Privacy notice
How personal data is processed.
Controller
The controller is the sole proprietor identified in the legal notice. Final contact details must be configured before publication.
Data and purposes
We process account email/authentication, uploaded file and metadata, salted or truncated IP hashes for abuse prevention, necessary sessions, and notice-form details. Final legal bases must be reviewed against the actual service.
Providers and transfers
Supabase, storage, hosting, backup and anti-abuse providers are named only after contract, region and transfer review. EU operation is the target; every non-EU transfer must be assessed and documented.
Cloudflare Turnstile
Cloudflare Turnstile is intended to protect anonymous uploads from abuse. Verification tokens, IP address, browser and device information may be sent to Cloudflare. It is enabled in production only after its contract, data fields, retention and possible third-country transfers have been documented and accepted; otherwise an EU-operable alternative must replace it.
Retention
Anonymous files expire after 30 days. Failed quarantine objects are removed after 24 hours and rate-limit hashes after about two hours. Closed notice and deletion records are generally retained for 180 days unless legal preservation requires longer. Provider log and backup periods must be documented before launch.
Your rights
You may request access, correction, deletion, restriction, portability or object, withdraw consent, and complain to the competent data protection authority.
Cookies and measurement
Only necessary authentication/session cookies are used. There are no marketing, advertising or product analytics scripts. Search Console requires no embedded visitor analytics script.
Competent supervisory authority
The data protection authority competent for the operator’s actual registered address will be verified and named here before launch where legally required.