1. Data Controller

John Fox, trading as BinDay ("we," "us," or "our"), is the data controller responsible for the personal data described in this policy. BinDay is based in Ireland and processes personal data under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

2. Data We Collect

The information we process depends on the features you use:

Account and contact data: Name, email address, profile image, account ID and sign-in provider.
Address and household data: The full Eircode and address label you enter, your selected council or waste provider, address and schedule metadata, and household membership details.
Service data: Collection schedules, bin types, reminder and notification preferences, push-notification token, provider imports, schedule confirmations, reports, reviews, referrals, waste-dashboard entries and deposit-return records.
Content you submit: Receipt or item images, complaint details, messages, feedback and other information you choose to send through a BinDay feature.
Subscription data: Customer, subscription, product and purchase status needed to provide paid features. Payment card details are entered with Stripe, Apple or Google and are not stored by BinDay.
Technical and usage data: IP address, device and browser details, pages and actions, consent choice, diagnostic logs, errors, performance data and cookie or analytics identifiers where the relevant tracking has been accepted.

3. Purpose of Processing and Legal Basis

We use personal data to run accounts, provide schedules and reminders, complete features you request, manage subscriptions, provide support, protect the service and understand how BinDay is working. The legal basis depends on the purpose:

Contract or steps you request: To create and operate your account, provide schedules, reminders, provider imports and paid features, and handle support requests.
Legitimate interests: To keep BinDay reliable and secure, prevent fraud and abuse, diagnose faults, improve the service and measure basic performance, where those interests are not overridden by your rights.
Consent: For non-essential analytics, advertising tags, optional replay, optional notifications and marketing where consent is required. You can withdraw consent without affecting processing that already took place.
Legal obligations: To keep records or disclose information where tax, accounting, consumer, law-enforcement or other applicable law requires it.

4. Waste Provider Imports

Provider import is optional and starts only when you request it. If you enter an account number, username, password or PIN, BinDay passes those details through its server to the waste provider or its portal to retrieve your schedule. BinDay does not save the password or PIN as a reusable credential.

BinDay may retain a masked account reference and the schedule, source file or raw response, source URL and import or verification metadata returned by the provider. These records are linked to your account or address so that BinDay can display and verify the imported schedule. The provider or portal also processes the details it receives under its own privacy notice.

5. Bin Company Quotes

If you ask for quotes on our price comparison page, we collect your Eircode, your current bin company, the bins you need, your name, your email address and, if you give it, your phone number. We also record that you ticked the consent box, the exact wording you agreed to, its version and the time. We do not store your IP address with the request. To limit repeated submissions we keep a keyed one-way hash of your IP address, and of your email and Eircode, for no more than 4 days; these are then deleted automatically.

Legal basis: your consent, given by ticking the box. You can withdraw it at any time by emailing support@binday.ie, and we will delete your request.
Who sees it: BinDay does not yet have an agreement with any bin company, so we have not passed any request on. For now we contact you ourselves about the options for your area.
Sharing: the current form gives BinDay permission to contact you, not to share your details. Sharing requires your separate agreement, a provider arrangement and confirmed service for your area. Older requests using our original sharing checkbox remain limited to at most three companies serving that area. We do not sell your details or use them for anything else.
Retention: requests are deleted automatically 12 months after you send them.
Counting: we count clicks on the “compare providers” button and the number of requests sent, in the same cookie-free way as our page counts (see section 6). These counts never include your name, contact details, Eircode or town.

6. Services We Use

We do not sell personal data. Depending on the feature and your consent choices, BinDay uses the following services and sends them the information needed for their role:

Vercel: Website hosting, server functions and deployment.
Google Firebase and Google Cloud: Authentication, database, file storage, push notifications and backend services. Google Sign-In is also available.
Google Gemini API (paid service): Processing Premium item photos, receipt images, recycling questions, personalised tips and customer-supplied calendar documents. BinDay sends content only after a current paid or card-backed-trial entitlement is verified. Google states that prompts, images and responses submitted through paid services are not used to improve its products.
Apple, Google Play and RevenueCat: Apple Sign-In, app-store purchases, subscription validation and entitlement updates for mobile apps.
Stripe: Web checkout, billing and subscription management. Stripe receives payment details directly; BinDay stores identifiers and status needed to manage the subscription.
Resend: Account, reminder, support and other service emails, plus marketing emails where permitted.
Cloudflare Workers AI (Qwen): A separate fail-closed fallback for portfolio-owned public provider-document extraction and separately disabled Facebook replies. It is not used for free-user or Premium customer AI requests.
Sentry: Error, crash and performance diagnostics. Screen replay is used only after tracking consent and where enabled.
PostHog: Product analytics and, on eligible non-sensitive pages, optional masked session replay after tracking consent.
Google Analytics, Google Ads, Meta, TikTok and Reddit: Analytics, conversion measurement and advertising tags after tracking consent and where the relevant service is configured.
Waste providers and their portal operators: Schedule lookup or import only when you use that provider feature.

Separately, we count page views with Vercel Web Analytics, which is built into our hosting. It sets no cookies and stores nothing on your device, so it runs whether or not you accept optional analytics. It records the page address (without any query string), the referring site, and your broad location, device and browser type. Vercel does not store your IP address; it uses a daily-changing hash that cannot identify you or follow you across sites. We also count taps on our App Store and Google Play buttons the same way, recording only which store and which page. We use these aggregate counts only, under our legitimate interest in knowing which pages people use, to maintain and improve BinDay.

7. Retention and Deletion

Retention periods vary by record and purpose. Account, address, schedule and feature data is generally kept while your account is active. The in-app account-deletion process removes the account and core account-linked BinDay records, including stored provider-import records and receipt images.

Some information may remain for a limited period in backups, security or operational logs, or where it is needed for legal, tax, accounting, dispute or abuse-prevention purposes. A minimal suppression record may be kept to honour an email opt-out. Shared community records may remain with your account identifier removed, and aggregated or de-identified information may be kept. Stripe, Apple, Google and other providers keep their own records under their policies and legal duties.

8. International Transfers and Security

Some service providers may process data outside Ireland or the European Economic Area. Where GDPR transfer rules apply, the transfer must be covered by a lawful mechanism, such as an adequacy decision or Standard Contractual Clauses, as applicable. Provider privacy notices give more detail about their processing locations and safeguards. We use access controls and other technical and organisational measures to protect data, but no online service can guarantee complete security.

9. Your Rights

Depending on the circumstances and the GDPR conditions, you may have the right to:

Access your personal data and receive a portable copy of eligible data.
Correct inaccurate or incomplete personal data.
Ask for erasure or restriction of processing.
Object to processing based on legitimate interests or for direct marketing.
Withdraw consent at any time for future consent-based processing.

To exercise a right, contact support@binday.ie. We may need enough information to verify your identity and understand the request.

You also have the right to lodge a complaint with Ireland's Data Protection Commission (DPC), including through dataprotection.ie.

Privacy Policy