Controller
The data controller is Matyash Igor, Kherson, Ukraine. Contact privacy@gollby.com.ua. This policy covers the public website, Gollby workspaces, authentication, billing and Telegram publishing.
Gollby · Legal information
Privacy Policy
Gollby privacy, cookies, data deletion, security and subprocessors in one policy.
Data we process
We process account and profile data, workspace content and files, brand settings, calendar data, technical and security logs, plan and transaction details, OAuth identifiers, permissions and encrypted tokens. Passwords are stored only as salted scrypt hashes.
Purposes and legal bases
Data is used to perform the service contract, secure the platform, provide support, prevent abuse, comply with law and, with separate consent, measure website usage. Gollby does not sell personal data or use customer content for third-party advertising.
Providers and transfers
Production is hosted by DigitalOcean in Frankfurt, Germany. OpenAI, Google, Resend, Telegram, Google Analytics and Microsoft Clarity are used only for requested functions. See the subprocessors section.
Retention and deletion
Active account data is retained while the service is used. Account deletion has a 30-day cancellation period. Payment and security records may be retained where law or dispute prevention requires it.
Your rights
You may request access, correction, export, restriction, objection or deletion and withdraw analytics consent. Contact privacy@gollby.com.ua.
Cookie Policy
Essential storage, analytics and consent choices.
Essential storage
Session, security, language and consent storage is necessary for sign-in and workspace operation.
Optional analytics
After consent, GA4, GTM and Microsoft Clarity may measure aggregate events, funnels, heatmaps and interactions. Email addresses and customer content are not sent as analytics parameters.
Control
Analytics storage defaults to denied under Consent Mode v2. Refusing analytics does not limit core functionality.
Data Deletion
Delete your Gollby account and data.
Delete account
Open Settings → Workspace → Account deletion and enter DELETE. Sensitive actions are blocked and a cancellation link is emailed.
30-day cancellation
You can cancel for 30 days. Afterwards the account is anonymized, access tokens are removed, and solely owned workspaces are deactivated and their files cleared.
No account access
Email privacy@gollby.com.ua from the registered address. Identity verification may be required.
Security
Technical and organizational safeguards used by Gollby.
Access
Passwords use salted scrypt hashes. Sessions use HttpOnly, Secure and SameSite cookies. Google OAuth uses one-time state and PKCE. Sensitive actions require a verified email.
Integrations
Channel tokens are encrypted at rest, never displayed again and removed on disconnect. OAuth callbacks validate state, age and account ownership.
Infrastructure
Production runs over HTTPS in DigitalOcean Frankfurt with container isolation, restricted networks, security headers, backups and privacy-conscious logs.
Report an issue
Send impact and reproduction steps to support@gollby.com.ua and avoid public disclosure until we respond.
Subprocessors
Services supporting delivery of Gollby.
DigitalOcean
Production hosting and storage in Frankfurt, Germany.
OpenAI
User-requested text and image generation.
Telegram
Channel connection, user-requested publishing and Stars payments.
Sign in with Google, GA4 and Tag Manager.
Resend
Transactional email delivery.
Microsoft Clarity
Optional interaction analytics after consent.