CompanyMetrics

Privacy & cookie policy

Last updated 5 October 2026

1. Controller

Salvatore Stivala, trading as CompanyMetrics, 106 Rue Jean-François Boch, 1244 Limpertsberg, Luxembourg ("we"). Contact for privacy matters: companymetrics@protonmail.com. No data protection officer has been appointed; contact us at this address with privacy questions.

2. What we collect and why

  • Orders — email address, order contents, price, payment status and the payment reference. Purpose: take payment, deliver the file, handle refunds and support. Legal basis: performance of a contract.
  • Accounting records — the same order data. Purpose: tax and bookkeeping. Legal basis: legal obligation.
  • Payment details — entered directly into our payment provider's checkout (Stripe). We never see full card numbers. Stripe also uses device and payment data to prevent fraud.
  • Rate-limit records — a hash derived from your IP address and the time of recent requests, used to limit abuse and automated scraping. We periodically clear records whose last activity was more than 24 hours ago. Legal basis: our legitimate interest in protecting the service.
  • Usage events — the event type (for example "search" or "download") and its time. We do not attach these events to a customer ID or store search terms.
  • Support — whatever you send us by email. Legal basis: legitimate interests / contract.

We do not sell personal data, use it for advertising or make automated decisions with legal effects.

3. Recipients

  • Stripe (payment processing, fraud prevention, tax calculation and receipts). Stripe may act as an independent controller for some processing; see Stripe's privacy notice.
  • Our hosting, database and infrastructure providers, acting on our instructions.
  • Tax authorities and advisers where legally required.

Some providers process data outside the EU/UK. Transfers rely on adequacy decisions or standard contractual clauses.

4. Retention

  • Order and invoice records: 10 years after the end of the financial year, as required by Luxembourg accounting law.
  • Download access: 7 days after payment.
  • Rate-limit records derived from hashed IP addresses: periodically cleared when their last activity is more than 24 hours old.
  • Support emails: up to 2 years after your query is resolved, unless needed longer for a legal claim.

5. Cookies and browser storage

We do not use advertising or analytics cookies. We use browser storage for the order reference and to remember that you dismissed this notice. Stripe may use cookies or similar storage for payment security and fraud prevention; the details can vary by browser and payment context.

  • Order reference (browser local storage) — links a purchase to the browser that started checkout so only you can download it. Kept until you clear site data.
  • Notice dismissed (browser local storage) — remembers that you closed the cookie notice.
  • Stripe checkout — Stripe may use cookies or similar storage for payment security and fraud prevention. See Stripe's cookie information.

6. Your rights

Under the EU and UK GDPR you can ask for access, correction, deletion, restriction or a portable copy of your data, and object to processing based on legitimate interests. Email companymetrics@protonmail.com; we reply within one month. You can complain to the Commission nationale pour la protection des données (cnpd.lu) in Luxembourg, the UK Information Commissioner's Office (ico.org.uk), or your local authority.

7. Company data on this site

Company information comes from the Companies House public register. We do not include director or persons-with-significant-control records. We do include company names and registered-office details, which may identify individuals in some cases. If you believe a page contains your personal data, contact us and we will review it.

8. Changes

We will update this page if our practices change and show the date of the latest version above.