This policy explains how we collect, use, store, and protect your personal data, and the rights you hold. It is written to align with the EU GDPR, the UK GDPR, and comparable regimes (including the CCPA/CPRA for California residents); where local law grants you stronger rights, that law prevails.

1. What we collect

1. Data you give us: order details needed to process your subscription payment; billing entity name and tax ID when you request an invoice; the contact details you leave in a support ticket.
2. Account data: identifiers such as your email address collected at registration and login, and your API keys (stored as hashes only, never in plaintext).
3. Data collected automatically: device and browser data (user agent, screen size, language), access logs (IP, timestamp, referrer), and cookie / similar-technology identifiers.
4. We do not collect sensitive personal data unrelated to the service, and we do not ask you for identity-document photos unless the law explicitly requires it.

2. How we collect it

1. Directly, through forms you complete and files you upload on this site.
2. Automatically, through cookies, local storage, and server access logs, for availability and security.
3. From the payment provider's webhook (order id, amount, timestamp). We never receive your full card number or your payment password.

3. Why we use it

1. To perform our contract with you: provision and deliver your data subscription, maintain API quota, issue invoices, process refunds.
2. For our legitimate interests: abuse and anomaly screening, fraud prevention, and cooperating with lawful requests from authorities.
3. For security and operations: detecting and handling scrapers, credential-stuffing, and fraudulent activity.
4. On a de-identified basis: publishing aggregate platform statistics such as subscription counts and API volume. This aggregate data is not personal data.
5. We do not use your personal data for automated marketing decisions, and we do not send you marketing unrelated to this service.

4. Sharing, processors & disclosure

1. We do not sell your personal data. We do not "share" it for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA.
2. We use a limited set of processors strictly on a need-to-know basis: the merchant-of-record (MoR) payment provider, the cloud hosting provider, and the invoicing provider. Each is bound by a data-processing agreement and may not use the data for its own purposes.
3. Public board data: entry names, URLs, and public signal figures (star / fork counts) are public by default on the leaderboard — sourced from public materials, not from your account. Your subscription status, billing, and API usage are never published.
4. We may disclose data where legally required, in response to a valid judicial or regulatory request, or where necessary to protect life, health, or property.

5. Retention & location

1. Our primary processing region is the European Economic Area. Where we transfer personal data outside the EEA — for example to a processor in another region — we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses, together with supplementary technical measures.
2. Retention: order and invoice records for at least 3 years (tax and e-commerce record-keeping duties); access logs for at least 6 months; API call logs for 12 months.
3. Once a retention period ends, we delete or anonymise the personal data.

6. Your rights

1. Access & portability: request a copy of the personal data we hold about you, in a structured, machine-readable format.
2. Rectification: correct inaccurate data.
3. Erasure: request deletion where a lawful ground applies (purpose fulfilled, consent withdrawn, or unlawful processing).
4. Restriction & objection: restrict or object to processing based on our legitimate interests, including profiling.
5. Withdraw consent: withdraw any consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
6. Lodge a complaint: with your local supervisory authority (in the EU/UK, your national data-protection authority).
7. To exercise these rights, open a support ticket. We respond within 30 days, extendable by a further 60 days for complex requests, with notice.

7. Minors

1. This service is aimed at businesses and is not directed at children. We do not knowingly collect data from children under 16 (EEA/UK) or under 13 (US).
2. If you are a minor in your jurisdiction, please review this policy with a parent or guardian and obtain their consent before using the service.
3. If we learn we collected a minor's data without the required consent, we will delete it promptly.

8. Contact & complaints

1. For any privacy question or request, open a support ticket or email privacy@example.com. We respond within 30 days.
2. If you are unsatisfied, you may complain to your local data-protection supervisory authority.
3. Last updated: 2026-09-21. Material changes are announced on-site at least 7 days in advance.