PRIVACY POLICY AND PROTECTION OF PERSONAL DATA

Effective from: July 10, 2026

1. General Provisions

This Privacy Policy and Protection of Personal Data describes how personal data of users of the Easy Cuts website and online platform are collected, used, stored, disclosed, and protected, available at:

https://www.easy-cuts.com

The policy applies to:

• visiting the site;
• creating and using a user account;
• registration and login via Google;
• using Easy Cuts features;
• purchasing paid access;
• making card payments via Stripe;
• issuing invoices;
• sending inquiries, complaints, or technical reports;
• receiving official or marketing communications;
• using cookies and similar technologies.

2. Personal Data Controller

The personal data controller is:

"ALMARKET" OOD EIK: 204488517 Headquarters and registered address: village of Bazan, 7 Kamchiya St., Ruse Municipality, Ruse District, Republic of Bulgaria Email: almarket.bulgaria@gmail.com Phone: 0878 625 635 Website: https://www.easy-cuts.com

Referred to below as the "Controller", "Easy Cuts", "we", "us", or "our".

3. Applicable Law

Personal data is processed in accordance with:

• Regulation (EU) 2016/679 – General Data Protection Regulation, hereinafter referred to as the GDPR;
• The Personal Data Protection Act;
• The Electronic Commerce Act;
• applicable Bulgarian and European legislation.

4. Fundamental Principles

Easy Cuts processes personal data in compliance with the following principles:

• legality, fairness, and transparency;
• collection for specific, explicitly stated, and legitimate purposes;
• minimization of data to the necessary extent;
• maintenance of accuracy and currency;
• storage period limitation;
• protection of integrity and confidentiality;
• accountability in processing.

5. What Personal Data We Process

Depending on how the user uses Easy Cuts, we may process the following categories of personal data.

5.1. Registration and User Account Data

We may process:

• first and last name;
• email address;
• phone number, when provided;
• unique user identifier;
• profile picture;
• date and time of registration;
• date and time of last login;
• account status;
• selected subscription period;
• activation date;
• expiration date of paid access;
• account usage history.

5.2. Data during Registration and Login via Google

When a user chooses "Sign in with Google", Easy Cuts may receive from Google:

• unique Google profile identifier;
• name;
• email address;
• profile picture, when available.

Easy Cuts does not receive or store the Google profile password.

Standard login via Google does not grant Easy Cuts access to:

• Gmail;
• Google Drive;
• Google Calendar;
• Google Contacts;
• photos;
• documents;
• content from other Google services.

Access to additional Google services can only be granted after a separate, clear, and explicit permission from the user.

5.3. Paid Plan Data

When purchasing paid access, we may process:

• selected period – 1 month, 3 months, or 1 year;
• date and time of the order;
• activation date;
• expiration date;
• price;
• currency;
• order status;
• information about applied discounts or promo codes, when applicable;
• history of purchased periods.

All plans are one-time payments.

After the selected period expires, no automatic renewal occurs and no new amount is charged.

To continue paid access, the user must independently select and pay for a new period.

5.4. Card Payment Data via Stripe

Card payments in Easy Cuts are processed via Stripe.

When making a payment, the user enters their payment details into the secure Stripe payment environment.

Depending on the payment method used, Stripe may process:

• payer's name;
• email address;
• billing address;
• bank card number;
• expiration date;
• security code;
• country of card issuance;
• IP address;
• information about the device and browser;
• transaction data;
• payment authentication data;
• information necessary for fraud prevention;
• data necessary to fulfill legal and regulatory obligations.

Easy Cuts does not receive or store:

• the full bank card number;
• the card's security code;
• online banking password;
• confirmation codes sent by the bank.

Easy Cuts may receive from Stripe:

• name and email of the payer;
• payment status;
• paid amount;
• currency;
• date and time of payment;
• transaction identifier;
• payment session identifier;
• card type or brand;
• last four digits of the card;
• country of issuance;
• information about successful or failed payment;
• information about a refunded amount;
• information about a transaction dispute;
• data for verification and fraud prevention.

Stripe may process certain personal data as an independent controller according to its own terms and privacy policy.

The payment is one-time for the selected period.

Stripe will not be used by Easy Cuts for automatic renewal or periodic fee charging.

5.5. Invoicing Data

When a user wishes to receive an invoice, we may process:

• name of the natural person;
• company name;
• EIK or other identification number;
• VAT number;
• registered address or billing address;
• email;
• phone;
• name of the recipient or materially responsible person;
• information about the purchased service;
• paid amount;
• date of payment;
• invoice number and date.

5.6. Data Entered into Easy Cuts

When using the system, the following may be processed:

• project names and numbers;
• dimensions and quantities of parts;
• dimensions and characteristics of boards;
• names and types of materials;
• material thickness;
• cutting settings;
• blade width;
• edging;
• direction of grain or pattern;
• production marks;
• generated diagrams;
• labels;
• reports;
• downloadable files;
• residues;
• user notes;
• history of performed actions.

This data generally constitutes technical or production information.

It may constitute personal data when the user includes in it the names of clients, employees, suppliers, or other information allowing the identification of a natural person.

The user should not enter personal data that is not necessary for using the platform.

5.7. Technical Data

When using the site and platform, the following may be automatically processed:

• IP address;
• date and time of access;
• device type;
• operating system;
• browser;
• language settings;
• screen resolution;
• approximate location determined by IP address;
• session identifier;
• visited pages;
• features used;
• session duration;
• technical log files;
• information about errors that occurred;
• security data;
• information about failed login attempts;
• information about the source from which the user reached the site.

5.8. Communication Data

When a user contacts us, we may process:

• name;
• email address;
• phone;
• company;
• content of the message;
• attached files;
• screenshots;
• information about the technical problem;
• name or identifier of the project;
• correspondence history;
• actions taken to resolve the case.

5.9. Marketing Data

When a user provides consent for marketing messages, we may process:

• name;
• email address;
• communication preferences;
• date and method of providing consent;
• date of withdrawal of consent;
• information about opening or interacting with sent messages, when such technology is used.

6. Sources of Personal Data

We may receive personal data:

• directly from the user;
• from Google when using "Sign in with Google";
• from Stripe when making a payment;
• automatically from the device and browser;
• from hosting, database, security, and analytics service providers;
• from a company or organization that provides access to its employee;
• from a legally authorized representative.

7. Purposes and Legal Bases for Processing

7.1. Account Creation and Management

We process personal data for:

• registration;
• identification;
• account login;
• account management;
• Google authentication;
• providing access to Easy Cuts.

Legal basis: performance of a contract or taking steps at the user's request prior to entering into a contract.

7.2. Providing Easy Cuts

We process data for:

• creating and saving projects;
• performing calculations;
• optimizing cutting;
• generating diagrams, labels, reports, and files;
• activating and managing the paid period;
• providing technical support.

Legal basis: performance of a contract.

7.3. Processing Payments via Stripe

We process personal data for:

• creating a payment session;
• accepting and confirming card payment;
• activating the purchased period;
• checking payment status;
• preventing fraud;
• refunding amounts;
• reviewing payment disputes;
• protecting against abuse.

Legal basis: performance of a contract, legal obligation, and legitimate interest in protecting against fraud and unauthorized payments.

7.4. Invoicing and Accounting

We process data for:

• issuing invoices;
• accounting;
• tax reporting;
• fulfilling obligations to competent authorities;
• storing accounting documents.

Legal basis: legal obligation.

7.5. Security

We process technical data for:

• account protection;
• preventing unauthorized access;
• detecting fraud;
• preventing abuse;
• protecting the infrastructure;
• diagnosing and resolving technical problems;
• protecting the rights and legitimate interests of Easy Cuts and users.

Legal basis: legitimate interest.

7.6. Improving the Platform

We may use limited, aggregated, or statistical data for:

• improving features;
• optimizing the interface;
• identifying common errors;
• usage analysis;
• measuring technical performance;
• developing new features.

Legal basis: legitimate interest or consent, when the technology used requires prior consent.

7.7. Communication with the User

We process personal data for:

• answering inquiries;
• technical support;
• payment notification;
• confirming a purchased plan;
• notifying about upcoming expiration of the paid period;
• security-related messages;
• notifying about changes to the service or terms;
• handling complaints and claims.

Legal basis: performance of a contract, legal obligation, or legitimate interest.

7.8. Marketing Messages

Marketing messages may be sent:

• after explicit consent;
• in other cases permitted by law;
• with a clear and easy opt-out option.

Legal basis: consent or another applicable basis when the law allows it.

Users can withdraw their consent or unsubscribe at any time.

8. Mandatory and Optional Data

Data required for registration, payment, and service provision is mandatory.

Without it, it may not be possible to:

• create an account;
• log in to Easy Cuts;
• make a payment;
• activate paid access;
• issue an invoice;
• provide technical support.

Providing data for marketing and consent for non-mandatory cookies are voluntary.

9. Login via Google

When using "Sign in with Google", Google authenticates the user's identity and provides Easy Cuts with limited profile data.

Easy Cuts uses the data received from Google solely for:

• creating an account;
• logging into the account;
• identifying the user;
• account protection;
• communication regarding the service.

Easy Cuts:

• does not sell data received from Google;
• does not provide data to advertisers;
• does not use data for credit assessment;
• does not use data for sensitive profiling;
• does not use data for purposes incompatible with this policy;
• does not provide access to data to individuals who have no relation to the service.

Users can withdraw the access granted to Easy Cuts through their Google profile settings.

Withdrawal of Google access does not automatically lead to deletion of the account in Easy Cuts.

To delete the account, the user must use the deletion function in the platform or send a request to:

almarket.bulgaria@gmail.com

10. Payments via Stripe

All card payments in Easy Cuts are processed via Stripe.

Stripe provides a secure payment infrastructure and may process personal and payment data for:

• executing the transaction;
• authenticating the payment;
• preventing fraud;
• complying with legal requirements;
• reviewing disputed payments;
• refunding amounts;
• protecting the payment system.

When a user is redirected to a Stripe payment page or uses an embedded Stripe payment form, the terms and privacy policy of Stripe also apply to the processing of certain data.

Easy Cuts uses Stripe only for one-time payments for a period of:

• 1 month;
• 3 months;
• 1 year.

No automatic renewal is performed.

After the period expires, Stripe does not charge a new amount on behalf of Easy Cuts without a new explicit confirmation and payment from the user.

11. Recipients of Personal Data

When necessary for providing the service, personal data may be provided to:

• Base44 and related technical providers;
• hosting and cloud infrastructure providers;
• database providers;
• Google in connection with registration and Google login;
• Stripe in connection with card payments;
• banks, card issuers, and payment institutions;
• fraud prevention service providers;
• email and communication service providers;
• analytics service providers;
• cybersecurity service providers;
• accountants and auditors;
• lawyers and other professional consultants;
• competent state and supervisory authorities;
• courts and law enforcement agencies when required by law.

Recipients only receive access to data necessary for performing the relevant activity.

When a provider processes personal data on our behalf, the relationship is governed by a contract or other applicable data protection guarantees.

12. International Transfer of Personal Data

Some of the providers used, including Google, Stripe, or their subcontractors, may process personal data outside the European Economic Area.

In such a case, the transfer is based on an permissible mechanism, including:

• a European Commission adequacy decision;
• standard contractual clauses;
• binding corporate rules;
• applicable international data protection framework;
• another permissible basis under the GDPR.

When necessary, additional technical and organizational measures are applied.

13. Storage Periods

Personal data is stored only for the period necessary for the relevant purpose.

13.1. Account Data

Account data is stored as long as it is active, and for a limited period after its deletion, when necessary for:

• security;
• dispute resolution;
• protection of legal claims;
• fulfillment of legal obligations.

13.2. Projects and Production Data

Projects and production data are stored as long as the account and relevant functionality are active, as well as for a limited backup period.

Users are obliged to download and save their own copies of important projects and files.

13.3. Payment Data

Transaction information is stored for the period necessary for:

• performance of the contract;
• accounting;
• resolving payment disputes;
• fraud prevention;
• compliance with applicable limitation periods.

Payment data processed independently by Stripe is stored according to Stripe's periods and policies.

13.4. Accounting and Invoicing Data

Accounting and invoicing data are stored for the periods required by applicable accounting and tax law.

13.5. Technical Log Files

Technical logs are stored for a limited period necessary for:

• security;
• diagnostics;
• preventing abuse;
• establishing technical problems.

13.6. Correspondence

Correspondence is stored until the final resolution of the case and for a reasonable period thereafter.

13.7. Marketing Data

Marketing data is stored until:

• withdrawal of consent;
• unsubscription from communication;
• expiration of the legal basis;
• termination of the relevant marketing activity.

Data may be stored longer when:

• the law requires it;
• there is an ongoing dispute;
• it is necessary for establishing, exercising, or defending legal claims;
• a competent authority has ordered its retention.

14. Account Deletion

Users can request the deletion of their account:

• through the "Delete Account" function, when available;
• via email to almarket.bulgaria@gmail.com.

Upon deletion, the following may be removed:

• profile data;
• saved settings;
• projects;
• generated files;
• usage history that is not required to be saved.

Deletion does not cover data that:

• we are required to store by law;
• is necessary for accounting purposes;
• is necessary for the protection of legal claims;
• must be kept for fraud prevention;
• is stored by Stripe as an independent controller according to its legal obligations.

Account deletion does not automatically lead to a refund of a paid amount.

15. Rights of Data Subjects

Every data subject has the following rights.

15.1. Right to Information

The right to receive clear and understandable information regarding the processing of their personal data.

15.2. Right of Access

The right to request confirmation of whether we process their personal data and to receive a copy of it.

15.3. Right to Rectification

The right to request the correction or completion of inaccurate or incomplete personal data.

15.4. Right to Erasure

The right to request the deletion of personal data when there are legal grounds.

The right to erasure is not absolute and may not apply when storage is necessary for:

• fulfillment of a legal obligation;
• establishing, exercising, or defending legal claims;
• other grounds provided for in the GDPR.

15.5. Right to Restriction of Processing

The right to request a temporary restriction of processing in cases provided by law.

15.6. Right to Portability

The right to receive the personal data they have provided in a structured, commonly used, and machine-readable format, when legal conditions are met.

15.7. Right to Object

The right to object to processing based on legitimate interest.

Upon objection to direct marketing, processing for this purpose ceases.

15.8. Right to Withdraw Consent

When processing is based on consent, the user can withdraw it at any time.

Withdrawal does not affect the lawfulness of processing before the moment of withdrawal.

15.9. Right to Complain

Users have the right to file a complaint with:

Commission for Personal Data Protection

or to another competent supervisory authority in a European Union country.

15.10. Right to Judicial Protection

Users have the right to seek protection before the competent court.

16. Exercising Rights

Requests regarding personal data should be sent to:

almarket.bulgaria@gmail.com

The request should contain:

• name;
• email address associated with the account;
• description of the request;
• information necessary to identify the person and account.

To prevent abuse, we may request additional confirmation of identity.

A response is provided without undue delay and as a rule within one month.

In case of factual or legal complexity, the period may be extended in cases provided for by the GDPR, for which the person will be notified.

Requests are usually processed free of charge.

For manifestly unfounded or excessive requests, a reasonable fee may be charged or action may be refused when the law permits it.

17. Automated Decision-Making

Easy Cuts uses algorithms for automatic calculation and cutting optimization.

The algorithms process the entered technical parameters and generate production suggestions.

This processing does not constitute an automated decision that produces legal effects or similarly significantly affects a natural person within the meaning of the GDPR.

Users independently verify and decide whether to use the generated result.

Stripe may use automated tools for risk assessment and fraud prevention within the payment services it provides.

18. Profiling

Easy Cuts does not engage in profiling that produces legal effects or significantly affects the user.

Limited statistical and analytical data may be used to improve the service when permitted and the necessary consent has been obtained.

19. Security of Personal Data

We apply appropriate technical and organizational measures, including:

• encrypted connection;
• access control;
• user authentication;
• login via Google;
• restriction of administrative access;
• account protection;
• archiving;
• security log files;
• monitoring for suspicious activity;
• protection against unauthorized access;
• incident response procedures;
• use of verified technical providers;
• processing of card payments via Stripe.

Regardless of the measures taken, no internet system can guarantee absolute security.

Users are obliged to protect their Google profile, device, and access means.

20. Security Breach

In the event of a personal data security breach, we will take action to:

• contain the incident;
• establish the causes;
• assess the risk;
• restore security;
• document the incident;
• notify the competent supervisory authority when required;
• notify the affected persons when the breach poses a high risk to their rights and freedoms.

21. Third-Party Data Entered by the User

When a user enters personal data of their clients, employees, suppliers, or other persons into Easy Cuts, they are responsible for:

• having a valid legal basis;
• providing necessary information to the relevant persons;
• not entering more data than necessary;
• complying with applicable law;
• not using Easy Cuts for storing unnecessary or sensitive personal data.

When Easy Cuts processes such data solely on behalf of a corporate user, "ALMARKET" OOD may act as a data processor, and the respective corporate user – as a controller.

If necessary, relationships can be settled with a separate data processing agreement.

22. Data of Minors

Easy Cuts is intended for adults and professional use.

We do not knowingly collect personal data of children.

When we find that personal data of a minor has been provided without a valid basis, we will take steps to delete it.

23. Cookies

Easy Cuts uses cookies and similar technologies.

Detailed information regarding:

• types of cookies;
• purposes of use;
• providers;
• periods;
• consent management;
• cookies related to Google and Stripe;

is available in the separate Cookie Policy.

Non-mandatory analytical and marketing cookies are activated only after valid prior consent, when required.

24. External Links and Services

The site may contain links to external sites and services, including Google and Stripe.

Easy Cuts does not control the privacy practices of these external providers.

Users should familiarize themselves with the privacy policy and terms of the respective provider.

25. Changes to the Policy

This policy may be amended in the event of:

• legislative changes;
• addition of new features;
• change of technical providers;
• change of payment method;
• addition of new processing purposes;
• need for improving transparency and security.

The current version is published at:

https://www.easy-cuts.com

with the specified effective date.

In case of significant changes, registered users may be notified via email or a message in the platform.

26. Contacts

For questions, requests, or reports regarding personal data protection:

"ALMARKET" OOD EIK: 204488517 Address: village of Bazan, 7 Kamchiya St., Ruse Municipality, Ruse District, Republic of Bulgaria Email: almarket.bulgaria@gmail.com Phone: 0878 625 635 Website: https://www.easy-cuts.com