1. Data Controller
John Fox, trading as BinDay ("we," "us," or "our"), is the data controller responsible for the personal data described in this policy. BinDay is based in Ireland and processes personal data under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
2. Data We Collect
The information we process depends on the features you use:
- Account and contact data: Name, email address, profile image, account ID and sign-in provider.
- Address and household data: The full Eircode and address label you enter, your selected council or waste provider, address and schedule metadata, and household membership details.
- Service data: Collection schedules, bin types, reminder and notification preferences, push-notification token, provider imports, schedule confirmations, reports, reviews, referrals, waste-dashboard entries and deposit-return records.
- Content you submit: Receipt or item images, complaint details, messages, feedback and other information you choose to send through a BinDay feature.
- Subscription data: Customer, subscription, product and purchase status needed to provide paid features. Payment card details are entered with Stripe, Apple or Google and are not stored by BinDay.
- Technical and usage data: IP address, device and browser details, pages and actions, consent choice, diagnostic logs, errors, performance data and cookie or analytics identifiers where the relevant tracking has been accepted.
3. Purpose of Processing and Legal Basis
We use personal data to run accounts, provide schedules and reminders, complete features you request, manage subscriptions, provide support, protect the service and understand how BinDay is working. The legal basis depends on the purpose:
- Contract or steps you request: To create and operate your account, provide schedules, reminders, provider imports and paid features, and handle support requests.
- Legitimate interests: To keep BinDay reliable and secure, prevent fraud and abuse, diagnose faults, improve the service and measure basic performance, where those interests are not overridden by your rights.
- Consent: For non-essential analytics, advertising tags, optional replay, optional notifications and marketing where consent is required. You can withdraw consent without affecting processing that already took place.
- Legal obligations: To keep records or disclose information where tax, accounting, consumer, law-enforcement or other applicable law requires it.
4. Waste Provider Imports
Provider import is optional and starts only when you request it. If you enter an account number, username, password or PIN, BinDay passes those details through its server to the waste provider or its portal to retrieve your schedule. BinDay does not save the password or PIN as a reusable credential.
BinDay may retain a masked account reference and the schedule, source file or raw response, source URL and import or verification metadata returned by the provider. These records are linked to your account or address so that BinDay can display and verify the imported schedule. The provider or portal also processes the details it receives under its own privacy notice.
5. Services We Use
We do not sell personal data. Depending on the feature and your consent choices, BinDay uses the following services and sends them the information needed for their role:
- Vercel: Website hosting, server functions and deployment.
- Google Firebase and Google Cloud: Authentication, database, file storage, push notifications and backend services. Google Sign-In is also available.
- Apple, Google Play and RevenueCat: Apple Sign-In, app-store purchases, subscription validation and entitlement updates for mobile apps.
- Stripe: Web checkout, billing and subscription management. Stripe receives payment details directly; BinDay stores identifiers and status needed to manage the subscription.
- Resend: Account, reminder, support and other service emails, plus marketing emails where permitted.
- Google Gemini: Processing images, text or provider documents when you request an AI-assisted scan, tip or import feature.
- Sentry: Error, crash and performance diagnostics. Screen replay is used only after tracking consent and where enabled.
- PostHog: Product analytics and, on eligible non-sensitive pages, optional masked session replay after tracking consent.
- Google Analytics, Google Ads, Meta, TikTok and Reddit: Analytics, conversion measurement and advertising tags after tracking consent and where the relevant service is configured.
- Waste providers and their portal operators: Schedule lookup or import only when you use that provider feature.
6. Retention and Deletion
Retention periods vary by record and purpose. Account, address, schedule and feature data is generally kept while your account is active. The in-app account-deletion process removes the account and core account-linked BinDay records, including stored provider-import records and receipt images.
Some information may remain for a limited period in backups, security or operational logs, or where it is needed for legal, tax, accounting, dispute or abuse-prevention purposes. A minimal suppression record may be kept to honour an email opt-out. Shared community records may remain with your account identifier removed, and aggregated or de-identified information may be kept. Stripe, Apple, Google and other providers keep their own records under their policies and legal duties.
7. International Transfers and Security
Some service providers may process data outside Ireland or the European Economic Area. Where GDPR transfer rules apply, the transfer must be covered by a lawful mechanism, such as an adequacy decision or Standard Contractual Clauses, as applicable. Provider privacy notices give more detail about their processing locations and safeguards. We use access controls and other technical and organisational measures to protect data, but no online service can guarantee complete security.
8. Your Rights
Depending on the circumstances and the GDPR conditions, you may have the right to:
- Access your personal data and receive a portable copy of eligible data.
- Correct inaccurate or incomplete personal data.
- Ask for erasure or restriction of processing.
- Object to processing based on legitimate interests or for direct marketing.
- Withdraw consent at any time for future consent-based processing.
To exercise a right, contact support@binday.ie. We may need enough information to verify your identity and understand the request.
You also have the right to lodge a complaint with Ireland's Data Protection Commission (DPC), including through dataprotection.ie.