ThatsIt is run by a US company, so it's fair to ask what that means for your data. Here are the short answers. The legally binding text is our Privacy Policy.
- Who is responsible?
- Thatsit.cards LLC (Delaware, USA). EU contact in Vienna: Rueppgasse 34/6, 1020 Vienna, Austria, privacy@thatsit.cards.
- Which law protects you?
- The EU GDPR applies to everything we do with your data. As an EU consumer you also keep the protection of your national consumer law and can go to court in your own country.
- Where can you complain?
- At your national data protection authority, in Austria the Datenschutzbehörde (dsb.gv.at). Or write to us first: we answer within 30 days.
- Who processes your data for us?
- Stripe Payments Europe (payments, identity check, payouts), Cloudinary (images), Base44 (hosting and database), Easyship (shipping labels), email delivery and card image recognition providers. All are bound by data processing agreements.
- Does data leave the EU?
- Yes, some of it can be processed in the USA. For that we use the EU Standard Contractual Clauses or EU adequacy decisions.
- What do we never do?
- We do not sell your data. Your ID documents are checked by Stripe and are not stored by ThatsIt.
- How long do we keep it?
- Account data while your account is open and 3 years after closing, transaction records 7 years (tax law), logs 90 days.
- What can you ask for?
- A copy of your data, corrections, deletion, a machine-readable export, or that we stop certain processing. Email privacy@thatsit.cards.
For businesses
Commercial sellers who need a data processing agreement (DPA) with ThatsIt can request it at privacy@thatsit.cards.