreement history.

13. Communications and moderation

We process support and privacy correspondence, content reports and related reviews. Reports may include another person's information. Transactional emails such as verification, recovery and service or billing notices use configured authentication/email infrastructure; providers process recipients and delivery information. These service messages are distinct from optional marketing. Internal moderation and privacy-review information is restricted, not ordinary public content.

14. Security

Authentication, access controls, restricted administrative tools and other technical and organizational measures protect information. No internet service can guarantee absolute security. Keep credentials private and tell support about suspected unauthorized access. Do not send passwords, verification tokens or full payment credentials in ordinary messages.

15. Technical and log data

Hosting, authentication, payment and security providers may process IP addresses, browser or user-agent information, timestamps, operational logs and errors for delivery, troubleshooting, abuse prevention and investigations. Administrative and financial operations may have audit trails. A field's absence from a public profile does not mean infrastructure providers never process it.

16. Purposes and legal bases

Under the GDPR, operating your account, requested profile/listing publication and purchased services relies on contractual necessity or requested pre-contractual steps (Article 6(1)(b)). For a company representative who is not personally party to the contract, legitimate interests in administering the company's service may apply instead (Article 6(1)(f)).

Legally required accounting and records rely on legal obligations (Article 6(1)(c)). Proportionate security, abuse prevention, complaint handling, reliability and protection of claims rely on legitimate interests (Article 6(1)(f)), balanced against your rights. Ask us about a particular interest. Where optional processing requires consent, it relies on consent (Article 6(1)(a)), withdrawable without affecting earlier lawful processing. This Policy does not itself obtain consent for referral tracking or optional marketing.

17. Recipients and providers

Recipients as needed include Supabase for authentication, database and storage; Vercel for hosting; Google for chosen Google sign-in; Stripe for payments and Connect; and configured transactional-email and support-mail providers. Providers may be processors or independent controllers for their own services. Staff and advisers receive access limited to their authorized work.

Public content is disclosed to visitors, search engines and services used to open links. Partner disclosures are described above. Other disclosures may be required by law, protection of rights or a lawful business transfer, with applicable safeguards and notice. We do not sell Google sign-in data or use it for personalized advertising. Contact us for current provider and recipient details relevant to your data.

Supabase privacy notice

Vercel privacy notice

Google privacy notice

Stripe privacy notice

18. International processing

Providers may process data outside your country, including outside the EEA. GDPR-restricted transfers require an applicable adequacy decision, appropriate safeguards such as standard contractual clauses and necessary supplementary measures, or a permitted statutory exception. Using Sharcio is not blanket consent to transfers. Ask the privacy contact about destinations and safeguards applicable to your data and how to obtain a copy where available.

19. Cookies and similar technologies

Supabase Auth uses cookies and related storage to maintain secure sessions. Referral links additionally use sharcio_referral_visitor, an opaque intent identifier lasting up to 30 days, and sharcio_referral_oauth, a separate OAuth registration bridge lasting up to one hour and normally removed at callback. These are pseudonymous identifiers, not anonymous data.

Referral attribution is distinct from the session needed to sign in. This notice does not classify referral cookies as strictly necessary or obtain consent required by local law. Browser controls can block or delete cookies; blocking session storage may prevent sign-in, while blocking referral storage may prevent attribution. Deleting cookies does not erase account-bound history. Google and Stripe may use their own technologies on their services under their notices.

20. Retention

Information is retained for its purpose and applicable legal obligations. Account and profile data supports account operation and chosen publication; financial and tax evidence follows applicable recordkeeping obligations; agreement and dispute evidence follows relevant limitation periods. Security logs are retained according to investigation and reliability needs, not indefinitely merely because storage is available.

Referral-cookie periods are not deletion deadlines for durable attribution or commissions. Confidential privacy exports have separate expiry and cleanup controls. Information no longer needed should be deleted or anonymized, subject to lawful holds and backup/recovery constraints. Ask us for the retention criteria and applicable period for a particular record. There is no single deletion deadline for all categories.

21. Closure and erasure

Close account stops normal access and public availability and initiates billing cleanup, not automatic erasure. Authentication identities, media, financial, referral, agreement and moderation evidence may remain. Public media URLs and external copies may remain accessible. Erasure is reviewed separately, with lawful retention for obligations or claims. Restoration of access, where available, does not erase historical evidence or imply republication.

22. Your privacy rights

Subject to applicable law and its conditions, you may request access, correction, erasure, restriction, portability and objection, including objection to legitimate-interest processing. Consent can be withdrawn where relied on. Search ranking uses profile, membership and promotion inputs to order public results. Where the law provides rights concerning solely automated decisions with legal or similarly significant effects, you may ask us about the decision and request the available human review.

Use Privacy & my data when signed in, or the privacy email below if closed out or unable to sign in. Proportionate identity verification may be needed; exports are not automatically sent to an unverified supplied address. GDPR requests are normally answered within one month, with explanation of any lawful extension or refusal. You can complain to the Czech Office for Personal Data Protection or another competent authority, including where you habitually reside, work or an alleged infringement occurred.

Czech Office for Personal Data Protection

23. Capacity and minors

Use is subject to the legal capacity and authorization requirements in the Terms; partner programs separately require age 18 or above. Do not supply information about children or others without necessary authority. Contact us if an account or content involves a minor without required authorization so we can assess appropriate restriction or removal.

24. Changes to this Policy

This Policy may change with the platform, providers or law. Version and effective date identify the notice. Material changes will be communicated through appropriate in-service notices or account email where required. New consent will be requested separately where necessary. Updating a notice does not retroactively authorize incompatible use of previously collected data.

25. Privacy contact

Use the privacy email below or the operator's address above for privacy enquiries, recipient, retention and transfer information, or rights requests. Provide enough information to locate the issue, not passwords, full payment credentials or unnecessary identity documents. Additional identity evidence should use an appropriately verified process.