Privacy policy

Who is responsible

The controller for this site is TODO_OWNER, TODO_OWNER. For anything about your data, write to privacy@crisiscart.com.

The test

Your answers to the test are processed in your browser and are never sent to us. When you open or share your result, its link contains a short code with the result only: rank, overall percent, days covered, the six scenario scores and the "self-assessed" mark. It contains no country, household size, names or answers. Our server reads the code to draw the result page and the picture and does not store it. Anyone who has the link can see that result.

The waitlist

If you join the waitlist, we store a random entry ID, your email address (trimmed and in lower case), the language you chose, a SHA-256 hash of the confirmation link token (not the token itself) and four timestamps: when the entry was created, when the last letter was sent, when the confirmation link expires and when you confirmed. We use this only to confirm the address and to write to you when the app is released. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

How long we keep it

The confirmation link works for 7 days. Addresses that nobody confirms are deleted after 30 days. Confirmed addresses are kept until you withdraw your consent or ask us to delete them. There is no unsubscribe link yet, so simply write to privacy@crisiscart.com and we will delete your address.

Who processes data for us

We use these service providers, only for the tasks named here:

• Hosting provider (OVH SAS), data centre in Milan, Italy: runs the server with the site and the waitlist database, and processes technical request data, such as your IP address in server logs.
• Resend, Inc. (USA): sends the confirmation letter and, later, the launch letter. For this, your email address is transferred to the USA under the EU Standard Contractual Clauses in Resend's data processing agreement.

Technical data

To keep the waitlist and the picture service from being flooded, the server counts requests per IP address in its working memory, for at most 10 minutes per request; older entries are no longer used and are removed soon after. This count is not written to the database or to files and disappears when the server restarts.

Cookies and third parties

The only cookie is "locale". It remembers the language you picked, for one year, and is not used for tracking. There is no analytics, no advertising and no third-party scripts. Fonts are served from this site, so your browser does not contact Google Fonts.

Your rights

Under the GDPR you can ask for access to your data, its correction or deletion, restriction of processing and data portability, and you can object to processing. You can withdraw your consent at any time. Write to privacy@crisiscart.com. You also have the right to lodge a complaint with a data protection supervisory authority.

Changes

If this policy changes, we will update it here and change the date at the top.