Privacy Policy
Last updated: 12 October 2026
This document was prepared in good faith based on the app's actual technical practices and the core requirements of the GDPR, but it does not constitute legal advice. This English version is provided for convenience; the Bulgarian version is legally authoritative and prevails in case of discrepancy.
1. Who processes your data
Design Depot EOOD (Дизайн Депо ЕООД), company ID (ЕИК) 104689647, 9V Konstantin Panitsa Street, Veliko Tarnovo, Bulgaria ("we", "us"), is the data controller for the First Day List mobile app and website (firstdaylist.com) (the "App").
For any privacy question or to exercise your GDPR rights, contact us at office@design-depot.eu.
Given the scale and nature of our activities we are not required to appoint a Data Protection Officer (Art. 37 GDPR); the email above is our single point of contact. As we are established in the EU, no Art. 27 GDPR representative is required.
Supervisory authority: the Bulgarian Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, cpdp.bg. You may lodge a complaint with the КЗЛД or with the supervisory authority of the EU member state where you live or work.
2. What data we collect and why
2.1 Registration data
If you create an account, we collect the email, first name, last name and phone number you provide, and a password (stored only in hashed form). Core features also work without registration — on first launch an anonymous session with a unique technical identifier is created so your data persists between sessions on the same device.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in offering the App without forced registration (Art. 6(1)(f)).
2.2 Sign in with Google
If you sign in with Google, we receive your profile name, email address and an authentication token. Google acts as a processor.
Legal basis: performance of a contract (Art. 6(1)(b)).
2.3 Profile photo
If you upload a photo, it is stored in secure storage and is accessible at a unique URL. Only you can upload or change it.
Legal basis: consent (Art. 6(1)(a)) — entirely optional.
2.4 Your list content
We store the names of items in your lists, their status, any custom rows or notes, and any purchase information you choose to enter manually.
Important note: some list categories (e.g. "Pregnancy", "First Baby") may indirectly reveal reproductive or parental status. We do not require or knowingly process health data, but we treat this content with extra care and ask you not to enter medical, financial or other sensitive information about yourself or others in free-text fields (custom rows, notes, AI requests).
Legal basis: performance of a contract (Art. 6(1)(b)).
2.5 AI Assistant
If you use the "AI Assistant", the text of your request is sent through a secure function in our infrastructure to the Google Gemini API to generate a suggested list. Google processes it as a processor.
Please do not enter sensitive personal information in your request.
To prevent abuse we keep only a technical log (timestamp and session identifier, without the request content) for up to 25 hours, after which it is deleted automatically.
Legal basis: performance of a contract — triggered only by your explicit action (Art. 6(1)(b)).
2.6 Live list sharing
If you invite someone to share a list, we store the email address you enter in order to send the invitation. As the inviting user you represent that you have the right to invite that address.
Legal basis: our legitimate interest in providing the collaborative list feature (Art. 6(1)(f)).
2.7 List suggestions
If you submit a suggestion, we store its text and your email address so we can review it and, if needed, reply.
Legal basis: consent, expressed by submitting the suggestion (Art. 6(1)(a)).
2.8 Purchases, payments, pass status and AI credits
Payments are made on a secure payment page operated by Stripe. When you purchase, Stripe collects your email, name, billing address and card details and processes them under its own privacy policy. We never receive or store your card or bank details. On our side we keep only information about your current pass (type and expiry), remaining lists and AI credits, the number of lists created, and the identifiers of your customer and purchase in Stripe, needed to link a payment to your account and to handle any refund. From Stripe we also receive the name, email, billing address and country entered at payment — to issue the invoice and determine VAT.
Billing details and invoices. Optionally you enter a name and, for a company, its name, registration number, VAT number, address and country (Profile → Billing details). We use them for the invoice and to determine VAT. The VAT number of a company from another EU country is checked automatically in the European Commission's VIES system; we keep the result and the date of the check. Issued invoices (recipient, amount, VAT, country and how it was determined) are kept for 10 years as required by the Bulgarian Accountancy Act — including after the account is deleted. Invoices are sent by email through an email service provider (see Section 4).
Legal basis: performance of a contract (Art. 6(1)(b)) and compliance with a legal obligation — accounting and tax requirements (Art. 6(1)(c)).
2.9 Technical data
We collect your device's language preference (to select one of the App's eight supported languages) and standard technical data generated by every request to our infrastructure (e.g. IP address), needed for security and stability.
Legal basis: legitimate interest (Art. 6(1)(f)).
2.10 Device location (planned feature)
Today the App does not request or store location data. If we add a "find the nearest store" feature, it will request location only in the foreground and only with your explicit permission, and we will update this policy before releasing it.
3. Cookies and similar technologies
The App uses only technically necessary local storage (session data for sign-in, a catalog cache for faster offline use) — strictly necessary and not requiring consent. The Stripe payment page may use its own technical cookies for security and fraud prevention.
Today we do not use third-party analytics or advertising cookies. If we introduce them, we will ask for your explicit consent first.
4. Who we share data with
- Supabase (processor) — all data in Section 2, including Stripe customer and purchase identifiers; hosting infrastructure for the App.
- Google — OAuth and Gemini API (processor) — Google sign-in data and AI request text.
- Stripe Payments Europe, Ltd. — independent controller for payment processing. Receives the email, name, billing address, payment details and amount you enter on the payment page; we receive back the payment status, identifiers and the billing details (no card data).
- Resend (processor) — sending invoices by email: email address, name and the PDF invoice.
- European Commission — VIES — checking the VAT numbers of EU companies: we send only the country and the VAT number.
- Affiliate partner networks (e.g. Profitshare, Admitad, Awin, GetYourGuide, Viator, Tiqets, Civitatis, Musement) — independent controllers. No direct transfer from us: clicking a recommended product or service redirects you to the merchant's site, which processes your data under its own policy.
We do not sell your personal data and do not use it for third-party advertising.
International transfers: some recipients (e.g. Google, Stripe, Resend) may process data outside the European Economic Area (e.g. in the US). We rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and/or an applicable EU data-transfer framework.
5. Retention
We keep your data while you have an active account or until you ask for deletion. Limited-purpose technical logs (e.g. AI rate-limiting) are deleted automatically within 25 hours. On account closure we delete your personal data within a reasonable period, except data we are legally required to retain (e.g. accounting records and payment data, typically up to 10 years under the Bulgarian Accountancy Act).
6. Your rights
Under the GDPR you may: access your data (Art. 15); rectify it (Art. 16); erase it (Art. 17); restrict processing (Art. 18); port your data (Art. 20); object to processing based on legitimate interest (Art. 21); and withdraw consent at any time without affecting the lawfulness of earlier processing.
How to exercise your rights: the fastest way is the "Profile" section in the App, where you can request an export or deletion yourself. You can also write to office@design-depot.eu — we will reply within one month (Art. 12(3) GDPR). If you are not satisfied, you may complain to the КЗЛД or the competent court.
7. Data security
We apply appropriate technical and organizational measures, including password hashing, row-level access control in our database, and encrypted transmission. No system is 100% secure, but we apply good practices appropriate to our scale.
8. Children
The App is not directed at persons under 18 and registration requires adulthood. If we learn we have collected data from someone under 18 without parental consent, we will delete it promptly. If you believe this has happened, write to office@design-depot.eu.
9. Links to third-party sites
The App contains links to merchant and partner sites. This policy does not cover their practices — their own privacy policies apply once you visit them.
10. Changes to this policy
We may update it as the App or the law changes. For material changes we will notify you in the App before they take effect. The date of the last update is shown at the top.
11. Contact
Design Depot EOOD, company ID (ЕИК) 104689647, 9V Konstantin Panitsa Street, Veliko Tarnovo, Bulgaria, office@design-depot.eu, firstdaylist.com