Privacy & cookie policy

Last updated: September 17, 2025

Superform Labs OÜ (“we”, “our”, “us”) respects your privacy and is committed to protecting your personal data. This Privacy & Cookie Policy explains what information we collect, how we use it, and what rights you have under the General Data Protection Regulation (GDPR) and other applicable laws. It applies to our websites, products, and services.

1. Who we are

Superform Labs OÜ

Registry number: 17007747

Office address: Ahtri tn 12, 15551 Tallinn, Estonia

Email: hello@superformlabs.eu

Contact for privacy matters: Jules Stuifbergen (reachable at hello@superformlabs.eu)

2. Data controller

Superform Labs OÜ is the controller responsible for the processing of personal data described in this policy.

3. Personal data we collect

We collect and process the following categories of data, depending on how you interact with us:

Website visitors

  • Analytics data via Google Analytics 4 (Consent Mode enabled).

  • Consent choices: no tracking, cookieless pings, or full tracking.

  • Contact form submissions (name, email, message).

  • Newsletter sign-ups via Buttondown (name, email).

Product users (Core, Premium, Custom)

  • Name, email, Google Cloud project IDs.

  • License key data and subscription details.

  • Application logs for troubleshooting.

Support users

  • Email communications (name, email, message).

  • Support tickets (via Zammad).

  • GitHub issue data if submitted.

Business and billing data

  • Payment and invoicing information:

    • Lemon Squeezy (merchant of record) for most purchases.

    • Envoice for some Custom plan invoices.

  • We do not collect or store credit card details ourselves.

4. How we use data

We process personal data to:

  • Provide access to GA4Dataform (licensing, subscription management).

  • Deliver support and respond to inquiries.

  • Process payments and issue invoices.

  • Send product updates and newsletters (with consent; unsubscribe any time).

  • Improve our website and services (analytics, performance data).

  • Comply with legal and tax obligations.

5. Legal basis for processing

We rely on the following legal grounds under GDPR:

  • Contract performance (providing GA4Dataform, licensing, support).

  • Consent (analytics, newsletters, optional communications).

  • Legal obligation (invoicing, tax compliance).

  • Legitimate interest (improving services, preventing misuse).

6. Third parties and international transfers

We use third-party service providers to operate our services:

  • Payments and billing: Lemon Squeezy (US), Envoice (Estonia)

  • Hosting: TransIP (EU)

  • Database: Google Firestore (EU)

  • Email and productivity: Google Workspace (EU/US)

  • Newsletters: Buttondown (US)

  • Support and ticketing: Zammad (EU)

  • Code management: GitHub (US)

  • Automation: Zapier (US)

  • Internal communication: Slack (US)

Where data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission.

7. Data retention

  • Account and billing data: as long as you have an active account, and up to 7 years afterwards (to meet legal obligations).

  • Support tickets and emails: up to 3 years.

  • Newsletter subscription: until you unsubscribe.

  • Analytics data: per Google Analytics default retention settings.

8. Cookies and tracking

Our website uses cookies for:

  • Always: Strictly necessary functions (site operation).

  • After Stats consent: Analytics via Google Analytics 4 with Consent Mode.

  • After Stats + Marketing consent: we load the Lemon Squeezy affiliate tag (see 6)

You may choose between no tracking, analytics tracking, or full tracking.

You can adjust your cookie preferences at any time via our cookie banner.

9. Your rights

You have the right to:

  • Access your data.

  • Rectify inaccurate data.

  • Request deletion of your data.

  • Restrict or object to processing.

  • Request data portability.

  • Withdraw consent (for example, newsletter or analytics).

To exercise these rights, contact us at hello@superformlabs.eu.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate or your local supervisory authority.

10. Google API data use

Our app’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. Newsletters and marketing

We use Buttondown for newsletters.

  • Double opt-in is required.

  • You can unsubscribe at any time via the link in every email.

12. Refunds and cancellations

  • For purchases via Lemon Squeezy, refunds and cancellations are governed by their Terms of Service.

  • For directly invoiced customers, we do not provide refunds unless required by law.

13. Security

We use appropriate technical and organizational measures to protect personal data, including encryption, access controls, and minimization of data.

14. Changes to this policy

We may update this Privacy & Cookie Policy from time to time. Material changes will be communicated on our website.

15. Contact us

If you have any questions about this policy or your data, please contact us at:

Superform Labs OÜ

Ahtri tn 12

15551 Tallinn

Estonia

Email: hello@superformlabs.eu