Privacy Policy

1. Controller

The controller of burnit.dev is BurnIT, Tbilisi, Georgia (“we”). Contact for personal-data matters: hello@burnit.dev; we will send the controller's full legal details on request to this address.

Email: hello@burnit.dev.

2. Hosting and server logs

The website and its server functions are hosted by Cloudflare, Inc., USA. On every request the host processes server log data: IP address, date and time, the requested URL and your browser's user agent.

This is necessary to deliver the website and keep it running and secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website). Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, so an adequacy decision covers transfers to it.

3. Cookies, analytics and browser storage

This website does not use cookies, analytics tools or advertising pixels. Fonts are served from the website itself; no requests are made to Google Fonts.

Two technical flags are written to your browser's tab storage (sessionStorage): that the intro animation has already been shown, and that the fire should be drawn in a simplified mode on this device. They contain no personal data, are never sent to the server and are deleted when you close the tab. They are strictly necessary for the website to work as you requested it. The currency you choose stays in your browser (localStorage) until you clear site data; it is not personal data and is not sent to the server.

4. Contact form

When you submit the contact form, the following is processed: the services you selected, your contact for the reply (Telegram username, email address or phone number — whatever you enter), your message (optional), the page language and where you came from (the name of the referring site or an ad label, not the full address). If you clicked “Get the exact plan” in the Forge, your business description and an excerpt of the draft are pre-filled into the message; you can edit or delete them before sending. For spam protection, a hidden technical field and the time taken to fill in the form are also sent; they do not identify you.

Purpose: to answer your inquiry and, where applicable, to prepare and perform a contract. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request). Providing the data is voluntary, but without a contact we cannot reply.

The inquiry is delivered via a server function to the controller's private Telegram chat. If Telegram is temporarily unavailable, it waits in Cloudflare storage for up to 30 days and is deleted as soon as it is delivered. Recipient: Telegram (Telegram Messenger Inc. / Telegram FZ-LLC, United Arab Emirates). There is no EU adequacy decision for the UAE and no standard contractual clauses with Telegram; the transfer is based on Art. 49(1)(b) GDPR, as it is necessary to answer the inquiry you sent. Please be aware that the level of data protection there may be lower than in the EU. If you prefer, write to us by email instead.

To block repeated submissions, your IP address is kept in the server's memory for 20–30 seconds and in Cloudflare's rate limiter for up to a minute. To limit the number of inquiries per IP address per day, only a hash of the address (for IPv6, of its first half) made with a secret key is stored; the address cannot be recovered from it without that key. The address itself is never stored, and the hash is deleted after one day. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the form from abuse).

5. The Forge (AI-generated plan draft)

If you use the Forge, the business description you enter is sent via OpenRouter, Inc. (USA) to the Claude model of Anthropic PBC (USA) so that it can generate a draft plan; this is stated right above the input field. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request). The transfer to the USA is based on the standard contractual clauses in these providers' data processing terms (Art. 46(2)(c) GDPR). Please do not enter personal data such as names, phone numbers or email addresses.

Neither the description nor the answer is stored on this website. The request is sent on the condition that it is not used to train models; OpenRouter and Anthropic process it under their API terms. The draft is AI-generated, labelled as such, and is neither a decision about you nor an offer — no automated decision-making within the meaning of Art. 22 GDPR takes place.

6. Direct contact by email or Telegram

If you contact us directly by email, the data you provide (such as your address and the content of your message) is processed to handle your request. Legal basis: Art. 6(1)(b) GDPR.

7. Storage period

Inquiries that do not lead to a contract are deleted no later than 6 months after the last message. If a contract is concluded, the data is kept for its duration and afterwards as long as statutory retention obligations require.

IP addresses for spam protection: 20–30 seconds in server memory and up to a minute in Cloudflare's rate limiter; the hash of the address for the daily limit: one day. Server logs: kept by the host within its own retention period.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability.

Right to object: you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (server logs, spam protection).

To exercise your rights, contact hello@burnit.dev. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence.

9. Changes to this policy

This policy is updated when the website or legal requirements change. The current version is always available on this page.