Privacy Policy

At VeriPadel, we take user privacy seriously. This policy explains what data we collect, how we use it, and what your rights are.

1. Data we collect

User account (optional)

If you create an account, we store:

• Email address — to identify you and send price alerts if you set them up.
• Name — if you sign in via Google OAuth, we receive your profile name.
• Session data — we store sessions in our database (no JWT). Sessions expire after 30 days of inactivity.

Affiliate click tracking

When you click a link that redirects you to an external store, we record:

• Anonymized IP hash — we use HMAC-SHA256 with a secret key. We do not store your actual IP address, only an irreversible hash for click fraud detection.
• Destination URL and store — for statistical purposes.
• Referrer page — the VeriPadel page you clicked from.

Web analytics

We use Umami Analytics, a privacy-focused analytics solution:

• No cookies are used.
• No personally identifiable information (PII) is collected.
• Data is stored anonymously and in aggregate.

Error tracking

We use Sentry to detect and fix technical errors:

• It captures technical browser information (type, version, operating system).
• No personally identifiable data is collected.
• Data is used exclusively to improve service stability.

2. How we use your data

• Price alerts: If you set up an alert, we send you an email when a product's price drops to your target.
• Affiliate: Anonymized clicks help us measure the effectiveness of our service.
• Service improvement: Analytics and error tracking help us improve VeriPadel.

3. Data sharing

We do not sell or share your personal data with third parties, except:

• Service providers: We use third-party services for email (Resend), analytics (Umami), and error tracking (Sentry). These providers process data on our behalf and are subject to their own privacy policies.
• Legal requirement: If required by law to disclose information.

4. Data retention

• User accounts: Your data is retained as long as your account is active. You can request deletion at any time.
• Click data: IP hashes are retained for 90 days for fraud detection.
• Analytics: Aggregated Umami data does not contain personal information.

5. Your rights (GDPR)

As a user in the European Union, you have the right to:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate data.
• Erasure: Request deletion of your account and associated data.
• Portability: Receive your data in a structured format.
• Objection: Object to the processing of your data.

To exercise these rights, contact us at contact.ruben.business@gmail.com.

6. Security

We implement security measures including:

• Encryption in transit (HTTPS/TLS).
• Irreversible IP hashing (HMAC-SHA256).
• Sessions with automatic expiry.
• Security headers (X-Frame-Options, CSP, HSTS).

7. Changes to this policy

We reserve the right to update this policy. The last updated date is shown at the bottom of the page. Significant changes will be communicated by email to registered users.

8. Contact

If you have questions about this privacy policy, contact us at contact.ruben.business@gmail.com.