peerpush.com privacy policy — score 55/100 (medium risk)
Last analyzed
PeerPush · peerpush.com
Report details
medium riskPeerPush has strong anonymization practices for its public analytics but falls short on GDPR basics by failing to disclose legal bases, lacking an EU representative, and using vague language around international data transfers.
The policy reflects a product-focused approach to privacy, particularly excelling in its 'Signals' feature which implements k-anonymity and PII stripping. However, it reads more like a US-centric policy than a GDPR-compliant one. It completely omits the legal bases for processing, fails to mention Standard Contractual Clauses or other transfer mechanisms, and provides an incomplete catalog of user rights. The children's privacy section relies on the COPPA standard (13 years) rather than the GDPR standard (16 years).
Category Assessment
Breakdown of the policy across key compliance areas. Good = strong, fair = mixed, poor = concerning.
Collects primarily necessary data for the service and explicitly avoids third-party advertising cookies or tracking pixels.
Clearly explains the 'Boost' system and 'Signals' analytics, but completely omits the legal bases for processing as required by GDPR.
Sharing is limited to essential service providers (hosting, auth, email) and public user-generated content, with no ad-tech sharing.
Mentions transfers occur but provides zero specifics on the destination countries or the legal safeguards and mechanisms used.
The policy is silent on whether user data is used to train PeerPush's own AI models, though it details how AI agent traffic is tracked in analytics.
Omits key GDPR rights (portability, objection, restriction), provides no formal process or timeline for requests, and lacks an EU representative contact.
Key Findings
Notable clauses, issues, or positive practices discovered (critical first)
Missing Legal Bases for Processing
The policy details what data is collected and how it is used, but completely fails to state the legal basis for processing (such as consent, contract performance, or legitimate interest) as required by GDPR Article 13(1)(c).
Vague International Transfer Mechanisms
Section 10 states that data may be transferred internationally and that 'appropriate safeguards' are in place, but it does not specify the actual legal mechanism (e.g., Standard Contractual Clauses, adequacy decisions) or the destination countries, leaving EU users uninformed.
Incomplete User Rights Catalog
Section 7 lists access and deletion but omits other mandatory GDPR rights, specifically the right to restrict processing, the right to data portability, and the right to object. It also fails to provide a clear timeline or dedicated contact method for exercising these rights.
US-Centric Children's Privacy Standard
Section 11 sets the age threshold at 13, aligning with US COPPA rules, but disregards the GDPR standard which generally requires parental consent for children under 16 (or 13-16 depending on the member state).
Strong Anonymization in Public Analytics
Section 9 outlines robust privacy-preserving measures for the 'Signals' feature, including k-anonymity (hiding rows with fewer than 5 visitors), automated PII stripping from search queries, and daily rotation of anonymous identifiers.
Consumer Takeaway
Your data is generally safe from ad trackers and public exposure thanks to clever anonymization, but you lack the full suite of GDPR protections, and your data might leave the EU without robust legal safeguards.
Compliance Posture
Partial compliance. Strong on data minimization for analytics and security, but fundamentally deficient in GDPR transparency requirements (legal basis, transfer mechanisms, full rights catalog, DPO/Representative).
EU Transfers
Inadequate. The policy admits data may be transferred internationally but fails to name the destination countries or the legal mechanisms (like SCCs or adequacy decisions) used to protect the data, violating GDPR Articles 13(1)(f) and 46.
Detected Signals
Specific data points and practices identified in the text
Evidence Snippets
Direct quotes from the policy supporting these findings
Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.
Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.
We never publish a row backed by fewer than 5 distinct visitors. Below that floor, the row is hidden.
Product submissions: Retained indefinitely once published
Missing or Unclear
- Legal bases for processing (consent, contract, legitimate interest)
- Specific international transfer mechanisms (SCCs, BCRs, adequacy)
- EU representative designation
- Data Protection Officer (DPO) contact details
- Right to object, restrict processing, and data portability
- Retention periods for click tracking and IP address data
Questions to Ask
- What specific legal mechanisms (e.g., Standard Contractual Clauses) do you rely on for international data transfers outside the EEA?
- What is the legal basis (consent, legitimate interest, contract) for processing IP addresses and click tracking data for the Boost system?
- How can EU users exercise their right to data portability and the right to object to processing, which are missing from your policy?
- Who acts as your EU representative under GDPR Article 27, given that you process EU user data?
- What is the specific retention period for raw click tracking data and IP addresses used in fraud prevention?
Share this analysis
Anyone with this link can view the result above.
Built by DentroChat
100% European AI chat for everyone
Chat with AI, work with files, generate images, and search the web. Data stays in Europe.