This notice explains what personal data zuzuzu processes and why, under the EU General Data Protection Regulation (GDPR). It is a working draft.
controller
The controller responsible for this processing is [registered name and address]. See the imprint for full details. Contact for privacy matters: [privacy contact email].
what we process
- Session cookies — an anonymous, signed creator and receiver identifier so links and results work without an account.
- Age-gate cookie — records that you confirmed you meet the 18+ age requirement.
- Link content you create — sender name, chosen options, and an optional short note.
- Responses — the choices a receiver taps and the generated result.
- Hashed IP prefix — we do not store raw IP addresses; we store a salted one-way hash of an IP prefix for abuse-prevention and rate-limiting only.
- Optional email — only if you ask to be notified when someone answers your link.
- Product analytics — anonymous usage events to understand the flow (only if analytics is enabled).
legal bases (Art. 6 GDPR)
- Providing the service you requested — Art. 6(1)(b) (performance of a contract / pre-contractual steps).
- Abuse prevention, security, and rate-limiting — Art. 6(1)(f) (legitimate interests).
- Optional email notifications and non-essential analytics — Art. 6(1)(a) (consent), where required.
processors we use
- Vercel — hosting and content delivery.
- Neon — database (EU region, Frankfurt).
- PostHog — product analytics (if enabled).
- Resend — transactional email (if you opt in).
Each processor acts under a data-processing agreement. Where a processor transfers data outside the EU/EEA, transfers rely on [Standard Contractual Clauses / adequacy decision — confirm per processor].
retention
- Active links and responses: about 30 days, then removed.
- Security and abuse logs: a short, limited period.
- Moderation evidence (where a report is made): [confirm retention with lawyer].
your rights
You have the right to access, rectify, erase, restrict, and port your data, and to object to processing based on legitimate interests. To exercise any of these, contact [privacy contact email]. You also have the right to lodge a complaint with a supervisory authority (in Germany, the data-protection authority of your federal state).
age
zuzuzu is intended for people aged 18 and over. We do not knowingly process data from anyone below the applicable age of digital consent.
This draft is not legal advice. A qualified lawyer must review and finalize it before zuzuzu processes real users' data.