Privacy Policy

This Privacy Policy describes how personal data is collected, used, stored, disclosed and deleted when you visit the Exbustl website (exbustl.com), use the web application (app.exbustl.com) or contact support.

Exbustl is a web-based workspace for planning, tasks, projects, goals, ideas, notes, links, time tracking and personal statistics. The Service Administration processes personal data under applicable Ukrainian law and the EU General Data Protection Regulation (GDPR) where it applies.

Personal data means information relating to an identified or identifiable individual. User Content is information that users create or save in their own workspace. Processing includes collection, recording, storage, modification, use, disclosure and deletion.

Reading this Policy does not constitute blanket consent to any processing. Each purpose relies on an appropriate legal basis; separate consent is sought only where required.

The personal data owner under Ukrainian law and the controller under the GDPR, where applicable, is sole proprietor Huziev V. (registered Ukrainian name: Гузєв Віктор Олексійович), operating the service under the name Exbustl.

For questions about processing or to exercise data protection rights, contact [email protected]. Official website: https://exbustl.com.

The Administration determines the purposes and means of processing. Infrastructure providers handle data according to their contractual roles; some may act as independent controllers for their own technical or account-related operations.

Provider details and payment terms are available in the Public Offer

Account information

• Email address, internal user identifier, email verification status, account creation and status information.
• Information used for password verification and account recovery; sessions, sign-in methods and authentication events.
• Security settings, including TOTP multi-factor authentication; language, theme and other interface preferences.

Passwords are processed through Supabase Auth. Exbustl does not store users’ passwords in plain text.

Workspace content

• Tasks, projects, schedules, to-do lists, goals, ideas, notebooks, pages and notes.
• Saved links, resource descriptions, tool tabs, timers, focus sessions and time-tracking information.
• History, statistics, achievements, preferences and record relationships needed for available features.

Users decide what to enter in their workspace. Exbustl does not require health, belief-related or other special-category personal data; users may nonetheless include such information voluntarily in their records.

Technical data and support

• IP addresses, browser and device information, request timestamps, session identifiers, security events, errors and sync status, to the extent processed by the service and its providers.
• For support requests, the sender’s email, correspondence and information voluntarily supplied to resolve the issue.

Do not send passwords, active one-time authentication codes, TOTP secrets or unrelated payment credentials to support.

1. Account registration, email verification, sign-in, recovery and session management.
2. Providing workspace features, offline operation and synchronization between devices.
3. Enforcing plan limits and access rights, and providing subscription or promotional benefits.
4. Protecting accounts, preventing abuse, troubleshooting and maintaining service availability.
5. Responding to support requests and sending essential account and security messages.
6. Meeting applicable legal obligations, including accounting and payment records.
7. Measuring basic public-site traffic through Cloudflare Web Analytics.

We do not sell private workspace content to advertisers, use it for behavioral advertising or send user records to third-party AI developers for model training.

Where the GDPR applies, Exbustl uses the relevant legal bases under Article 6:

• Performance of a contract or steps taken at the user’s request — registration, sign-in, storage, synchronization and plan delivery (Article 6(1)(b)).
• Legitimate interests — service security, reliable operation, responding to requests and limited website statistics, subject to an appropriate balancing assessment (Article 6(1)(f)).
• Legal obligation — where applicable law requires retaining or providing particular records (Article 6(1)(c)).
• Consent — for optional processing that may be introduced and legally requires it (Article 6(1)(a)).

Where consent is used, it may be withdrawn without affecting earlier lawful processing. Using the service does not constitute consent to all possible future purposes.

Exbustl combines server-side storage with browser-based storage, including IndexedDB. This lets users continue working with previously loaded data while offline and synchronize changes once a connection is restored.

Synchronization involves records and technical data about changes, versions and operation status. Core server-side workspace data is stored with Supabase/PostgreSQL.

Local records may remain until cleared by the user, browser or application. Clearing browser storage, losing a device or switching devices may result in the loss of changes that have not synchronized.

Browser storage is not a guaranteed independent backup. When signing out, switching accounts or deleting an account, the application applies its implemented data isolation and cleanup measures.

Supabase

Supabase provides authentication, a PostgreSQL database, server functions and synchronization. The Exbustl primary database is hosted in Frankfurt, Germany. Certain logs, metadata and supporting provider operations may be handled outside the selected region.

Supabase Privacy Policy

Cloudflare

Cloudflare provides website and application delivery, network security and supporting infrastructure. It may process IP addresses and request information. Cloudflare Web Analytics is used for public-site statistics without analytics cookies or individual fingerprinting.

Cloudflare Privacy Policy

Resend

Resend delivers essential emails, including address verification, access recovery and security notices. Recipient addresses, message content and delivery metadata are processed for this purpose. Resend stores email service data in the United States even when an EU sending region is selected.

Resend Privacy Policy

Zoho Mail

Zoho Mail (European region) receives messages sent to [email protected] and delivers support replies. It processes sender addresses, message contents, attachments if supplied, and technical delivery metadata. The support mailbox is not used for advertising mailings.

Zoho Privacy Policy

Payment provider

Personal Pro subscription payments are processed through monobank. The Administration handles the transaction information required to confirm payment, grant paid access and meet applicable obligations; full card numbers and CVV codes are not collected through Exbustl.

Subscription, payment and refund terms — Public Offer

Information may also be disclosed to authorized personnel within their responsibilities or to competent authorities where legally required. Private workspaces are not made freely accessible to third parties.

International infrastructure may involve processing certain data outside Ukraine and the European Economic Area. The primary database location does not mean that every supporting service operates exclusively in that region.

Transfers are handled under applicable law and providers’ contractual safeguards, including EU Standard Contractual Clauses (SCCs) where required. Resend states that its US transfers are covered by SCCs and the applicable EU–US Data Privacy Framework mechanisms.

To request information about current transfer safeguards, email [email protected].

The Exbustl public website does not use advertising or analytics cookies to track visitors. According to Cloudflare, Cloudflare Web Analytics does not rely on cookies, localStorage or browser fingerprinting for traffic measurements.

Cloudflare may nevertheless use strictly necessary technical cookies for network security and bot protection. The web application uses browser storage for session state, interface preferences and local workspace data.

Essential browser storage is not used to sell information to advertising networks. If optional technologies that require consent are added in the future, the necessary consent controls will be introduced.

Cookie and Similar Technologies Policy

Personal data is retained for as long as needed for its stated purpose or an applicable legal obligation. Default provider retention settings are currently in use; different categories of data have different retention periods.

• Account and workspace data — while the account or saved records remain active, subject to legally required exceptions.
• Local browser data — until cleared by the browser, application or user.
• Technical and security logs — according to the providers’ default policies and legitimate diagnostic or security needs.
• Resend messages and delivery logs — under Resend’s published policy, ordinarily 30 days for Free, Pro and Scale plans; plan or policy changes can affect this period.
• Support correspondence — while the request is handled and for a justified period needed to resolve related issues.
• Payment and statutory accounting records — for the period required by applicable law.

Deleted data may remain in backups or technical logs until their applicable retention cycles expire. Once retention is no longer justified, data is deleted or de-identified as appropriate.

Exbustl uses HTTPS/TLS, Supabase Auth, optional TOTP multi-factor authentication, access controls, database Row Level Security, server-side authorization checks and Cloudflare network security measures.

The regular administration interface is not designed for browsing individual users’ private records. Necessary technical access is limited to authorized responsibilities and maintenance purposes.

No information system can guarantee absolute security. If an incident occurs, the Administration assesses its impact and takes legally required steps, including notifications where applicable.

Users should safeguard passwords, multi-factor authentication methods and device access.

Under applicable law, you may have rights to information, access and a copy of your data; correction, erasure or restriction; objection to processing based on legitimate interests; and data portability where applicable.

You may also withdraw consent for processing that relies on consent, complain to a competent supervisory authority and exercise other legal rights.

Send requests to [email protected]. To protect accounts, the Administration may reasonably verify the requester’s identity. Response periods follow applicable law; under the GDPR, a response is generally due within one month, subject to lawful extensions.

Depending on jurisdiction, complaints may be submitted to the Ukrainian Parliament Commissioner for Human Rights or a competent EU data protection authority.

Exbustl provides an account deletion procedure in application settings. This requires appropriate identity confirmation and, if enabled, additional two-factor verification.

After successful deletion, the account and private workspace data are removed from active systems, except for records whose retention is necessary under law or justified legal obligations.

The app performs its implemented local cleanup on the device used to delete the account. Other devices and files previously exported by the user may retain copies that need separate deletion. Recovery of deleted records is not guaranteed.

Technical logs and backups may hold limited data until their retention periods end. Users should export any needed information before deleting their account.

Exbustl automatically checks sessions, plan limits and feature access, synchronizes records and performs security tasks as part of providing the service.

We do not use private workspace information for advertising profiling or make decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of GDPR Article 22.

Material changes to these processing practices will be disclosed and relevant rights respected.

The Exbustl website links to official project accounts on X and Telegram and to independent resources published by its creator. Users may also store links to third-party websites in their workspace.

When following an external link, that provider’s own privacy terms apply. This Policy does not govern independent data processing by third-party websites.

Exbustl is not specifically directed at children and is not designed to collect children’s personal data intentionally.

Where applicable law requires parental or guardian authorization for particular processing involving a minor, those requirements must be met. Concerns about improper processing may be reported to [email protected].

The Administration may update this Policy when Exbustl functionality, service providers, data handling or legal requirements change.

The current version will be made available on the website with its effective date. Material changes will be communicated separately where required by law. A revised Policy does not retroactively legitimize previously unlawful processing.

For privacy, personal data, access and deletion requests, contact the Exbustl Administration: [email protected].

Official Exbustl website

Exbustl web application

Public Offer and provider details