Privacy Policy

Last updated: 2026-08-29

1. Controller

BurnRateSurgeon acts as the data controller for personal data processed via BurnRateSurgeon. Contact: info@burnratesurgeon.workers.dev.

2. Data we collect

Account identifiers (email, name) supplied at sign-up.
Authentication metadata from our identity provider (Auth0).
Content you upload to the Service.
Operational logs (request IP, timestamp, user-agent) retained for security and abuse-prevention purposes.

3. Legal basis

We process the data above on the legal basis of (a) contract performance — to deliver the Service you signed up for — and (b) legitimate interest, where applicable, for security, fraud prevention and product analytics (with consent for non-essential categories — see section 9).

4. Data residency

All data is processed and stored within the European Union (Cloudflare EU region: D1, KV, R2 all jurisdiction-locked). Authentication (Auth0) and billing (Stripe) sub-processors may transfer data within the EEA only.

5. Retention

Account data is kept for as long as your account exists. Operational logs are kept for 90 days. On account deletion you may request erasure of personal data at info@burnratesurgeon.workers.dev.

6. Your rights

Under GDPR you have rights of access, rectification, erasure, restriction, portability and objection. Access and portability are self-service: Your data downloads a machine-readable JSON copy of your account, the organizations you belong to and the API tokens you created. Token secrets are never included — they are not stored. For rectification, erasure, restriction or objection, email info@burnratesurgeon.workers.dev; we answer within 30 days.

7. Sub-processors

We use Cloudflare (EU region: infrastructure), Auth0 (authentication), and Stripe (payments). Each is a GDPR-compliant sub-processor with EU data-processing agreements in place.

8. Security

We use industry-standard encryption in transit (TLS 1.3) and at rest. Application secrets are stored encrypted (AES-GCM) and rotated on schedule. Access to production data is restricted to a named operator list.

9. Cookies

BurnRateSurgeon distinguishes three cookie categories. Essential cookies (session, CSRF, authentication; httpOnly, Secure, SameSite=Strict) are always on — without them the service does not work. Analytics and Marketing cookies are off by default and only load after you accept them in the consent banner shown on your first visit. Withdrawing is as easy as consenting: the Your data page reopens the banner so you can change or revoke your choice at any time. We do not load any third-party tag before consent.

10. Changes to this Policy

We may update this Privacy Policy. Material changes will be notified via email at least 30 days in advance. Continued use of the service after the effective date constitutes acceptance.

11. Contact & DPO

Data protection enquiries: info@burnratesurgeon.workers.dev.