Privacy Notice — Yuh Gettin' Tru?

Dharach Pte. Ltd. ("Dharach", "we", "us") operates the self-service advertiser portal at https://staging-ads.yuhgettintru.com/ads (the "Portal") on the public Yuh Gettin' Tru? product-search site. Dharach is incorporated in Singapore and operates the Portal from its office at Coral Glade, Prior Park, St James, Barbados. This notice tells you what personal information we collect, why, and what choices you have. It covers the Portal only — not the public search site, which has its own notice.

What we collect

Account data — your name, email, company, hashed password, role.
Billing data — handled by Stripe Payments Europe Ltd. We store the customer ID, subscription ID, plan, renewal dates, and the last four digits of the card. Card numbers and CVV never touch our servers.
Advert content — creatives, target URL, target text, schedule, revision history, approval decisions.
Delivery data — impressions, clicks, click-through rate per Advert.
Email — verification emails, password reset, billing receipts. We use MailHog (dev) / a transactional SMTP provider (production) to send them.
Logs — request timestamps, IP, user agent, as standard for any web service.

Why we collect it (purposes)

To create and authenticate your account.
To review your Adverts and run them on the search site.
To bill you monthly via Stripe and prove the transaction happened if there is a dispute.
To show you delivery stats (impressions, clicks) and improve the matching algorithm.
To send you service emails (verification, password reset, receipts, plan changes).
To detect fraud and abuse (spam, chargebacks, scraping).

Who we share it with

Stripe — to process payment. Stripe processes card data under their own privacy notice; we never see card numbers.
S3 / MinIO — to store creative files. The bucket lives in the data centre we use for staging (Hetzner, Falkenstein) and production (Hetzner, Ashburn); the public CDN serves them from images2.yuhgettintru.com.
OpenAI / Cerebras — only when you explicitly click "Generate" on the AI Creative helper. We send the reference image you uploaded and your prompt; their privacy notices govern what they do with it.
MailHog (staging only) — to deliver verification emails to the in-cluster MailHog. Replaced by a transactional SMTP provider in production.
Law enforcement — only if we receive a valid legal order.

We do not sell or rent your data. We do not share it with third-party advertisers or data brokers.

Where data lives

Application database — Postgres on the staging or production host. Staging: Hetzner Falkenstein. Production: Hetzner Ashburn.
Stripe — United States / Ireland (Stripe's choice).
S3 / MinIO — see above.

By using the Portal from Barbados you understand your data may be processed in Singapore (Stripe), the United States (Stripe), and the EU (Stripe Ireland). The European Commission has not issued an adequacy decision for Singapore, so transfers rely on Stripe's Standard Contractual Clauses.

Cookies and similar

The Portal uses a single first-party session cookie (ad_session) to keep you signed in. We do not set third-party advertising or analytics cookies in the Portal. If we add analytics (e.g. a self-hosted Plausible) in the future, this notice will be updated first.

How long we keep it

Account data — until you delete your account, plus 30 days for fraud / chargeback holdback.
Billing data — 7 years (Barbados tax-record retention).
Advert content + delivery data — until you delete the Advert, plus 13 months of anonymised aggregates.
Logs — 30 days, then aggregated.

Your rights

Under the Barbados Data Protection Act 2019-1 ("DPA"), you have the right to:

Ask what personal data we hold about you (right of access).
Have incorrect data corrected (right of rectification).
Have your data deleted, subject to the retention rules above (right to erasure).
Receive your data in a portable, machine-readable format (right to portability — limited to data you provided).
Object to processing for direct marketing (we don't do this).

To exercise any of these, email ops@yuhgettintru.com. We respond within 30 days.

Children

The Portal is for businesses. If you are under 18, do not create an account. We do not knowingly collect personal data from anyone under 18.

Security

We use TLS for transport, bcrypt-hashed passwords, Stripe's PCI-compliant vault for card data, and standard access controls. No system is 100% secure; if you find a vulnerability, please email security@yuhgettintru.com and we'll respond promptly.

International transfers

Your account data is stored in the EU/US (Hetzner Ashburn or Falkenstein, plus Stripe's data centres). Where we transfer data outside Barbados, we rely on Standard Contractual Clauses or equivalent safeguards. If you want a copy of the SCCs, write to us.

Changes to this notice

Material changes will be announced in the Portal and (where you have an account) emailed at least 14 days before they take effect. The current version is always at this URL.

Contact and complaints

Email ops@yuhgettintru.com. Dharach Pte. Ltd., Coral Glade, Prior Park, St James, Barbados. If we cannot resolve a complaint, you may contact the Barbados Data Protection Office (barbadosdataprotection.gov.bb).

Adapted from the General Legal Templates — Privacy Policy (GDPR Enhanced) (CC0 1.0) for Dharach Pte. Ltd.