Draft. This document has not yet been reviewed by an attorney and may change.
GDPR Notice
This notice is for people in the European Economic Area, the United Kingdom and Switzerland. It adds to our Privacy Policy, which describes what we collect.
Controller
The controller of your personal data is Friends of Play and Prosper LLC, a New Hampshire limited liability company. Contact: privacy@counthis.app.
Legal bases
| What we do | Data | Legal basis |
|---|---|---|
| Count badge views once per visitor and filter bots | IP address and user agent, reduced in memory to a temporary scrambled number; network operator | Legitimate interests (Art. 6(1)(f)): accurate counts and protecting the Service. The data is never stored on disk by our software and is discarded after six hours. |
| Run your account, counters and subscription | Email address, claimed names, counters, sign-in records | Contract (Art. 6(1)(b)) |
| Take payments and keep accounting records | Stripe subscription records; XRP Ledger address and transaction identifiers | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Prevent abuse and secure the Service | Rate-limit state, sign-in network, proxy access logs | Legitimate interests (Art. 6(1)(f)) |
We do not use your data for automated decisions with legal or similarly significant effects, and we do not profile you for advertising.
Visitors who view a badge
If you view a page that shows a counthis badge, the site owner chose to embed it; we process your request only as described above to count the view. We do not set cookies on badge requests and cannot link your views across sites, because the scrambling key is held only in memory and changes on every restart.
Your rights
You have the right to access, rectify and erase your personal data, to restrict or object to processing, and to data portability. Where we rely on legitimate interests you may object at any time. To use these rights, email privacy@counthis.app; we will respond within one month. Because we keep viewer data only in memory for six hours, we cannot retrieve or identify a viewer's past views.
You also have the right to lodge a complaint with your local data protection authority.
International transfers
We are located in the United States, and our servers and service providers are mainly there. Transfers of personal data from the EEA, UK and Switzerland rely on the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) with our providers, or on another lawful transfer mechanism where available.
Retention
See "How long we keep it" in the Privacy Policy.
Representative
Where the law requires us to appoint a representative in the EU or UK, we will name them here.