CROSSBOUND
Sign in

Crossbound · Legal

Privacy Policy

Last updated:

1. Introduction

Crossbound.eu (“Crossbound”, “we”, “us” or “our”) is operated by Reaching Expatations, a sole proprietorship registered in the Netherlands.

We respect your privacy and are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch data protection legislation.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and what rights you have regarding your information when using Crossbound.eu and its related services.

2. Who is responsible for your data?

The data controller responsible for personal data processed through Crossbound is:

Reaching Expatations
Keurenplein 41, Unit C3127
1069 CD Amsterdam
The Netherlands

KvK: 84654589
VAT identification number: NL003533743B67
Email: legal@reachingexpatations.com

For privacy-related questions or requests, please contact us at the email address above.

3. Personal data we collect

Depending on how you use Crossbound, we may collect the following categories of personal data:

3.1 Account information

When you create or manage an account, we may process your name, email address, account identifiers, authentication information and other information you choose to provide.

3.2 Subscription and transaction information

When you purchase a subscription or another paid service, we may process your selected plan, subscription status, transaction identifiers, billing country, purchase history and payment-related records.

Payments are handled by Stripe, which may act as the merchant of record for eligible transactions. Stripe processes payment and billing information under its own applicable terms and privacy notice.

We do not intend to store complete payment card details on our own systems.

3.3 Affiliate and referral information

If you join our affiliate programme, we may process your name, contact details, affiliate account information, referral identifiers, promotional links or codes, attributed conversions, commission calculations and payout-related information.

Affiliate attribution is intended to be recorded through referral identifiers and account-level or database records. We use the information available in those records to associate eligible registrations and purchases with the relevant affiliate. Attribution may not be possible where a referral cannot reliably be matched to an account or transaction.

3.4 Communications and support

If you contact us, request assistance or communicate with us through the platform, we may process your messages, contact details, support history and information necessary to respond.

3.5 Technical and usage information

To operate, secure and troubleshoot Crossbound, the platform and its infrastructure providers may process technical information such as IP address, browser and device information, access times, diagnostic information and security logs. The precise information generated depends on the live configuration and how you use the Service.

We use Lovable Cloud for the application's backend and database. When you choose to sign in with Google, Google OAuth is used for that sign-in flow. These details do not, by themselves, establish which cookies or other storage technologies are used by the live site.

We currently use Google Search Console for search-performance reporting, such as understanding how Crossbound appears in Google Search. Search Console is not, by itself, evidence that Google Analytics or other on-site analytics cookies are installed. Based on the information currently available to us, we have not confirmed a separate on-site analytics service.

Where cookies, local storage or similar technologies are implemented, they may support essential functions such as authentication, session management, security, preferences or referral attribution. We will seek consent before using non-essential technologies where applicable law requires it.

3.6 Information you choose to provide

We may process additional information you voluntarily submit when using Crossbound. Please do not submit sensitive personal information unless it is necessary for a specific feature and we have an appropriate legal basis to process it.

4. Why we process personal data

We process personal data for the following purposes:

  • Providing the service: creating accounts, enabling access to features and operating subscriptions.
  • Managing payments: coordinating subscription status, billing records and transaction-related support with Stripe.
  • Managing affiliate referrals: attributing eligible purchases, calculating commissions, preventing referral abuse and administering affiliate payouts.
  • Customer support: responding to questions, resolving technical problems and handling complaints.
  • Security and fraud prevention: protecting accounts, detecting suspicious activity and preventing abuse.
  • Service improvement: maintaining platform performance, diagnosing errors and improving functionality. We use Google Search Console for search-performance reporting; we do not describe it as on-site behavioural analytics.
  • Legal and administrative obligations: maintaining appropriate business records, complying with legal requirements and responding to lawful requests.
  • Communications: sending essential service notices and, where legally permitted or consented to, marketing communications.

5. Legal bases for processing

We rely on one or more of the following legal bases under the GDPR, depending on the circumstances:

  • Contract: processing necessary to provide the service you requested or to take steps before entering into a contract.
  • Legal obligation: processing necessary to comply with applicable law.
  • Legitimate interests: processing necessary for purposes such as platform security, fraud prevention, service administration and improvement, provided those interests do not override your rights.
  • Consent: processing based on your consent, including where required for non-essential cookies or certain marketing activities.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. How we share personal data

We do not sell your personal data.

We may share personal data with the following categories of recipients where necessary:

6.1 Service providers

We use Lovable Cloud for the application's backend and database. We also use Google OAuth when a user chooses to sign in with Google, and Google Search Console for search-performance reporting. Stripe processes transactions as described below.

Other providers may be involved in operating, securing or supporting the platform where enabled in the live configuration. The specific providers and processing activities may change as the Service develops. Where required, we put appropriate contractual and data protection arrangements in place with providers processing personal data on our behalf.

6.2 Stripe

Stripe processes payment and billing information, including as merchant of record for eligible transactions. It may also process information necessary for payment verification, subscription management, refunds, tax compliance, fraud prevention and customer support.

Stripe's own privacy documentation explains its processing of buyer information.

6.3 Affiliate programme participants

We may share limited information with affiliates or affiliate programme providers where necessary to attribute referrals, administer commissions, prevent fraud or resolve disputes. We aim to limit such information to what is necessary and will not disclose your private account details or communications to affiliates merely because you used their referral link.

6.4 Professional advisers and authorities

We may disclose information to accountants, legal advisers, regulators, law enforcement agencies or other authorities when legally required or reasonably necessary to protect our rights, users or business.

6.5 Business transfers

If our business or relevant assets are transferred, merged or reorganised, personal data may be transferred as part of that transaction, subject to applicable data protection law.

7. International data transfers

Some service providers may process personal data outside the European Economic Area (EEA).

Where personal data is transferred to a country without an applicable adequacy decision, we will rely on an appropriate transfer mechanism where required, such as Standard Contractual Clauses, together with any supplementary safeguards that may be necessary.

Further information about relevant safeguards can be requested using the contact details in this Policy.

8. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

In general:

  • Account information is retained while your account is active and for a reasonable period afterward where necessary for security, dispute resolution or legal compliance.
  • Subscription and transaction records are retained for applicable accounting, tax and legal retention periods.
  • Affiliate records are retained for the administration, verification and settlement of commissions and for any applicable legal or dispute-related requirements.
  • Support communications are retained for as long as necessary to address the relevant issue and maintain appropriate records.
  • Technical logs are retained for a period appropriate to security, troubleshooting and operational needs.

When information is no longer necessary, we will delete it or anonymise it where reasonably practicable, subject to applicable legal obligations.

9. Cookies and similar technologies

The specific cookies, local-storage entries or similar technologies used by Crossbound depend on the live website configuration. We do not claim that a particular cookie or analytics technology is installed unless that has been verified.

Authentication, session management, security, preferences or referral attribution may rely on technical storage mechanisms where implemented. Affiliate attribution is intended to use referral identifiers and account-level or database records; this Policy does not assume that attribution depends on cookies.

Google Search Console is used for search-performance reporting. Its use alone does not establish that Google Analytics or analytics cookies are installed on Crossbound.

Where applicable law requires consent for non-essential cookies or similar technologies, we will request that consent before using them. You may also be able to manage storage through your browser settings. Blocking technologies that are necessary for a particular feature may affect that feature.

10. Your rights

Subject to applicable law, you may have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete information.
  • Request deletion of your personal data.
  • Restrict certain processing activities.
  • Object to processing based on legitimate interests.
  • Receive certain personal data in a portable format.
  • Withdraw consent where processing relies on consent.
  • Lodge a complaint with a competent data protection authority.

To exercise your rights, contact legal@reachingexpatations.com. We may request information necessary to verify your identity before responding.

We will respond within the time limits required by applicable law.

In the Netherlands, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

11. Account deletion

You may request the deletion of your Crossbound account by contacting us at legal@reachingexpatations.com or through an available account-management feature.

Deleting your account does not necessarily erase all information immediately. We may retain records where necessary to comply with legal obligations, maintain accounting records, resolve disputes, prevent fraud or establish, exercise or defend legal claims.

Any active subscription should be cancelled separately where required to prevent further billing. Subscription billing and cancellation are subject to the applicable purchase and subscription terms.

12. Data security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

However, no online service or method of electronic storage can be guaranteed to be completely secure.

If a personal data breach occurs, we will take the steps required by applicable data protection law.

13. Children's privacy

Crossbound is not intended for children who are legally unable to enter into the relevant service contract without the required consent or authorisation.

We do not knowingly collect personal data from children in circumstances where doing so would be unlawful. If you believe a child has provided personal data inappropriately, please contact us so we can assess the situation.

14. Changes to this Privacy Policy

We may update this Policy to reflect changes to Crossbound, our service providers, our processing activities or applicable law.

The latest version will be published on Crossbound.eu with its updated date. Where required by law, we will provide additional notice or obtain consent for material changes.

15. Contact

For questions, complaints or requests concerning this Privacy Policy or your personal data, contact:

Reaching Expatations
Email: legal@reachingexpatations.com
Keurenplein 41, Unit C3127
1069 CD Amsterdam, The Netherlands

Back to top ↑