Privacy Policy

This policy describes how Admin Base ("the Platform", operated by Yevhenii Palapa) collects and processes the personal data of its users — the people who sign up to run a store. Personal data of a store's own end customers is processed by the Platform only on that store owner's behalf (see the Commercial Terms and the Data Processing Agreement annexed to them).

Effective date: 2026-08-27

1. Who is responsible for your data (controller)

The controller of your personal data as a Platform user is Yevhenii Palapa, registered at Bělohorská 209/133, Břevnov, 169 00 Praha 6, Czech Republic (company ID 21725209).
For any privacy question you can reach us at info@admin-base.cz.

2. What data we collect

Account data: your email address, and optionally your name and profile image.
Authentication and security metadata: short-lived sign-in codes and links, session records, browser and device information, and a hashed form of your IP address used for rate limiting and abuse prevention.
Consent records: which legal documents you accepted, in which version, and when — together with the IP address and the browser and device information recorded at the moment of acceptance, so that consent can be proven.
Usage and content: stores, products, and other content you create in the admin, plus billing and subscription information tied to your account.

3. Why we process it, and the legal basis

To provide the service you signed up for — creating and running your store (performance of a contract).
To keep accounts and the Platform secure — authentication, rate-limiting, and abuse prevention (legitimate interest).
To comply with legal obligations — for example accounting and tax records related to billing (legal obligation).
Where we ask for it explicitly — such as optional communications (consent, which you can withdraw at any time).

4. Legal documents and your acceptance

When you create an account you accept the Terms of Use. That is the only document we ask you to accept, and we record the act: document, version, timestamp, IP address, and browser and device information.
This Policy is not one of them. It is information under Art. 13 GDPR, not a contract: nobody accepts it and its version binds you to nothing. We record only which version you were shown.
If we materially change the Terms of Use, we raise the version and tell you by e-mail at least 30 days before the change takes effect. You may reject it and close your account as of that date without penalty. If you do not, and you keep using the admin after that date, the change counts as accepted — we say so in the notice itself. Neither raising a version nor declining a new one suspends your access.
The Commercial Terms, which cover the tariff and payment for one store, are a separate contract accepted by that store's Customer when the store is created. If you were invited into somebody else's store, you are not a party to them.

5. Payments

Card payments are handled directly by a certified payment provider (Stripe). The Platform stores no full card numbers. Their handling of your payment data is governed by their own privacy policy, linked from the sub-processor list.

6. Who we share data with (processors)

We use a limited set of sub-processors to run the service: Hostinger (Hosting), Cloudflare (Storage), Stripe (Payments), Google Workspace (SMTP) (Email). What each of them does, and where the data sits, is listed at /legal/subprocessors.
We do not sell your personal data.

7. How long we keep it

Account data is kept while your account is active. When the account is closed, it is deleted from production systems without undue delay.
Data belonging to a store — its products, orders and customers — is not account data. It is governed by the Commercial Terms and stays available for export for 90 days after the contract for that store ends.
Backups rotate automatically, so deleted data may still sit in them for up to a further 35 days; they are not accessed except when recovering from a failure. Short-lived authentication artifacts expire within minutes.
Records we need for tax and accounting, and records of the consents you gave, are kept for the period the law requires, even after the account is deleted.

8. International transfers

Some sub-processors process data outside the EEA. We rely on appropriate safeguards: Cloudflare — Standard contractual clauses (Art. 46(2)(c) GDPR) contained in the Cloudflare Data Processing Addendum. Stripe — Standard contractual clauses and EU–US Data Privacy Framework certification. Google Workspace (SMTP) — Standard contractual clauses and EU–US Data Privacy Framework certification.

9. Your rights

Subject to applicable law, you can request access to your data, correction, erasure, restriction, or portability, and you can object to certain processing or withdraw consent.
To exercise any of these, contact info@admin-base.cz. You also have the right to lodge a complaint with the supervisory authority — Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7 (https://www.uoou.cz).

10. Cookies and similar technologies

The Platform sets three cookies. All of them are strictly necessary and all of them are readable only by the server: one keeps you signed in, one remembers which store you currently have open, and one remembers whether you have finished setting up your account.
We run no analytics, no advertising pixels and no third-party tracking scripts, and we set no cookie that would need your consent — hence no cookie banner. A cookie requiring consent would be set only after that consent was given.
Strictly necessary cookies cannot be switched off inside the Platform. Blocking them in your browser prevents signing in.

11. Changes to this policy

We may update this policy from time to time. A material change raises the version shown above and we tell you about it by e-mail. There is nothing to accept: this policy informs you, it does not bind you.

12. Contact

Questions about this policy can be sent to info@admin-base.cz. Contractual notices go to saas@admin-base.cz.

Effective date: 2026-08-27

2. What data we collect

Account data: your email address, and optionally your name and profile image.

Authentication and security metadata: short-lived sign-in codes and links, session records, browser and device information, and a hashed form of your IP address used for rate limiting and abuse prevention.

Consent records: which legal documents you accepted, in which version, and when — together with the IP address and the browser and device information recorded at the moment of acceptance, so that consent can be proven.

Usage and content: stores, products, and other content you create in the admin, plus billing and subscription information tied to your account.

3. Why we process it, and the legal basis

To provide the service you signed up for — creating and running your store (performance of a contract).

To keep accounts and the Platform secure — authentication, rate-limiting, and abuse prevention (legitimate interest).

To comply with legal obligations — for example accounting and tax records related to billing (legal obligation).

Where we ask for it explicitly — such as optional communications (consent, which you can withdraw at any time).

4. Legal documents and your acceptance

When you create an account you accept the Terms of Use. That is the only document we ask you to accept, and we record the act: document, version, timestamp, IP address, and browser and device information.

This Policy is not one of them. It is information under Art. 13 GDPR, not a contract: nobody accepts it and its version binds you to nothing. We record only which version you were shown.

If we materially change the Terms of Use, we raise the version and tell you by e-mail at least 30 days before the change takes effect. You may reject it and close your account as of that date without penalty. If you do not, and you keep using the admin after that date, the change counts as accepted — we say so in the notice itself. Neither raising a version nor declining a new one suspends your access.

The Commercial Terms, which cover the tariff and payment for one store, are a separate contract accepted by that store's Customer when the store is created. If you were invited into somebody else's store, you are not a party to them.

7. How long we keep it

Account data is kept while your account is active. When the account is closed, it is deleted from production systems without undue delay.

Data belonging to a store — its products, orders and customers — is not account data. It is governed by the Commercial Terms and stays available for export for 90 days after the contract for that store ends.

Backups rotate automatically, so deleted data may still sit in them for up to a further 35 days; they are not accessed except when recovering from a failure. Short-lived authentication artifacts expire within minutes.

Records we need for tax and accounting, and records of the consents you gave, are kept for the period the law requires, even after the account is deleted.

8. International transfers

Some sub-processors process data outside the EEA. We rely on appropriate safeguards: Cloudflare — Standard contractual clauses (Art. 46(2)(c) GDPR) contained in the Cloudflare Data Processing Addendum. Stripe — Standard contractual clauses and EU–US Data Privacy Framework certification. Google Workspace (SMTP) — Standard contractual clauses and EU–US Data Privacy Framework certification.

9. Your rights

Subject to applicable law, you can request access to your data, correction, erasure, restriction, or portability, and you can object to certain processing or withdraw consent.

To exercise any of these, contact info@admin-base.cz. You also have the right to lodge a complaint with the supervisory authority — Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7 (https://www.uoou.cz).

10. Cookies and similar technologies

The Platform sets three cookies. All of them are strictly necessary and all of them are readable only by the server: one keeps you signed in, one remembers which store you currently have open, and one remembers whether you have finished setting up your account.

We run no analytics, no advertising pixels and no third-party tracking scripts, and we set no cookie that would need your consent — hence no cookie banner. A cookie requiring consent would be set only after that consent was given.

Strictly necessary cookies cannot be switched off inside the Platform. Blocking them in your browser prevents signing in.