# Privacy Policy
> This site keeps no record of you. Here is the whole story — what happens when you load a page, what happens if you write to us, and what you can ask us to do about either.
Softaware Ltd · effective 4 September 2026 · https://softaware.io/privacy/
## The short version
softaware.io is a set of static pages. There are no accounts, no forms, no analytics, no advertising, no tracking pixels and no code from anyone but us. Loading a page tells us nothing about you, because we built it so that it cannot.
The only personal data that reaches us is an email you decide to send. Three settings stay in your browser and never leave your device. Everything below is the long version of those two sentences.
## Who is responsible
**Softaware Ltd** (Софтауеър ООД), UIC 206609469, registered in Sofia, Bulgaria, is the controller of the personal data described here, under the General Data Protection Regulation (EU) 2016/679 and the Bulgarian Personal Data Protection Act.
Write to [hi@softaware.io](mailto:hi@softaware.io) about anything on this page. We are not required to appoint a data protection officer and have not appointed one. That address reaches the people who actually decide how this works.
## Loading a page
The site is delivered by **Cloudflare**, which serves the files and stands in front of them. Like every host on earth, Cloudflare handles the technical side of each request: your IP address, the page you asked for, your browser's user agent, the time. It uses that to route the request, cache the response and block attacks.
That processing is Cloudflare's, under its own retention rules and its role as our processor. We do not open those logs, do not receive a copy, and have no analytics layered on top of them, so we cannot tell who visited, what they read, or whether they came back.
**Legal basis:** our legitimate interest in publishing a site that stays up and is not trivially knocked over. Article 6(1)(f) GDPR.
## Writing to us
Every "talk to us" on this site opens your own mail app. Nothing is submitted through the page, because there is nothing on the page to submit.
If you send that email, we receive what you chose to put in it: your address, your name if you sign it, whatever you wrote, and anything you attached. Our mailbox is **Google Workspace**, which processes it for us.
We use it to reply, to work out whether we can help, and to keep a record of what was agreed if we end up working together. We do not add you to a list, and there is no list to add you to.
**Legal basis:** where you are asking about work, taking steps at your request before a contract, Article 6(1)(b). Otherwise our legitimate interest in answering people who write to us, Article 6(1)(f).
**How long:** for as long as the exchange is useful, and then it goes. If the conversation turns into an invoice or a contract, the accounting copy is kept for as long as Bulgarian accounting and tax law requires us to keep it.
## Sending us a CV
If you write to us about working here, we read it, reply, and keep it for up to six months so we can come back to you if something opens up. Ask us to delete it sooner and we will. We do not run candidates through automated screening.
## What we never do
We do not sell personal data, share it with advertising networks, build profiles, or make decisions about anyone by automated means that produce legal or similarly significant effects. Article 22 GDPR does not come into it. We do not ask for special category data and would rather you did not send any.
## Who else is involved
| Who | What they do for us | Where |
| ------------------- | ---------------------------------- | ----------------------- |
| Cloudflare, Inc. | Serves and protects the site | US company, global edge |
| Google Ireland Ltd. | Our email (Google Workspace) | Ireland, US parent |
| Our accountant | Statutory books, if we invoice you | Bulgaria |
Beyond these, we disclose personal data only where a law or a court requires it. Nobody else gets it.
## Data leaving the EEA
Cloudflare and Google may process data outside the European Economic Area, chiefly in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. Ask us and we will point you at the current terms.
## Your rights
You can ask us to:
- **tell you** what we hold about you and why, and give you a copy (Articles 15, 20);
- **correct** anything wrong or incomplete (Article 16);
- **delete** it (Article 17);
- **restrict** what we do with it while something is in dispute (Article 18);
- **stop**, where we are relying on legitimate interests — you can object at any time (Article 21);
- **withdraw consent**, where we ever ask for it. We currently do not.
Write to [hi@softaware.io](mailto:hi@softaware.io). We answer within one month, and it costs nothing. In practice the honest answer is usually "the emails you sent us", and deleting those takes one request.
If you think we have got this wrong, you can complain to the **Commission for Personal Data Protection**, 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, cpdp.bg — or to the supervisory authority where you live or work.
## Keeping it safe
The site is served over HTTPS only, and its content security policy forbids the page from loading code, fonts, images or connections from any other domain, so no third party can reach you through it. Our mailbox is reachable only by the people who work here. We are a company where everything that can be handed to a machine has been, which also means very few people have access to anything at all.
## Children
The site is aimed at businesses and the people who work in them. It is not directed at children, and we do not knowingly process their data.
## What stays in your browser
Three settings, all of them yours, none of them sent anywhere. The [cookies page](/cookies/) lists each one and how to clear it.
## Changes
If the site ever starts doing more than this, we will say so on this page before it does, and the date at the top will change. Questions: [hi@softaware.io](mailto:hi@softaware.io).