Privacy Policy

Last updated: March 29, 2026

1. Data Controller

The data controller for personal data collected through bglocation.dev is:

Szymon Walczak
Kraków, Poland
Email: hello@bglocation.dev

2. What We Sell

bglocation is a software product — a Capacitor plugin for background location tracking in mobile apps. We sell perpetual software licenses, not a subscription service. Once you purchase a license, you own it permanently and can use it according to the Terms of Service.

3. What Data We Collect and Why

a) License Purchase Data

When you purchase a bglocation license, payment is processed by Lemon Squeezy, which acts as our Merchant of Record (MoR). Lemon Squeezy collects and processes your payment data (name, email, billing address, payment method) under their own privacy policy. We receive from Lemon Squeezy:

Your name and email address
Order details (product, date, amount)
License key

Legal basis: Performance of a contract (GDPR Art. 6(1)(b)) — necessary to deliver your license.

b) License Portal (Magic Link Login)

When you log in to the License Portal to manage your licenses, we send a one-time login link to your email address. We process your email address and a session cookie to authenticate you.

Legal basis: Performance of a contract (GDPR Art. 6(1)(b)).

c) Newsletter

When you subscribe to our newsletter, we collect:

Your email address
Your IP address (stored as part of the consent record)
Platform interest, if provided (e.g. Capacitor, React Native)
Subscription source (footer, landing page, or chat)
Timestamp and text of your consent

We use double opt-in: after you submit your email, you will receive a confirmation email. Your subscription becomes active only after you confirm.

Legal basis: Your consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time by clicking the unsubscribe link in any email.

d) AI Chat

Our website includes an AI-powered chat that answers questions about bglocation. Chat messages are processed by OpenAI's API to generate responses. We do not store chat conversations on our servers. Messages are transmitted to OpenAI during your session and are subject to OpenAI's Privacy Policy.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) — providing product support.

4. Data Retention

Customer data (name, email, orders, licenses): retained for the duration of the license and as required by tax and accounting regulations.
Newsletter — pending subscriptions (unconfirmed): automatically deleted after 7 days.
Newsletter — unsubscribed: automatically deleted after 30 days.
Newsletter — active subscribers: retained until you unsubscribe.
Chat messages: not stored on our servers.

5. Third-Party Processors

We use the following third-party services to operate bglocation.dev:

Service	Purpose	Location
Lemon Squeezy	Payment processing (Merchant of Record)	USA
Resend	Transactional emails (login links, newsletter)	USA
Vercel	Website hosting	USA / Global CDN
OpenAI	AI chat responses	USA
Neon	PostgreSQL database hosting	USA / EU

Where data is transferred outside the EU/EEA, these providers rely on Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR Chapter V.

6. Your Rights

Under GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15) — request a copy of your data
Right to rectification (Art. 16) — correct inaccurate data
Right to erasure (Art. 17) — request deletion of your data
Right to restrict processing (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21) — object to processing based on legitimate interest
Right to withdraw consent (Art. 7(3)) — for newsletter, via the unsubscribe link or by contacting us

To exercise any of these rights, contact us at hello@bglocation.dev. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. For Poland, this is the UODO (Urząd Ochrony Danych Osobowych).

7. Cookies

bglocation.dev uses only essential, functional cookies:

Session cookie (bgl_session) — used for License Portal authentication (expires after 7 days)
Admin session cookie (bgl_admin_session) — used for Admin Panel authentication (expires after 7 days)

We do not use tracking cookies, analytics cookies, or advertising cookies. We do not use Google Analytics or any third-party tracking scripts.

For full details, see our Cookie Policy.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. For significant changes, we will notify active newsletter subscribers by email.

9. Contact

If you have any questions about this Privacy Policy or your personal data, contact us at hello@bglocation.dev.