peerpush.com privacy policy — score 55/100 (medium risk)
Dernière analyse
Le contenu du rapport (résumé, constats, citations) a été généré en anglais et n'est pas localisé.
PeerPush · peerpush.com
Détails du rapport
medium risquePeerPush has strong anonymization practices for its public analytics but falls short on GDPR basics by failing to disclose legal bases, lacking an EU representative, and using vague language around international data transfers.
The policy reflects a product-focused approach to privacy, particularly excelling in its 'Signals' feature which implements k-anonymity and PII stripping. However, it reads more like a US-centric policy than a GDPR-compliant one. It completely omits the legal bases for processing, fails to mention Standard Contractual Clauses or other transfer mechanisms, and provides an incomplete catalog of user rights. The children's privacy section relies on the COPPA standard (13 years) rather than the GDPR standard (16 years).
Évaluation par catégorie
Répartition de la politique selon les principaux domaines de conformité. Bon = solide, moyen = mitigé, faible = préoccupant.
Collects primarily necessary data for the service and explicitly avoids third-party advertising cookies or tracking pixels.
Clearly explains the 'Boost' system and 'Signals' analytics, but completely omits the legal bases for processing as required by GDPR.
Sharing is limited to essential service providers (hosting, auth, email) and public user-generated content, with no ad-tech sharing.
Mentions transfers occur but provides zero specifics on the destination countries or the legal safeguards and mechanisms used.
The policy is silent on whether user data is used to train PeerPush's own AI models, though it details how AI agent traffic is tracked in analytics.
Omits key GDPR rights (portability, objection, restriction), provides no formal process or timeline for requests, and lacks an EU representative contact.
Constats clés
Clauses notables, problèmes ou bonnes pratiques identifiées (critiques en premier)
Missing Legal Bases for Processing
The policy details what data is collected and how it is used, but completely fails to state the legal basis for processing (such as consent, contract performance, or legitimate interest) as required by GDPR Article 13(1)(c).
Vague International Transfer Mechanisms
Section 10 states that data may be transferred internationally and that 'appropriate safeguards' are in place, but it does not specify the actual legal mechanism (e.g., Standard Contractual Clauses, adequacy decisions) or the destination countries, leaving EU users uninformed.
Incomplete User Rights Catalog
Section 7 lists access and deletion but omits other mandatory GDPR rights, specifically the right to restrict processing, the right to data portability, and the right to object. It also fails to provide a clear timeline or dedicated contact method for exercising these rights.
US-Centric Children's Privacy Standard
Section 11 sets the age threshold at 13, aligning with US COPPA rules, but disregards the GDPR standard which generally requires parental consent for children under 16 (or 13-16 depending on the member state).
Strong Anonymization in Public Analytics
Section 9 outlines robust privacy-preserving measures for the 'Signals' feature, including k-anonymity (hiding rows with fewer than 5 visitors), automated PII stripping from search queries, and daily rotation of anonymous identifiers.
Synthèse pour l'utilisateur
Your data is generally safe from ad trackers and public exposure thanks to clever anonymization, but you lack the full suite of GDPR protections, and your data might leave the EU without robust legal safeguards.
Posture de conformité
Partial compliance. Strong on data minimization for analytics and security, but fundamentally deficient in GDPR transparency requirements (legal basis, transfer mechanisms, full rights catalog, DPO/Representative).
Transferts UE
Inadequate. The policy admits data may be transferred internationally but fails to name the destination countries or the legal mechanisms (like SCCs or adequacy decisions) used to protect the data, violating GDPR Articles 13(1)(f) and 46.
Signaux détectés
Données et pratiques spécifiques identifiées dans le texte
Extraits probants
Citations directes de la politique à l'appui de ces constats
Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.
Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.
We never publish a row backed by fewer than 5 distinct visitors. Below that floor, the row is hidden.
Product submissions: Retained indefinitely once published
Manquant ou flou
- Legal bases for processing (consent, contract, legitimate interest)
- Specific international transfer mechanisms (SCCs, BCRs, adequacy)
- EU representative designation
- Data Protection Officer (DPO) contact details
- Right to object, restrict processing, and data portability
- Retention periods for click tracking and IP address data
Questions à poser
- What specific legal mechanisms (e.g., Standard Contractual Clauses) do you rely on for international data transfers outside the EEA?
- What is the legal basis (consent, legitimate interest, contract) for processing IP addresses and click tracking data for the Boost system?
- How can EU users exercise their right to data portability and the right to object to processing, which are missing from your policy?
- Who acts as your EU representative under GDPR Article 27, given that you process EU user data?
- What is the specific retention period for raw click tracking data and IP addresses used in fraud prevention?
Partager cette analyse
Toute personne disposant de ce lien peut consulter le résultat ci-dessus.
Conçu par DentroChat
Chat IA 100 % européen pour tous
Discutez avec l'IA, travaillez avec des fichiers, générez des images et cherchez sur le web. Les données restent en Europe.