Privacy policy
How 10BONDS uses your personal data, and your rights under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).
Draft of 19 October 2026. This text is being reviewed and will be completed with our company details. Bracketed items are still to be filled in.
1. Who is responsible (data controller)
SQUARE ONE OÜ, Männimäe/1, Pudisoo küla, Kuusalu vald, 74626 Harju maakond, Estonia, registry code 14035002, VAT number EE102234240. Privacy contact: privacy@10bonds.com.
2. What data we hold
- Account: e-mail address, username, a secure hash of your password (never the password itself), your plan, sign-up and last sign-in dates, the version and date of the Terms you accepted, whether you confirmed your e-mail.
- Payments: for paying customers, the Stripe customer and subscription reference, status, billing period and renewal date. Card details are entered on Stripe's page and held only by Stripe; we never see them.
- Search allowance: the time of each counted search, so the weekly limit of the free plan works.
- Usage statistics (only if you allow them): pages visited, searches made and buttons clicked, linked to a random visitor id. No IP address is stored with them.
- Codes: which trial code you used and when.
- Professional access (Pro): firm, role, country, regulator, licence number, website and the declaration you made.
- Security: your IP address is held briefly in the server's memory to limit repeated sign-in and sign-up attempts. It is not written to our database.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Running your account, the search, the weekly allowance and paid plans | Contract (6(1)(b)) |
| Taking payments and keeping invoices | Contract and legal obligation (6(1)(b) and (c)) |
| Checking that Pro users are regulated professionals | Contract and legitimate interest in offering the tool only to professionals (6(1)(b) and (f)) |
| Security, preventing abuse and fraud | Legitimate interest (6(1)(f)) |
| Usage statistics to improve the site | Your consent (6(1)(a)), which you can withdraw at any time under “Cookie settings” |
| E-mails about your account (confirmation, payment issues) | Contract (6(1)(b)) |
We do not sell your data, do not use advertising trackers and do not make decisions about you by automated means that have legal or similar effects.
4. Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Fly.io, Inc. | Hosting the website | Servers in Paris, France (EU); US company |
| Neon, Inc. (Databricks) | Database holding accounts and usage data | [Neon region to be confirmed]; US company |
| Stripe Payments Europe, Ltd. | Payments, subscriptions, invoices | Ireland (EU), with transfers to Stripe, Inc. (US) |
| Resend (Plus Five Five, Inc.) | Sending account e-mails, once switched on | US |
Each provider acts on our instructions under a data processing agreement. Where data leaves the European Economic Area, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
5. How long we keep it
- Account data: until you delete your account.
- Search allowance records: 30 days.
- Usage statistics: 13 months, then deleted automatically.
- Professional access request: until you delete your account.
- Invoices and payment records: kept by Stripe for as long as tax law requires (10 years in Italy), even after you delete your account.
6. Your rights
You have the right to:
- access your data and receive a copy (art. 15);
- correct wrong data (art. 16);
- erasure, the “right to be forgotten” (art. 17);
- restrict processing (art. 18);
- portability, receiving your data in a machine-readable format (art. 20);
- object to processing based on legitimate interest (art. 21);
- withdraw consent at any time, without affecting what was done before (art. 7(3)).
How to use them: on your profile page you can download all your data, delete your activity data and delete your account with everything in it, at once. For anything else write to privacy@10bonds.com. We answer within one month.
You can also complain to a data protection authority, in particular the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or the authority of the country where you live.
7. Payments and plans
Paid plans (Plus €9, Premium €19, Pro €89 a month, or 20% less yearly) are handled by Stripe. When you delete your account, any subscription is cancelled at once and nothing more is charged.
8. Children
10BONDS is for adults. We do not knowingly hold data about anyone under 18.
9. Security
Connections are encrypted (HTTPS), passwords are stored only as secure hashes, database access is limited to the roles that need it, and sign-in attempts are rate-limited. If a breach puts your data at risk, we tell the authority within 72 hours and you without undue delay.
10. Cookies
See the cookie policy.
11. Changes
We will publish any change here with its date, and tell account holders by e-mail if the change is material.