Privacy Policy

1. Controller

The data controller is YURUMI, operated by Lilly Blick as a Swedish sole trader. Org.nr: [confirm organisation number]. Contact: hello@lillyblick.com.

2. Data collected and why

• Contact, inquiry, and quote request data: name, email, country, VAT information where relevant, project details, budget, timeline, and message, used to respond and prepare work proposals.
• Client portal and billing data: client names, emails, company, country, EU VAT IDs, billing addresses, invoices, time entries, payment records, quotes, and subscriptions, used to provide services, invoices, payment tracking, and billing administration.
• Feedback: optional name, email, sentiment, and feedback text, used to improve services and reply where requested.
• Cookies and local storage: strictly necessary preferences and session/auth data, plus analytics or marketing only if consent is given.

3. Lawful basis

• Contract performance: client portal access, project delivery, quotes, invoices, billing, and payment follow-up.
• Legitimate interest: responding to business inquiries, managing client relationships, fraud prevention, service security, and internal administration.
• Consent: non-essential cookies and any optional marketing/analytics tools.
• Legal obligation: accounting, bookkeeping, VAT, tax, and payment records. Swedish bookkeeping law generally requires accounting records to be retained for about seven years. [confirm exact retention period and scope].

4. Hosting, transfers, and security

This app is built and hosted on Base44, Inc., a Wix.com Ltd subsidiary. Base44 uses origin infrastructure in the United States, including Google Cloud and Render, and Cloudflare CDN. Transfers from the EU to the US are covered by Standard Contractual Clauses and the EU–US Data Privacy Framework where applicable. Base44 is SOC 2 Type II and ISO 27001 certified. Review Base44’s privacy policy and DPA before relying on these details: Base44 Privacy Policy and Base44 DPA.

5. Sub-processors

6. Retention

Financial and accounting records are kept for the period required under Swedish bookkeeping law, generally about seven years. Project, contact, and portal records are kept only as long as needed for client service, administration, legal claims, or compliance. Exact retention schedules should be confirmed.

7. Your rights

You may request access, correction, deletion, restriction, portability, or objection where GDPR allows. You can also withdraw cookie consent at any time. You have the right to complain to Integritetsskyddsmyndigheten (IMY), the Swedish data protection authority: imy.se.

8. Cookies

Strictly necessary cookies and local storage support site security, portal sessions, and saved cookie choices. Analytics and marketing are disabled unless you opt in. You can change your choices anytime using Manage cookie settings.