Privacy Policy

Effective date: August 12, 2026 · Provider: Todd Fishman (doing business as Cinderella FYI; "Cinderella")

A note on the legal entity: Cinderella currently operates as Todd Fishman, a sole proprietor doing business as Cinderella FYI. If a legal entity (such as an LLC or corporation) is formed in the future, these documents will be updated to name it.

What we collect

• Account data: name, email, and authentication identifiers (e.g. Google

OAuth identifiers).

• Listing data: the projects, repositories, and ideas you upload, plus the

scrub reports generated from them.

• Transaction data: offers, purchases, escrow status, payout records, and

legal sign-off records (signature name, timestamp, IP, document versions).

• Payment data: handled by Stripe; we do not store full card numbers.
• Usage data: logs, device/browser info, and privacy-friendly analytics

needed to run and secure the service. See the Cookie Policy.

A note on uploaded code

Uploaded Submissions may inadvertently contain personal data despite our scrub. We process Submissions to detect and remove such data. Do not upload other people's personal data; see the Seller Agreement.

How we use it

To operate the marketplace, scrub and value Listings, process payments, prevent abuse, comply with law, and communicate with you.

Sharing & subprocessors

We share personal data only with the service providers that run the platform, with a Buyer when a sale completes (the Listing itself and the Bill of Sale), and where required by law. We do not sell personal data. Our current subprocessors:

• Stripe — payment processing, escrow, payouts, KYC.
• Resend — transactional email delivery.
• Render — application hosting and infrastructure.
• Plausible — privacy-friendly, cookieless website analytics.
• Anthropic — AI processing for scrub assistance, valuations, and the

"Cindy" assistant. Listing content sent for AI processing is not used by us to train models.

We will update this list as providers change; material changes are notified per the "Changes" section.

Retention schedule

We keep personal data only as long as needed for the purpose it was collected:

• Account data: for the life of your account, then deleted or anonymized

within 90 days of account deletion (except where retention is legally required).

• Listing data & scrub reports: while the listing is live; unsold delisted

content is deleted within 90 days of removal.

• Transaction & legal sign-off records: 7 years, to meet tax, audit, and

dispute obligations.

• Payment records: held by Stripe per its own retention obligations.
• Server logs & security data: up to 12 months.

Your rights — GDPR (EEA/UK users)

If you are in the European Economic Area or the United Kingdom:

• Lawful bases. We process your data on the bases of: contract (running

your account, listings, and transactions), legitimate interests (fraud prevention, security, analytics), legal obligation (tax and financial records), and consent where we ask for it (e.g. marketing email).

• Your rights: access, rectification, erasure, restriction of processing,

data portability, and objection to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time.

• International transfers. We are U.S.-based; data is processed in the

United States. Where required, transfers from the EEA/UK rely on the European Commission's Standard Contractual Clauses (SCCs) with our subprocessors.

• Complaints. You may lodge a complaint with your local supervisory

authority. We'd appreciate the chance to address concerns first: privacy@cinderella.fyi.

To exercise any right, email privacy@cinderella.fyi. We respond within 30 days.

Your rights — CCPA/CPRA (California users)

• Categories collected (see "What we collect"): identifiers (name, email,

IP), commercial information (transactions), internet activity (usage data), and user-provided content (listings). We collect them from you directly and from your use of the service, for the business purposes above.

• We do not sell or share personal information as defined by the CCPA/CPRA,

and we have not done so in the preceding 12 months. Because we do not sell or share, no "Do Not Sell or Share" opt-out is required — if that ever changes, we will add the link and honor Global Privacy Control signals first.

• Your rights: to know/access the personal information we hold about you,

to correct it, to delete it, and to not be discriminated against for exercising any right.

• How to exercise them: email privacy@cinderella.fyi. We will confirm

receipt within 10 business days and respond within 45 days (extendable once by a further 45 days with notice, as the CCPA allows). We may need to verify your identity before acting; you may use an authorized agent with written permission.

Security & breach notification

We use reasonable technical and organizational measures, including the scrub pipeline for uploaded content, encrypted transport, and access controls. No system is perfectly secure. If a personal-data breach occurs, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where GDPR applies, and will notify affected users without undue delay when the breach is likely to result in a risk to them, as applicable law requires.

Changes

We will post updates here and, for material changes, notify you.

Contact: privacy@cinderella.fyi (privacy requests) · legal@cinderella.fyi · support@cinderella.fyi