Privacy Policy

1. Data Controller

The data controller responsible for your personal data collected through this website is:

If you have any questions about how we handle your personal data, or wish to exercise your rights under GDPR, please use the contact details above.

2. Introduction

Mara's Secret is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, the legal basis for processing, and your rights regarding your data under the General Data Protection Regulation (GDPR) and Hungarian data protection law. By using our site you acknowledge that you have read and understood this policy.

3. Information we collect

We collect the following types of information:

• Account information — email address and password (hashed and never stored in plain text) when you register.
• Billing information — payment is processed entirely by Stripe. We receive only a Stripe customer ID and subscription status. We never see, store, or have access to your card number or banking details.
• Usage data — pages visited, content viewed, and timestamps, used to improve the service. This data is aggregated and not linked to your identity.
• Device data — browser type, approximate location derived from IP address, and operating system, collected for security and analytics purposes.
• Age declaration — your self-declaration that you are 18 or older, stored in your browser's local storage on your device only.

4. Legal basis for processing

We process your personal data on the following legal bases under GDPR Article 6:

• Contract performance (Article 6(1)(b)) — processing your account information and billing data is necessary to provide the subscription service you signed up for.
• Legitimate interests (Article 6(1)(f)) — usage data and device data are processed to maintain security, prevent fraud, and improve the service. These interests do not override your rights.
• Legal obligation (Article 6(1)(c)) — we retain certain billing records as required by Hungarian and EU financial regulations.

5. How we use your information

We use your information to:

• Provide and manage your account and subscription
• Process payments and send transaction receipts
• Send important service updates and account notifications
• Enforce our Terms of Service and age requirements
• Maintain the security and integrity of the site
• Comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for advertising or profiling purposes.

6. Data storage and security

Your data is stored securely using Supabase, a SOC 2 compliant platform. All data is encrypted in transit using TLS 1.2 or higher and encrypted at rest. Passwords are hashed using bcrypt and never stored in plain text. We implement industry-standard technical and organisational security measures to protect your information against unauthorised access, alteration, or destruction.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (NAIH) within 72 hours and affected users without undue delay as required by GDPR Article 33–34.

7. Third-party services (data processors)

We use the following trusted third-party services that may process your personal data on our behalf. Each is bound by a Data Processing Agreement and GDPR-compliant terms:

• Supabase — database and authentication (USA, with EU data residency options). Privacy Policy
• Stripe — payment processing (USA, EU Standard Contractual Clauses apply). Privacy Policy
• Cloudflare — media delivery and DDoS protection (USA, EU Standard Contractual Clauses apply). Privacy Policy
• Vercel — hosting and infrastructure (USA, EU Standard Contractual Clauses apply). Privacy Policy

Where personal data is transferred outside the European Economic Area, such transfers are made under appropriate safeguards including Standard Contractual Clauses as permitted by GDPR Chapter V.

8. Cookies and local storage

We use essential session cookies only — these are strictly necessary for authentication and to keep you logged in. We do not use tracking cookies, advertising cookies, or any third-party cookies. Your age gate confirmation is stored in your browser's local storage on your own device and is not transmitted to our servers.

We use Vercel Web Analytics for anonymous, aggregated traffic analysis. This service does not use cookies and does not collect personally identifiable information. No consent is required for its use.

9. Data retention

We retain your personal data only for as long as necessary:

• Account data — retained for the duration of your active account
• Billing records — retained for 7 years as required by Hungarian accounting law
• Usage/analytics data — aggregated and retained for up to 24 months

If you delete your account, your personal data will be deleted within 30 days, except where retention is required by law.

10. Your rights under GDPR

As a data subject under GDPR, you have the following rights:

• Right of access (Article 15) — request a copy of the personal data we hold about you
• Right to rectification (Article 16) — request correction of inaccurate or incomplete data
• Right to erasure (Article 17) — request deletion of your personal data where no legal basis for retention exists
• Right to data portability (Article 20) — request your data in a structured, machine-readable format
• Right to object (Article 21) — object to processing based on legitimate interests
• Right to restrict processing (Article 18) — request that we limit how we process your data in certain circumstances

To exercise any of these rights, contact us at [marassecret@gmx.de]. We will respond within 30 days. You may also lodge a complaint with the Hungarian data protection authority:

11. Children's privacy

Our site is strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have inadvertently collected data from a minor, we will delete it immediately. If you believe a minor has registered, please contact us immediately.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of significant changes by email or by posting a prominent notice on the site. The date at the top of this page indicates when the policy was last revised. Continued use of the site after changes are posted constitutes your acknowledgement of the updated policy.

13. Contact

For any privacy-related questions, data subject requests, or complaints, please contact us at: [marassecret@gmx.de]