peerpush.com privacy policy — score 55/100 (medium risk)
Zadnja analiza
Sadržaj izvješća (sažetak, nalazi, citati) generiran je na engleskom i nije lokaliziran.
PeerPush · peerpush.com
Detalji izvještaja
medium rizikPeerPush has strong anonymization practices for its public analytics but falls short on GDPR basics by failing to disclose legal bases, lacking an EU representative, and using vague language around international data transfers.
The policy reflects a product-focused approach to privacy, particularly excelling in its 'Signals' feature which implements k-anonymity and PII stripping. However, it reads more like a US-centric policy than a GDPR-compliant one. It completely omits the legal bases for processing, fails to mention Standard Contractual Clauses or other transfer mechanisms, and provides an incomplete catalog of user rights. The children's privacy section relies on the COPPA standard (13 years) rather than the GDPR standard (16 years).
Procjena po kategorijama
Razrada politike po ključnim područjima usklađenosti. Dobro = snažno, umjereno = mješovito, loše = zabrinjavajuće.
Collects primarily necessary data for the service and explicitly avoids third-party advertising cookies or tracking pixels.
Clearly explains the 'Boost' system and 'Signals' analytics, but completely omits the legal bases for processing as required by GDPR.
Sharing is limited to essential service providers (hosting, auth, email) and public user-generated content, with no ad-tech sharing.
Mentions transfers occur but provides zero specifics on the destination countries or the legal safeguards and mechanisms used.
The policy is silent on whether user data is used to train PeerPush's own AI models, though it details how AI agent traffic is tracked in analytics.
Omits key GDPR rights (portability, objection, restriction), provides no formal process or timeline for requests, and lacks an EU representative contact.
Ključni nalazi
Značajne klauzule, problemi ili dobre prakse (kritično prvo)
Missing Legal Bases for Processing
The policy details what data is collected and how it is used, but completely fails to state the legal basis for processing (such as consent, contract performance, or legitimate interest) as required by GDPR Article 13(1)(c).
Vague International Transfer Mechanisms
Section 10 states that data may be transferred internationally and that 'appropriate safeguards' are in place, but it does not specify the actual legal mechanism (e.g., Standard Contractual Clauses, adequacy decisions) or the destination countries, leaving EU users uninformed.
Incomplete User Rights Catalog
Section 7 lists access and deletion but omits other mandatory GDPR rights, specifically the right to restrict processing, the right to data portability, and the right to object. It also fails to provide a clear timeline or dedicated contact method for exercising these rights.
US-Centric Children's Privacy Standard
Section 11 sets the age threshold at 13, aligning with US COPPA rules, but disregards the GDPR standard which generally requires parental consent for children under 16 (or 13-16 depending on the member state).
Strong Anonymization in Public Analytics
Section 9 outlines robust privacy-preserving measures for the 'Signals' feature, including k-anonymity (hiding rows with fewer than 5 visitors), automated PII stripping from search queries, and daily rotation of anonymous identifiers.
Sažetak za korisnika
Your data is generally safe from ad trackers and public exposure thanks to clever anonymization, but you lack the full suite of GDPR protections, and your data might leave the EU without robust legal safeguards.
Stav usklađenosti
Partial compliance. Strong on data minimization for analytics and security, but fundamentally deficient in GDPR transparency requirements (legal basis, transfer mechanisms, full rights catalog, DPO/Representative).
EU prijenosi
Inadequate. The policy admits data may be transferred internationally but fails to name the destination countries or the legal mechanisms (like SCCs or adequacy decisions) used to protect the data, violating GDPR Articles 13(1)(f) and 46.
Otkriveni signali
Specifični podaci i prakse utvrđene u tekstu
Dokazni isječci
Izravni citati iz politike koji podupiru ove nalaze
Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.
Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.
We never publish a row backed by fewer than 5 distinct visitors. Below that floor, the row is hidden.
Product submissions: Retained indefinitely once published
Nedostaje ili nije jasno
- Legal bases for processing (consent, contract, legitimate interest)
- Specific international transfer mechanisms (SCCs, BCRs, adequacy)
- EU representative designation
- Data Protection Officer (DPO) contact details
- Right to object, restrict processing, and data portability
- Retention periods for click tracking and IP address data
Pitanja za postaviti
- What specific legal mechanisms (e.g., Standard Contractual Clauses) do you rely on for international data transfers outside the EEA?
- What is the legal basis (consent, legitimate interest, contract) for processing IP addresses and click tracking data for the Boost system?
- How can EU users exercise their right to data portability and the right to object to processing, which are missing from your policy?
- Who acts as your EU representative under GDPR Article 27, given that you process EU user data?
- What is the specific retention period for raw click tracking data and IP addresses used in fraud prevention?
Podijeli ovu analizu
Svatko s ovom poveznicom može vidjeti rezultat iznad.
Izradio DentroChat
100 % europski AI chat za sve
Razgovarajte s AI-jem, radite s datotekama, generirajte slike i pretražujte web. Podaci ostaju u Europi.