Privacy Policy

Last updated: October 26, 2026

This policy explains which personal data Bassfolio (bassfolio.com and the Bassfolio mobile app) processes, why, for how long, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

Bassfolio is a personal, non-commercial project run by the Bassfolio Team. The controller of your personal data is Dimitar Todorov, as a private individual. For any question about your data, write to contact@bassfolio.com.

2. Data we process

Account: email address, username and password (stored only as a secure hash); with Google sign-in also the name and profile photo from Google. Profile: photo, bio, city, country, social links and, for PRO installers, phone, website and address. Content: projects, vehicle and audio system data, photos, records and verification proofs, votes, ratings and comments, team memberships, event registrations and proposals, quiz answers and scores, feedback and contact form messages. Technical: IP address, browser and device type and the time of logins and other actions (security log), error logs.

3. Why we process it

To provide the platform and your account (performance of the contract, Art. 6(1)(b) GDPR). To protect the platform against abuse, fraud and attacks, through security logs and rate limits (legitimate interest, Art. 6(1)(f)). To send emails about your account, such as password resets, account deletion and team changes (performance of the contract). For statistics and advertising measurement with Google Analytics and Meta Pixel, only with your consent (Art. 6(1)(a)).

4. Who receives the data

We do not sell personal data. We use these service providers, who process data only on our behalf: MyHost (server hosting, data center in Sofia, Bulgaria), Backblaze (off-site backups, EU region), Resend (sending emails), Google (Google sign-in and, with consent, Google Analytics) and Meta (Meta Pixel, with consent). Some of them may process data outside the EU; in that case appropriate safeguards apply, such as the EU standard contractual clauses or the EU-US Data Privacy Framework. Public profile data and projects are visible to all visitors.

5. Cookies and local storage

Necessary: your login session and language are stored in the local storage of your browser, and your cookie choice in a cookie. Optional: Google Analytics and Meta Pixel are loaded only after you accept cookies in the cookie banner. You can withdraw your consent at any time by deleting the cookies of bassfolio.com in your browser; the banner will then appear again.

6. How long we keep data

Account data and content are kept as long as your account exists. Login sessions end after 30 days without use and at the latest 90 days after the login. The security log (IP address, device, time of security-relevant events such as password changes, logouts from all devices and suspicious use of a session) is kept for 90 days. When you delete your account, everything is deleted permanently after 14 days (during which you can restore the account); backup copies are overwritten within a further 14 days. We keep only an anonymous record that an account was deleted, without name or email address.

7. Your rights

You have the right to access your data, to correct it (in your profile settings), to have it deleted (Profile, Edit, Delete account, also in the app), to restrict or object to its processing, to data portability and to withdraw consent. To exercise a right, write to contact@bassfolio.com. You can also lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg) or the supervisory authority in your country.

8. Security

All connections use HTTPS, passwords are stored only as hashes, the database is not reachable from the internet and access to the servers is limited to the administrator. Login sessions are protected with rotating tokens: if a stolen token is used, the session is closed automatically and the administrators are notified. In your profile settings you can log out from all other devices at any time.

9. Changes

We may update this policy when the platform changes. The date of the last update is shown at the top of this page.