Privacy Policy

Last updated 2026-10-01 · Opentech OÜ

fewbase is built for one person at a time, and its data handling is meant to be small enough to describe in full. This page does that: every category of data we hold, why we hold it, and every third party that sees any of it.

Who is responsible

The data controller is Opentech OÜ, a company registered in Estonia, European Union.

• CompanyOpentech OÜ
• Registry code14633128
• AddressRavi tn 13-41, Järve linnaosa, Kohtla-Järve, Ida-Viru maakond, 30326, Estonia
• VAT numberEE102129232
• Emailinfo@opentech.ee

We have not appointed a Data Protection Officer: the scale of processing does not require one under Article 37 GDPR. Privacy questions go to the address above and are answered by a person, not a queue.

What we collect, and why

Account

Your email address, the interface language and time zone you choose, and — only if you connect it yourself — your Telegram chat identifier and username. The email address is both your identity and the only way to sign in; there is no password to store, and we do not ask for your name.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

What you put into the tools

Whatever you record while using them: project names, domains and monitored URLs and their running costs in Infra Tracker; service names, amounts, billing dates, categories and notes in Subscriptions Tracker; tasks, projects, tags, time entries and their notes in Time Recorder. We treat this as yours. We do not read it, mine it, profile you with it or train anything on it.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Payments and invoices

Card details never reach our servers: the payment itself runs entirely inside Stripe. On our side we store the Stripe customer identifier, which product you bought, its status and period — enough to give you access.

Invoices are issued by us, not by Stripe: once a month we issue a single invoice covering that month's payments, rather than one document per charge. To produce it we use the billing details collected at checkout — your name or company name, address, and VAT number if you gave one — and keep the issued invoices as accounting records. Those details are used for invoicing and bookkeeping, and for nothing else.

Legal basis: performance of a contract (Art. 6(1)(b)) for access; legal obligation (Art. 6(1)(c)) for invoices and accounting records.

Technical records

Our hosting provider, Cloudflare, processes the usual request metadata — IP address, user agent, timestamps — to deliver and protect the site. On top of that, we keep aggregated counters: how many times each page was viewed, and how many times each step of signing up and buying was reached. Each counter is a running total for a product and an event — never a record of one visit or one person — with no identifier attached and no way to link one event to another. The same Cloudflare processes these; there is still no advertising, tracking or profiling anywhere in fewbase.

Legal basis: legitimate interest in a working, non-abused service (Art. 6(1)(f) GDPR).

Where you came from

When you create an account, we save one word describing how you got to fewbase — derived from the site you arrived from or a campaign tag in the link, and reduced to a fixed, closed list such as google, reddit, direct or other — never the full referring link itself. It lives in your account record and tells us which channels bring people in.

Legal basis: legitimate interest in understanding which channels work (Art. 6(1)(f) GDPR). You may object under Art. 21 GDPR; we act on an objection by clearing the value from your account. There is no self-service control for this in the product — write to us and we will do it by hand.

Cookies

One cookie, fb_session, set after you sign in and holding nothing but a random session token. It is strictly necessary to keep you signed in, so it needs no consent banner — and there is nothing else to consent to: no analytics cookies, no third-party pixels, no fingerprinting. The counters described above are the same story: they are written from our own server as a request comes in, so nothing is ever set on your device to produce them — fewbase's analytics runs without cookies, without local storage and without a fingerprint, which is why this page carries no consent banner. Signing out deletes the session cookie.

One page is different: fewbase.com/consent, the page of our Consent product, shows its own cookie banner as a live example. Choosing there stores one more first-party cookie, fb_consent, with a random record ID, your choices and the time of the choice, for up to 12 months. It only remembers what you chose. Changing your choice or withdrawing consent is possible at any time from the round button in the corner of that page.

Who else sees your data

These are our processors. Each one gets the minimum it needs to do its job, under a data processing agreement.

• Cloudflare — hosting, database and network protection. All fewbase data is stored here.
• Stripe — payments and card data, and the billing details collected at checkout. Acts as an independent controller for the payment itself. Invoices are ours, not Stripe's.
• Resend — delivery of sign-in links, alerts and digests. Sees your email address and the message content.
• Telegram — only if you connect it: bot messages and alerts pass through Telegram's infrastructure.
• Anthropic — only when you upload a receipt for recognition in Subscriptions Tracker: that file is sent to Anthropic's API to be read, and its contents are not used to train models. Do not upload a receipt whose contents you would not want processed this way; you can always type the subscription in by hand instead.

Infra Tracker also queries public registries (RDAP/WHOIS and an SSL checking service) about the domains you monitor. Those requests carry the domain, never you.

We do not sell data, and we do not share it with anyone else — unless the law obliges us to.

Transfers outside the EU

Cloudflare, Stripe, Resend and Anthropic are US-based or operate globally. Transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

How long we keep things

• Sign-in links: 15 minutes, and they stop working once used.
• Sessions: 30 days, or until you sign out.
• AI tool calls through MCP (which tool an AI app called, with what arguments, and the outcome): 90 days, then erased automatically. Deleting the account erases them at once. The arguments can contain other people's data that the app sent, such as a client's email or the text of a reply. It stays in the log for up to 90 days, even if you delete that record in the service.
• Account and the data in your tools: until you ask us to delete them — deletion removes them from the live databases immediately and from backups as those rotate. Where you came from is part of this record, and goes when the account does.
• The counters behind the events: raw events are erased automatically after 90 days; what remains afterwards is anonymous monthly totals, which we keep indefinitely.
• Invoices we issue and the accounting records behind them: 7 years, as Estonian accounting law requires. This is the one thing we cannot delete on request.

Your rights

Under the GDPR you may request access to your data, correction, deletion, a portable copy, restriction of processing, or object to processing based on legitimate interest. Write to info@opentech.ee and we will answer within one month. There is no fee and no form to fill in.

If you think we handled your data badly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee, or to the supervisory authority where you live.

Changes

If this policy changes materially, we will email account holders before the change takes effect. The date at the top always reflects the current version.