Privacy policy

Who is responsible

Two Cents is run by Mariën Digital SRL in Belgium (see the legal notice for the full details). Write to sylvain@twocentsbox.com for anything about your data.

Our role depends on the data. For account and billing data we decide why and how it is used, so we are the controller. For feedback messages sent through a widget, the site owner who installed it decides why they are collected, so they are the controller and we are their processor. The data processing agreement covers that second case.

If you send a message through a Two Cents widget

You are writing to the owner of the site you are on, not to us. What you send goes into their inbox, and they decide what to do with it. Send the site owner your requests to see, correct or delete a message. If you cannot tell who that is, write to us and we will pass it on or act on their behalf.

The widget sends, with your message:

• the text you typed, and your name and email address if you filled those in. Both fields are optional and the site owner can switch the email field off;
• the address of the page you were on and the page you came from;
• your browser and system name, the size of the window and screen, your language and your time zone;
• for a bug report, the last few lines the page wrote to the browser console, so the owner can see what broke;
• a screenshot, only if you choose to attach one;
• whatever the site owner’s own code passes along about you, such as your name or account id if you are signed in on their site.

The widget sets no cookie and writes nothing to your device. Your IP address is used only to slow down abuse, held in the server’s memory for a short window, and is never saved with a message.

If you have an account

We keep:

• your name, email address and language;
• your password, if you set one, stored only as a salted hash, never in a readable form. If you sign in with Google instead, we keep the identifier Google gives us for you and the tokens it hands back, and never your Google password;
• each sign-in session: a random token, when it expires, and the IP address and browser it was opened from, so you can be signed out and abuse can be traced;
• your sites, their settings, your questions, and the webhook addresses you give us for Slack or Discord;
• the messages your widgets received, with the details listed above, and the notes and replies you add to them;
• for paid plans, your Stripe customer number, the plan, its status and renewal date. Your card number never reaches our servers: Stripe collects it.

One cookie, and it is a necessary one: the session cookie that keeps you signed in. It is not readable by scripts and is not used to track you. There is no consent banner because there is nothing to consent to.

If you only visit this site

We measure visits with Plausible, which we host ourselves on our own server. It sets no cookie, keeps no personal profile and does not follow you from one site to another. We count page views, where people came from and a few events such as reaching the sign-up page, to learn which pages help. Nothing is sent to an analytics company.

Why we use it, and on what legal basis

• To provide the service you asked for (account, widget, inbox, exports, notifications): performance of a contract, GDPR Article 6(1)(b).
• To send account emails such as confirmation and password reset, and the notification emails you turned on: the same basis.
• To keep the service secure and stop abuse (rate limits, session records) and to count visits in aggregate: our legitimate interest, Article 6(1)(f). It is small, and nothing here builds a profile.
• To keep invoices and tax records: a legal obligation, Article 6(1)(c).

We do not sell data, we show no advertising, and we do not use your messages to train any model.

How long we keep it

• Messages, sites and questions: until the site owner deletes them, or deletes the account. The owner decides; there is no automatic expiry.
• Deleting an account removes the account, its sites, messages and screenshots straight away. Nightly backups are kept for 14 days, so the data has left them within two weeks.
• Invoices and payment records are kept by Stripe for ten years, as Belgian accounting law requires. An account with a paid plan running cannot be deleted until the plan ends, so that nobody is billed for an account that no longer exists.
• Sessions end when they expire or when you sign out, and are deleted with the account.

Who else handles it

Everything is stored on a server in France. A few companies process data for us to run the service: the hosting provider, the payment provider and the email relay. They are listed, with what each one does and where, on the sub-processors page. We tell account holders before adding one.

Stripe can transfer data outside the European Economic Area. It relies on the EU–US Data Privacy Framework and standard contractual clauses for that. If you connect Slack or Discord, the notification text goes to them under your own agreement with them.

Your rights

You can ask to see your data, correct it, delete it, restrict its use, object to it, or receive it in a portable form. Account holders can export everything as CSV or JSON, and delete the account, from the dashboard without asking us. For anything else, write to sylvain@twocentsbox.com; we answer within one month.

If you think we handled your data wrongly, you can complain to the Belgian Data Protection Authority (Autorité de protection des données – Gegevensbeschermingsautoriteit), rue de la Presse 35, 1000 Brussels, autoriteprotectiondonnees.be. We would rather hear from you first.

Children

Two Cents is a tool for businesses and is not aimed at children. We do not knowingly collect their data. If you think a child has an account, tell us and we will delete it.

Changes

When this policy changes in a way that matters, we email account holders before it takes effect. The date at the top is the date of the latest change.