peerpush.com privacy policy — score 55/100 (medium risk)
Último análisis
El contenido del informe (resumen, hallazgos, citas) se generó en inglés y no está localizado.
PeerPush · peerpush.com
Detalles del informe
medium riesgoPeerPush has strong anonymization practices for its public analytics but falls short on GDPR basics by failing to disclose legal bases, lacking an EU representative, and using vague language around international data transfers.
The policy reflects a product-focused approach to privacy, particularly excelling in its 'Signals' feature which implements k-anonymity and PII stripping. However, it reads more like a US-centric policy than a GDPR-compliant one. It completely omits the legal bases for processing, fails to mention Standard Contractual Clauses or other transfer mechanisms, and provides an incomplete catalog of user rights. The children's privacy section relies on the COPPA standard (13 years) rather than the GDPR standard (16 years).
Evaluación por categoría
Desglose de la política en las principales áreas de cumplimiento. Bueno = sólido, regular = mixto, deficiente = preocupante.
Collects primarily necessary data for the service and explicitly avoids third-party advertising cookies or tracking pixels.
Clearly explains the 'Boost' system and 'Signals' analytics, but completely omits the legal bases for processing as required by GDPR.
Sharing is limited to essential service providers (hosting, auth, email) and public user-generated content, with no ad-tech sharing.
Mentions transfers occur but provides zero specifics on the destination countries or the legal safeguards and mechanisms used.
The policy is silent on whether user data is used to train PeerPush's own AI models, though it details how AI agent traffic is tracked in analytics.
Omits key GDPR rights (portability, objection, restriction), provides no formal process or timeline for requests, and lacks an EU representative contact.
Hallazgos clave
Cláusulas destacadas, problemas o buenas prácticas detectadas (críticos primero)
Missing Legal Bases for Processing
The policy details what data is collected and how it is used, but completely fails to state the legal basis for processing (such as consent, contract performance, or legitimate interest) as required by GDPR Article 13(1)(c).
Vague International Transfer Mechanisms
Section 10 states that data may be transferred internationally and that 'appropriate safeguards' are in place, but it does not specify the actual legal mechanism (e.g., Standard Contractual Clauses, adequacy decisions) or the destination countries, leaving EU users uninformed.
Incomplete User Rights Catalog
Section 7 lists access and deletion but omits other mandatory GDPR rights, specifically the right to restrict processing, the right to data portability, and the right to object. It also fails to provide a clear timeline or dedicated contact method for exercising these rights.
US-Centric Children's Privacy Standard
Section 11 sets the age threshold at 13, aligning with US COPPA rules, but disregards the GDPR standard which generally requires parental consent for children under 16 (or 13-16 depending on the member state).
Strong Anonymization in Public Analytics
Section 9 outlines robust privacy-preserving measures for the 'Signals' feature, including k-anonymity (hiding rows with fewer than 5 visitors), automated PII stripping from search queries, and daily rotation of anonymous identifiers.
Resumen para el usuario
Your data is generally safe from ad trackers and public exposure thanks to clever anonymization, but you lack the full suite of GDPR protections, and your data might leave the EU without robust legal safeguards.
Postura de cumplimiento
Partial compliance. Strong on data minimization for analytics and security, but fundamentally deficient in GDPR transparency requirements (legal basis, transfer mechanisms, full rights catalog, DPO/Representative).
Transferencias en la UE
Inadequate. The policy admits data may be transferred internationally but fails to name the destination countries or the legal mechanisms (like SCCs or adequacy decisions) used to protect the data, violating GDPR Articles 13(1)(f) and 46.
Señales detectadas
Datos y prácticas específicas identificadas en el texto
Fragmentos de evidencia
Citas directas de la política que respaldan estos hallazgos
Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.
Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.
We never publish a row backed by fewer than 5 distinct visitors. Below that floor, the row is hidden.
Product submissions: Retained indefinitely once published
Ausente o poco claro
- Legal bases for processing (consent, contract, legitimate interest)
- Specific international transfer mechanisms (SCCs, BCRs, adequacy)
- EU representative designation
- Data Protection Officer (DPO) contact details
- Right to object, restrict processing, and data portability
- Retention periods for click tracking and IP address data
Preguntas que hacer
- What specific legal mechanisms (e.g., Standard Contractual Clauses) do you rely on for international data transfers outside the EEA?
- What is the legal basis (consent, legitimate interest, contract) for processing IP addresses and click tracking data for the Boost system?
- How can EU users exercise their right to data portability and the right to object to processing, which are missing from your policy?
- Who acts as your EU representative under GDPR Article 27, given that you process EU user data?
- What is the specific retention period for raw click tracking data and IP addresses used in fraud prevention?
Compartir este análisis
Cualquiera con este enlace puede ver el resultado anterior.
Creado por DentroChat
Chat de IA 100 % europeo para todos
Chatea con la IA, trabaja con archivos, genera imágenes y busca en la web. Los datos permanecen en Europa.