Privacy policy

Information under art. 13 of the EU General Data Protection Regulation (GDPR). Last updated: [DATE]

Who is responsible

The data controller is [FIRST AND LAST NAME OF THE OWNER]. Contact: [PROJECT EMAIL].

What data we process

• Your row: row number, codename, anomaly and time of publication. You choose to make them public; please do not put your real name or anyone's personal data in them.
• Order data: a Stripe payment reference, a random order code and the number of reports received by the row. They are not public.
• Payment data: processed by Stripe (see below). We do not receive your card number. In the Stripe dashboard we can see limited payment details such as amount, date, last 4 digits, brand and country of the card and, for Apple Pay payments, the name on the card, which Apple Pay shares with Stripe. We never copy these details into the Ledger.
• Technical data: IP address and browser data, processed by Cloudflare to deliver the site and protect it from attacks and bots. We do not store them in our database.
• Cookies: we do not use advertising, analytics or profiling cookies. On the payment step Stripe sets technical cookies to prevent fraud.

Why, and on what legal basis

• Publishing your row and processing your payment: performance of the contract (art. 6(1)(b) GDPR).
• Moderation, security, fraud prevention: our legitimate interest in keeping the service safe and lawful (art. 6(1)(f)).
• Keeping payment records when the law requires it: legal obligation (art. 6(1)(c)).

Who receives the data

• Cloudflare (hosting, database, security), as our processor.
• Stripe (payments), which processes payment data also as an independent controller under its own privacy policy: stripe.com/privacy.
• Anyone on the internet can read the public rows of the Ledger.

Cloudflare and Stripe may process data outside the EU, including in the United States, with the safeguards required by the GDPR (EU-US Data Privacy Framework or standard contractual clauses).

How long

Public rows stay in the Ledger for as long as it exists, unless they are redacted. Order and payment data are kept for as long as needed to manage the purchase and for the period required by law.

Your rights

You can ask for access to your data, its correction or erasure, restriction of or objection to processing, and portability. If you ask for erasure of a row, its codename and anomaly are replaced by [REDACTED BY THE CURATOR]. Because we do not know who you are, write to [PROJECT EMAIL] with the row number and the date and last 4 digits of the card used, so we can match the request to the payment. You can also lodge a complaint with a supervisory authority, in Italy the Garante per la protezione dei dati personali (garanteprivacy.it).

Children

The service is not intended for children under 14.