Website privacy
Your privacy.
This notice covers finalsteplabs.com and correspondence sent to our company contact address. It does not cover personal data processed within Billuno.
Updated 7 October 2026
Who is responsible
FINAL STEP EOOD („ФИНАЛ СТЕП“ ЕООД), operating as Final Step Labs, is the controller of the personal data described here. Our Bulgarian company registration number (EIK/UIC) is 208893630. Our registered office is 16 Tsarkovna Nezavisimost St., floor 2, office 9, Ruse 7000, Bulgaria.
For privacy questions or requests, email contact@finalsteplabs.com or write to our registered office.
Visiting the website
The site consists of static pages, with fonts and images served from our own domain. It has no accounts, contact forms, advertising trackers or analytics scripts.
Cloudflare is our selected hosting and security provider. Delivering pages and protecting the service involves processing technical request data, such as your IP address, requested URL, request time, browser information and security signals. We may use the traffic and security information available in Cloudflare to investigate errors or abuse. Our legal basis is our legitimate interest in operating a reliable, secure website (Article 6(1)(f) GDPR).
Cookies and browser storage
Our site code does not set cookies or use browser storage. Cloudflare may use security cookies when checking traffic or presenting a security challenge. For example, cf_clearance records a successful check; the currently configured challenge-passage period is 30 minutes. Where bot protection uses __cf_bm, Cloudflare documents expiry after 30 minutes of inactivity. These serve security purposes, not advertising.
You can manage cookies in your browser, although blocking security cookies may cause repeated checks or prevent access. See Cloudflare’s security-cookie information.
When you email us
We process your email address, any name you provide, message content, attachments and correspondence metadata to read and answer your enquiry. Providing this information is voluntary, but we may be unable to respond without contact details and enough information about your request. Please include only what is necessary.
For ordinary enquiries, our legal basis is our legitimate interest in managing company correspondence (Article 6(1)(f) GDPR). Where you ask us to take steps towards a contract with you, or correspondence is needed to perform that contract, Article 6(1)(b) applies. We may also retain relevant records to meet legal obligations (Article 6(1)(c)) or establish, exercise or defend legal claims (Article 6(1)(f)).
Zoho Mail hosts our mailbox in its European data-centre region. Authorised people use email software to read and reply to correspondence. A European mailbox does not mean that all processing by every service takes place only in Europe.
Who receives data and international transfers
Our hosting, email and correspondence-service providers process the data needed to provide their services. Authorised people handling enquiries may access relevant messages. Where necessary, we may also share relevant records with professional advisers or authorities to meet legal obligations or handle claims. We do not sell your personal data.
Our hosting and email-service providers use international operations and service providers, which can involve processing outside the European Economic Area, including in the United States. Depending on the provider and destination, safeguards include European Commission adequacy decisions or Standard Contractual Clauses. You can contact us for information about the safeguards applicable to your data and how to obtain a copy.
Provider information: Cloudflare privacy policy, Cloudflare data processing terms and Zoho privacy policy. Providers may also process some data for their own service-security or legal purposes, as explained in their policies.
How long we keep data
We keep correspondence while an enquiry remains active or there is a specific continuing need for the record. Every six months, we review closed conversations and delete those no longer needed. Contractual records, legally required records and material needed for claims are kept separately for the applicable obligation or claim period, then deleted when no longer required. This review also covers copies and working material under our control.
Cloudflare currently documents 31 days of history for the HTTP-request and security-event analytics datasets on our Free plan. We have not enabled the Logpush service to export these logs to separate storage. This dashboard history period is not a deletion deadline for all information held by Cloudflare: its service and network-security records follow its own retention criteria, including the time needed to provide services, investigate abuse, meet legal obligations and resolve disputes. See Cloudflare’s data-retention policy.
Deletion from active services may not immediately remove protected backup copies; these remain subject to the provider’s backup and deletion procedures.
Your rights
Depending on the circumstances, you can request access, correction, erasure or restriction of your personal data. You may also have a right to data portability where processing is automated and based on consent or a contract. If we rely on consent for any optional processing, you can withdraw it at any time without affecting earlier lawful processing.
You can object to processing based on legitimate interests on grounds relating to your situation. We will assess your request and stop that processing unless we have overriding compelling grounds or need the data for legal claims.
Send requests to contact@finalsteplabs.com. We normally respond within one month. If the law permits an extension, we will explain it within that month. We may ask for proportionate information to confirm your identity.
You can complain to the Bulgarian Commission for Personal Data Protection or a supervisory authority in the country where you live or work, or where an alleged infringement took place. You do not have to contact us first.
We do not use this website or company correspondence to make solely automated decisions with legal or similarly significant effects on you.
Changes and product privacy
We will update this page when our handling of personal data changes and show the revision date above. Billuno’s account, expense and receipt processing is outside this notice and will be described in its own privacy information before public access is offered here.