Privacy Policy & Cookie Notice

Last updated: August 31, 2026

1. Data Controller

The entity responsible as Data Controller for personal data collected under this website is:

2. Personal Data We Collect

We adhere to the principle of data minimization. We only collect the minimal personal data necessary to provide and protect our services:

A. Technical & Server Log Data

When you browse our website, our web server and content delivery networks may automatically log standard connection data:

• IP address (truncated or anonymized where feasible)
• Date and time of server request
• Browser type, version, and operating system
• Referrer URL (the previous page from which you arrived)

Legal basis: Art. 6(1)(f) GDPR (Legitimate interest in ensuring technical stability, network security, and DDoS mitigation).

B. Analytics Data (Google Analytics 4)

We use Google Analytics 4 (Measurement ID: G-4JCLE6RZE0) provided by Google Ireland Limited to measure aggregate website traffic and visitor interactions.

• Google Consent Mode v2: Analytics cookies and tracking are blocked by default until you give explicit opt-in consent via our Cookie Banner.
• IP addresses are automatically anonymized by Google Analytics 4.
• No cross-device advertising profiling or personal identity correlation is performed.

Legal basis: Art. 6(1)(a) GDPR (Explicit user consent, revocable at any time).

C. Donation, Sponsorship & Payment Data

When you support Freerouting via one-time donations or recurring sponsorships:

• Stripe: Payment processing is handled by Stripe Payments Europe, Ltd. (and Stripe, Inc.). Stripe collects payment method details (card numbers, digital wallet tokens, TWINT credentials, bank accounts) in a PCI-DSS Level 1 compliant infrastructure. We never receive or store your raw payment details, credit card numbers, or CVC security codes. We only receive high-level transaction confirmations (e.g., transaction ID, amount, currency, donor email if provided, and timestamp).
• GitHub Sponsors: Processed directly through GitHub, Inc. subject to GitHub's Privacy Statement.

Legal basis: Art. 6(1)(b) GDPR (Performance of contract / transaction fulfillment) and Art. 6(1)(c) GDPR (Compliance with statutory accounting and tax obligations under Estonian and EU law).

D. Direct Inquiries & Communications

When you contact us via email ([email protected]), we process your email address, name, and message content to address your inquiry.

Legal basis: Art. 6(1)(b) GDPR (Pre-contractual communication) or Art. 6(1)(f) GDPR (Legitimate interest in responding to user inquiries).

3. Cookies & Tracking Technologies

Cookies are small text files stored on your device. We categorize cookies into two classes:

4. Data Retention

We store personal data only as long as necessary to fulfill the purposes for which it was collected, or as required by statutory retention periods:

• Accounting & Tax Records: Under the Estonian Accounting Act, accounting records and donation transaction receipts must be retained for 7 years.
• Server Logs: Technical log files are deleted or anonymized automatically within 30 to 90 days.
• Analytics Data: Retained in Google Analytics according to the standard retention window (14 months) before automatic expiration.

5. Third-Party Service Providers (Data Processors)

We work with trusted third-party providers who process data strictly under data processing agreements compliant with GDPR Art. 28:

• Stripe Payments Europe Ltd. (Ireland) & Stripe, Inc. (USA) — Payment facilitation. Data transfers to the USA are safeguarded under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs).
• Google Ireland Ltd. & Google LLC — Web analytics (conditional on consent).
• GitHub, Inc. — Code hosting, community issues, and GitHub Sponsors.

6. Your Rights Under the GDPR & EU Law

As a data subject located in the European Union / European Economic Area (or Switzerland/UK), you have the following rights under Articles 15–22 GDPR:

• Right of Access (Art. 15): You have the right to request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): You may request correction of inaccurate or incomplete data.
• Right to Erasure / "Right to be Forgotten" (Art. 17): You may request deletion of your personal data when statutory grounds are met.
• Right to Restriction of Processing (Art. 18): You may request suspension of data processing in certain circumstances.
• Right to Data Portability (Art. 20): You may receive your data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): You may object at any time to the processing of your data based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent (e.g. analytics cookies), you have the right to withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please email us directly at: [email protected].

7. Right to Lodge a Complaint with a Supervisory Authority

If you consider that our processing of your personal data infringes data protection laws, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence or our registered place of business.

Our lead supervisory authority is the Estonian Data Protection Inspectorate:

8. Notice for United States Residents (CCPA / CPRA)

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and similar state privacy statutes:

• We do NOT sell personal information: In the preceding 12 months, we have not sold any personal information of consumers.
• We do NOT share personal information for cross-context behavioral advertising: We do not share personal information with third parties for targeted cross-site marketing.
• Non-Discrimination: We will not discriminate against you (e.g., denying software downloads or features) for exercising any of your CCPA rights.
• You may exercise rights to know, delete, or correct personal data by contacting [email protected].

9. Security of Processing

We employ state-of-the-art technical and organizational security measures (including HTTPS TLS 1.3 encryption, secure hosting configurations, and principle of least privilege) to protect your personal data against loss, misuse, and unauthorized access.

10. Contact for Privacy Inquiries

If you have any questions, requests, or concerns regarding this Privacy Policy or how your data is handled:

Foxy Laboratories OÜ
Attn: Data Privacy Officer
Tartu maantee 67 1-13b, 10115 Tallinn, Harju, Estonia
Email: [email protected]