Privacy Policy

1. Controller

The controller of burnit.dev is BurnIT, Tbilisi, Georgia (“we”). Contact for personal-data matters: hello@burnit.dev; we will send the controller's full legal details on request to this address.

Email: hello@burnit.dev.

2. Hosting and server logs

The website and its server functions are hosted by Cloudflare, Inc., USA. On every request the host processes server log data: IP address, date and time, the requested URL and your browser's user agent.

This is necessary to deliver the website and keep it running and secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website). Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, so an adequacy decision covers transfers to it.

3. Cookies, analytics and browser storage

This website does not use cookies, analytics tools or advertising pixels. Fonts are served from the website itself; no requests are made to Google Fonts.

Two technical flags are written to your browser's tab storage (sessionStorage): that the intro animation has already been shown, and that the fire should be drawn in a simplified mode on this device. They contain no personal data, are never sent to the server and are deleted when you close the tab. They are strictly necessary for the website to work as you requested it.

4. Contact form

When you submit the contact form, the following is processed: the services you selected, your contact for the reply (Telegram username, email address or phone number — whatever you enter), your message (optional) and the page language. If you clicked “Get the exact plan” in the Forge, your business description and an excerpt of the draft are pre-filled into the message; you can edit or delete them before sending. For spam protection, a hidden technical field and the time taken to fill in the form are also sent; they do not identify you.

Purpose: to answer your inquiry and, where applicable, to prepare and perform a contract. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request). Providing the data is voluntary, but without a contact we cannot reply.

The inquiry is delivered via a server function to the controller's private Telegram chat. Recipient: Telegram (Telegram Messenger Inc. / Telegram FZ-LLC, United Arab Emirates). There is no EU adequacy decision for the UAE and no standard contractual clauses with Telegram; the transfer is based on Art. 49(1)(b) GDPR, as it is necessary to answer the inquiry you sent. Please be aware that the level of data protection there may be lower than in the EU. If you prefer, write to us by email instead.

To block repeated submissions, your IP address is kept in the server's memory for 20–30 seconds and not stored anywhere else. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the form from abuse).

5. The Forge (AI-generated plan draft)

If you use the Forge, the business description you enter is sent to Anthropic PBC (USA) so that the Claude model can generate a draft plan; this is stated right above the input field. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request). The transfer to the USA is based on the standard contractual clauses included in Anthropic's data processing terms (Art. 46(2)(c) GDPR). Please do not enter personal data such as names, phone numbers or email addresses.

Neither the description nor the answer is stored on this website. Under its API terms, Anthropic does not use them to train its models and deletes them after its retention period. The draft is AI-generated, labelled as such, and is neither a decision about you nor an offer — no automated decision-making within the meaning of Art. 22 GDPR takes place.

6. Direct contact by email or Telegram

If you contact us directly via the email or Telegram links, the data you provide (such as your address or username and the content of your message) is processed to handle your request. Legal basis: Art. 6(1)(b) GDPR.

7. Storage period

Inquiries that do not lead to a contract are deleted no later than 6 months after the last message. If a contract is concluded, the data is kept for its duration and afterwards as long as statutory retention obligations require.

IP addresses for spam protection: 20–30 seconds in server memory. Server logs: kept by the host within its own retention period.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability.

Right to object: you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (server logs, spam protection).

To exercise your rights, contact hello@burnit.dev. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence.

9. Changes to this policy

This policy is updated when the website or legal requirements change. The current version is always available on this page.