Privacy Policy

Last updated: 4 August 2026

1. About this Privacy Policy

StickyNotes.club is committed to protecting your personal data.

This Privacy Policy explains which personal data is collected, why it is used, how long it is kept, which service providers may receive it and which rights you have under the General Data Protection Regulation (GDPR).

2. Who is responsible for your data?

The controller responsible for processing your personal data is:

Farid Bouchdak, trading as StickyNotes.club
Sole proprietorship
Dutch Chamber of Commerce number: 30221015
Muntelbolwerk 1 P
5213 SZ 's-Hertogenbosch
The Netherlands
Email: farid﹫stickynotes.club

3. Minimum age

You must be at least 16 years old to create and use a StickyNotes.club account, or to take part in a workshop without an account.

StickyNotes.club is not intended for children under the age of 16. If you believe that a child under 16 has provided personal data, please contact us so that we can investigate and, where appropriate, delete the data.

4. Personal data we process

Depending on how you use StickyNotes.club, we may process the following personal data.

Account information

  • your email address;
  • your securely hashed password;
  • your display name;
  • your profile description;
  • your profile photo;
  • your selected profile location;
  • your account settings and preferences.

Participation without an account

When you join a workshop through a workshop link, you take part without creating an account. In that case we process:

  • the nickname you choose when you join;
  • the sticky notes, comments, hearts and votes you add to that board;
  • a random participation token stored in your browser and in your session, which lets you return to the same board as the same participant;
  • the date and time you joined and were last active on the board;
  • the technical and security information described below.

We do not ask for your email address, and you do not create an account. Your nickname is visible to everyone with access to that board.

Content and activity

  • public sticky notes;
  • private boards and board notes;
  • uploaded photos;
  • comments and likes;
  • tags and due dates;
  • dot votes and voting rounds;
  • board invitations, permissions and share links;
  • dates and times associated with your content and activity.

Subscription and payment information

  • your subscription or purchase status;
  • your selected plan;
  • customer, transaction and invoice references;
  • information needed to manage your subscription or purchase.

Payment card details are processed by Creem and are not stored by StickyNotes.club.

Technical and security information

  • your IP address;
  • browser and device information;
  • login and session information;
  • server, security and error logs;
  • information used to prevent misuse, fraud and unauthorised access.

Communications

  • emails and support requests you send us;
  • information included in bug reports or feedback;
  • reports about content or users;
  • communications concerning privacy requests or disputes.

Please avoid including unnecessary personal or sensitive information in sticky notes, boards, photos, support messages or other content.

5. Why we process your data

We process personal data for the following purposes and legal bases.

To provide the service

We process the information needed to:

  • create and manage your account;
  • let you sign in securely;
  • publish and manage sticky notes;
  • create and manage private boards;
  • support invitations, permissions and collaboration;
  • let people take part in a workshop without an account;
  • store and display the content you create;
  • provide paid features and manage subscriptions.

The legal basis is the performance of our agreement with you.

We process subscription, transaction and administrative information to:

  • process and administer purchases and subscriptions;
  • maintain financial records;
  • comply with tax, accounting and other legal obligations.

The legal bases are the performance of our agreement with you and compliance with legal obligations.

To communicate with you

We use your contact information to send necessary service messages, including:

  • email verification messages;
  • password reset messages;
  • board invitations;
  • security notifications;
  • subscription and payment messages;
  • responses to support and privacy requests.

The legal basis is the performance of our agreement with you. Where necessary, we may also rely on our legitimate interest in supporting and securing the service.

To protect and improve StickyNotes.club

We may use technical, security and limited usage information to:

  • keep the service secure;
  • prevent fraud, spam and misuse;
  • investigate errors and incidents;
  • maintain the reliability of the service;
  • understand and improve essential product functionality;
  • enforce the Terms of Service and Community Guidelines.

The legal basis is our legitimate interest in operating, protecting and improving StickyNotes.club. We balance this interest against your rights and reasonable expectations.

We will request separate consent before using personal data for an optional purpose that requires consent.

You can withdraw your consent at any time. Withdrawing consent does not affect processing that took place before it was withdrawn.

6. Public and private content

Public sticky notes

Public sticky notes and associated profile information can be viewed and shared by other people.

Search engines, social networks or other third parties may copy, index or cache public content. Removing a public sticky note from StickyNotes.club may therefore not immediately remove copies held by third parties.

You can edit and delete your public sticky notes yourself.

Private boards

Private boards are intended for the people who have been invited or who have access through a share link.

Board owners are responsible for managing invitations, permissions and share links. Anyone with access may be able to view or contribute to a board according to the permissions granted.

You can edit and delete your own content using the available controls. Board owners can manage access to their boards.

No online system can guarantee absolute confidentiality. Only add information to a private board that is appropriate to share with everyone who has access to it.

Workshops and participants without an account

A board Owner with access to workshop mode can create a workshop link. Anyone with that link can choose a nickname and take part in the session without an account.

A workshop link always has an expiry time and can be revoked by the Owner at any moment. When the link expires or is revoked, access ends.

A participant without an account can add, edit and delete their own sticky notes and take part in comments, hearts and dot voting. They cannot change anyone else's content or manage the board.

Treat a workshop link as private information. Anyone who receives or is forwarded an active link can take part in the session.

Because participation is not tied to an account, we cannot verify who is behind a nickname. Clearing your browser data means you take part as a new participant, and any earlier contributions stay on the board under the nickname you used at the time.

7. Cookies and analytics

StickyNotes.club uses only cookies and similar technologies that are necessary to operate the service.

These may be used for:

  • authentication;
  • keeping you signed in;
  • session security;
  • remembering essential settings;
  • preventing misuse.

StickyNotes.club does not currently use advertising cookies, behavioural tracking or third-party analytics.

Because these cookies are necessary to provide the service, they cannot be disabled through a consent preference without affecting essential functionality. You can block cookies in your browser, but parts of StickyNotes.club may then stop working.

8. Service providers

We use selected service providers to operate StickyNotes.club.

Fly.io

Fly.io hosts the application, database and stored content. The production server is deployed in the Amsterdam region.

Cloudflare

Cloudflare provides DNS, network delivery and security services. Cloudflare may process IP addresses and technical request information to deliver and protect the service.

Resend

Resend sends transactional emails, such as email verification, password reset and board invitation messages.

Creem

Creem processes payments, subscriptions and related customer administration. Creem may act as an independent controller for parts of the payment transaction and may process information under its own privacy policy.

These providers may use their own subprocessors where necessary to provide their services.

We may also share personal data:

  • with professional advisers when reasonably necessary;
  • with authorities when required by law;
  • in connection with a legal claim, security incident or investigation;
  • as part of a business transfer, provided appropriate safeguards apply.

We do not sell your personal data to advertisers or data brokers.

9. International data transfers

The main StickyNotes.club production server is hosted in Amsterdam, the Netherlands.

Some service providers or their subprocessors may process personal data outside the European Economic Area. Where this happens, we rely on an applicable lawful transfer mechanism, such as:

  • an adequacy decision by the European Commission;
  • the EU-US Data Privacy Framework where applicable;
  • European Commission Standard Contractual Clauses;
  • another safeguard permitted by the GDPR.

You can contact us for more information about the safeguards relevant to your personal data.

10. How long we keep your data

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy.

Unless a longer period is required by law or needed for a legal dispute, the following periods apply:

  • Account information and content: for as long as your account exists.
  • Participation without an account: the nickname and participation token of a participant without an account are removed 30 days after their last activity on the board. Their contributions remain on the board and are shown under a neutral name from that moment on.
  • Deleted accounts and active production data: removed from the active environment when account deletion is completed.
  • Backups: deleted data may remain in protected backups for up to 30 days before being overwritten.
  • Security, server and error logs: up to 90 days.
  • Support correspondence and feedback: up to 2 years after the matter is closed.
  • Financial and tax administration: 7 years, or longer if required by law.
  • Legal claims and disputes: for as long as reasonably necessary to establish, exercise or defend the claim.

StickyNotes.club does not currently delete accounts automatically because of inactivity.

Contributions are made anonymous rather than deleted. The result of a workshop is what the facilitator works with afterwards, and it should not disappear from a report a month later. Deleting a board removes its participants as well.

Some public information may remain temporarily available in third-party caches or copies that StickyNotes.club does not control.

11. Security

We use reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and disclosure.

These measures include, where appropriate:

  • encrypted connections;
  • secure password hashing;
  • authentication and access controls;
  • session management;
  • infrastructure and application security measures;
  • backups and recovery procedures;
  • restricted administrative access;
  • monitoring and investigation of security incidents.

No method of storage or transmission over the internet is completely secure. We therefore cannot guarantee absolute security.

You are responsible for using a strong, unique password and for keeping your login details confidential.

12. Your privacy rights

Subject to the conditions and exceptions in the GDPR, you may have the right to:

  • receive information about how your personal data is used;
  • access the personal data we hold about you;
  • correct inaccurate or incomplete data;
  • request deletion of your personal data;
  • restrict certain processing;
  • object to processing based on legitimate interests;
  • receive certain data in a structured, commonly used and machine-readable format;
  • withdraw consent where processing is based on consent;
  • lodge a complaint with a supervisory authority.

You can update or delete much of your information directly through StickyNotes.club.

There is currently no automatic data-export tool. You can submit an access or data-portability request by emailing farid﹫stickynotes.club.

We may ask for information needed to verify your identity. We will normally respond within one month. This period may be extended by up to two additional months for complex or numerous requests, in which case we will inform you.

Some requests may be limited where retaining or processing information is required by law or necessary to protect the rights of others.

13. Account deletion

You can permanently delete your account from your account settings.

Deleting your account removes your profile and content from the active service, subject to:

  • the temporary backup period described above;
  • financial information that must be retained by law;
  • information needed for security, fraud prevention or legal claims;
  • copies or caches held independently by third parties.

Account deletion cannot be undone.

If you have an active paid subscription, cancel it before deleting your account.

14. Complaints

Please contact us first if you have a question or concern about how your personal data is handled:

farid﹫stickynotes.club

You also have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens

You may instead contact the data protection authority in the EU or EEA country where you live or work, or where you believe an infringement occurred.

15. Changes to this Privacy Policy

We may update this Privacy Policy when the service, our providers or legal requirements change.

The current version will always be published with its latest revision date. We will provide additional notice when a change materially affects how we use your personal data.