Private-beta privacy notice

Invited private beta · Updated 9 November 2026 · English source

Who handles your information

Guilherme Curado, trading as GoalWindow, is the controller for the account service. Contact support@goalwindow.com; postal address: 54 Northfield Place, Leeds, LS26 0SL, United Kingdom. For the ICO data-protection fee, the owner has confirmed that the completed data protection fee assessment found GoalWindow exempt.

Information and purposes

We use your email, password hash, verification/reset records, session records, language preference and access grants to provide and secure your account. Administrators also have a protected authenticator secret and audit records. We use this information to deliver the requested service and protect it from misuse; account email is used for verification, password reset and support, not unsolicited marketing.

This complimentary beta does not collect card details or create a paid subscription, introductory-trial billing identity or trial email fingerprint. The planned post-deletion trial-fingerprint retention policy belongs to a future separately enabled service; no daily trial-expiry process is claimed to be running here.

Service providers and locations

our hosting supplier is OVH LIMITED, 31 Old Bailey, London EC4M 7AU, United Kingdom (company 05519821), as identified by the owner from the existing contract details. The owner records the hosting location as London, United Kingdom. OVH Limited's UK Data Processing Agreement provides applicable safeguards for remote transfers; UK storage does not mean all access stays in the UK. Resend stores email recipients, content and delivery logs in the United States under its incorporated DPA and UK Addendum. Encrypted recovery backups use EU storage with Backblaze under its UK DPA. These statements use the owner's hosting records and the service terms checked on 21 October 2026; they are not a claim of independent contract or legal review.

Resend receives the recipient address and verification/reset message content. Recovery backups are encrypted before off-server transfer. Encryption does not remove their status as personal information. No payment intake is enabled.

Retention and your rights

Account information is kept while your account exists. On a closure request, we delete your account data, normally within 30 days of your request, unless the law requires us to keep it. Session and challenge records are linked to the account. Web request logs are retained for up to seven days. Local recovery copies retain the latest 14 daily backups; encrypted off-server recovery follows the separately configured 14-daily, 8-weekly, 12-monthly policy. Deleted information can remain in restricted recovery copies until expiry; an operator must reapply account erasures before reopening restored account access.

You may request access, correction, deletion, restriction, objection or a portable copy where applicable by contacting support. We respond to rights requests within one month. You may complain to the UK Information Commissioner's Office. Necessary legal records may be retained where the law requires them.