Privacy Policy

At ExtraBar, we take your privacy seriously. This Privacy Policy explains how we collect, use, and protect your personal information, the regional defaults that apply to optional website services, and the choices available to you. Where consent is required, using the website or services does not replace an explicit consent choice.

Company Information

ExtraBar is operated by Appit Studio, located at Boris Rumenov 9, Sofia, Bulgaria. We act as the data controller for all personal information collected through our services.

Contact Email: support@appitstudio.com

What Information We Collect

We collect the following types of information:

• Identification Information: Name and email address when you purchase our product or contact us
• Technical Data: IP address, browser type, device information, and operating system version
• Transaction Records: Purchase history and payment information (processed securely by our payment providers)
• Communications: Messages you send us through support channels
• Marketing Attribution Identifiers: Click identifiers and promotion codes from tracked marketing links, used to attribute purchases and refunds to the link, campaign, or partner that introduced you

How We Collect Your Information

We collect information when you:

• Visit our website
• Purchase ExtraBar
• Contact our support team
• Subscribe to our newsletter

Legal Basis for Processing

We process your personal information under the following lawful grounds:

• Contract Performance: To deliver the product you purchased
• Consent: For marketing communications and cookie usage
• Legal Compliance: To meet our legal obligations
• Legitimate Interests: For security, fraud prevention, and service improvement

Where we apply an approved regional default outside a strict opt-in region, we rely on our legitimate interests in measuring website journeys and campaign performance. You can object or turn those services off at any time through Cookie Settings in the footer.

How We Use Your Information

We use your information to:

• Deliver ExtraBar and provide license keys
• Process payments and send purchase confirmations
• Respond to customer support requests
• Send administrative communications about your purchase
• Improve our website and services
• Prevent fraud and enhance security
• Send marketing communications (with your consent)
• Attribute purchases and refunds to the marketing link, campaign, or partner that introduced you (with your consent)

We do not engage in profiling or automated decision-making.

How We Share Your Information

We do not sell your personal data. We share information only with trusted service providers who help us operate our business:

• Payment Processors: Stripe and PayPal for secure payment processing
• Email Services: Email platforms for sending purchase confirmations and newsletters
• Analytics Services: DataFast for website and revenue analytics; Google Tag Manager may deliver approved measurement tags
• Experience Analytics: Hotjar for optional session replay and usability analysis
• Marketing Attribution: LnkFlow, to measure campaign performance and calculate any applicable partner commission

All service providers are contractually bound to protect your data and use it only for the purposes we specify. Where a provider processes data outside the EEA, we rely on its applicable contractual transfer safeguards, including Standard Contractual Clauses where relevant.

Your Rights Under GDPR

If you are located in the European Economic Area (EEA), you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Correction: Request correction of inaccurate information
• Right to Deletion: Request deletion of your personal data
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Request your data in a portable format
• Right to Object: Object to certain types of processing
• Right to Withdraw Consent: Withdraw consent for marketing or cookies at any time
• Right to Complain: Lodge a complaint with your local data protection authority

To exercise any of these rights, please contact us at support@appitstudio.com. We will respond within one month.

Data Security

We implement appropriate technical and organizational measures to protect your personal information, including SSL encryption and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Data Retention

We retain your personal information only as long as necessary for the purposes outlined in this policy or as required by law. When data is no longer needed, we securely delete or anonymize it.

Under our current Hotjar Basic plan, session Recordings and Heatmaps are retained for one month from capture. Hotjar Surveys are not enabled for this site. Where Hotjar or another service provider processes data outside the EEA, we rely on the provider's applicable contractual transfer safeguards.

The privacy-choice cookie lasts up to 182 days and consent evidence is retained for up to 730 days. DataFast's first-party visitor and session-count cookies last up to 365 days, while its session cookie lasts about 30 minutes. LnkFlow attribution cookies last up to 90 days. Rejecting or withdrawing the relevant purpose clears the applicable LnkFlow, Google Analytics, and Hotjar cookies configured for removal.

Cookies

Our website separates optional processing into Analytics, Attribution, Experience, and Advertising purposes. The website resolves a privacy context at runtime from a trusted Cloudflare country signal. It accepts that signal only through configured Cloudflare infrastructure or a secret-authenticated origin request. It does not infer your location from your time zone, locale, browser language, currency, or other browser settings.

In the EEA, United Kingdom, Switzerland, and other configured strict opt-in regions, Google Tag Manager and Google Analytics, LnkFlow persistent storage, and Hotjar remain off until you grant the relevant permission. DataFast runs on public pages by default in every region without waiting for a cookie-banner choice. Its first-party visitor, session, and session-count cookies connect visits into returning-visitor journeys. Rejecting Analytics in Cookie Settings does not disable DataFast; Global Privacy Control suppresses it. Private purchase receipts do not load its collector.

In a known region outside the strict opt-in list, LnkFlow Attribution storage is enabled by default to measure journeys and campaign performance. Google Tag Manager, Google Analytics, and Hotjar remain off unless you explicitly allow their Analytics or Experience purpose. You can reject or change these defaults at any time.

If the country signal is missing, invalid, reports a Tor exit, or cannot be trusted, the privacy banner remains visible, while LnkFlow persistent storage, Google Tag Manager, Google Analytics, and Hotjar remain off until you explicitly allow them.

DataFast measures public page visits and connects them to Stripe revenue through its native Stripe integration. A same-browser Stripe return may include a session_id so DataFast can reconcile that connected payment. The return page does not create a second payment event, and we do not send a parallel browser payment or custom DataFast payment for the same Stripe transaction.

When DataFast is permitted and its server goals are enabled, a successful newsletter signup may send a newsletter_subscribed goal containing only the integration label beehiiv. A committed referral survey may send one purchase_referral_survey_completed goal containing only the selected source. These goals use the permitted DataFast visitor identifier but do not include the subscriber's email, internal subscriber ID, survey free text, identity profile, payment, refund, or revenue fields.

When a tracked link brings you to our website, LnkFlow may temporarily read the lnk_id click identifier and any lnk_promo promotion code into browser memory. Before the Attribution purpose is permitted, LnkFlow does not store these values, call its journey endpoint, or add a unique identifier to Stripe checkout links.

When Attribution is permitted, including through an approved non-strict regional default, LnkFlow stores these identifiers in first-party cookies for up to 90 days so attribution can survive navigation and return visits. If you then open a dedicated ExtraBar checkout, the opaque click identifier may be passed to Stripe as a client_reference_id. Shared Appit Studio bundle checkout links remain unchanged and are attributed by Appit Studio. One authoritative backend reporter records each confirmed sale or refund; opening or returning from a checkout never creates a second LnkFlow conversion.

Hotjar is treated as Experience processing, LnkFlow as Attribution processing, and Google Tag Manager as Analytics processing. If you reject, opt out, or later withdraw a purpose, the site blocks new activity for those services, clears covered storage, and reloads when required to stop an already-active vendor safely. A Global Privacy Control signal overrides every regional default, disables all optional services including DataFast, and suppresses the initial banner. You can review or change your choices at any time through the permanent Cookie Settings control in the footer.

Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

Children's Privacy

ExtraBar is not intended for use by children under 13 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 13, we will delete it promptly.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page, updating the "Last Updated" date, and requesting a new privacy choice when the change materially affects consent.

Internal Appit offer emails

We may send optional offers, upgrades and discounts for Appit Studio's own related apps and services. These are Appit promotions, not messages sent for third-party marketers.

The internal-offer preference is enabled by default only where applicable law permits. We send these emails with the required consent or under the existing-customer rules for our own similar products and services, including a clear opportunity to decline when contact details are collected. Updated terms do not create past consent or cancel a previous opt-out.

Use the unsubscribe link in every Appit promotional email or your Appit Services email preferences to stop these offers. Receiving offers again requires an explicit choice; signing in or continuing to use a product does not turn them back on.

We do not sell your email address or share it for another company's marketing. Delivery providers may process it on our behalf. Necessary account, security, payment, refund and license messages are separate from optional offers.

Existing newsletter subscriptions and any earlier consent-only or no-marketing promise keep their existing terms. Publishing this notice does not enroll those contacts or treat silence as new consent.

Manage Appit offer email preferences

Offer-email notice added 8 November 2026.

Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us: