Privacy policy

This policy explains which personal data lansirano.com processes, why, for how long, and what your rights are. It describes the site as it is built: we process only the data the site needs.

Controller

The controller of your personal data is Devisium d.o.o. (company details). For questions about privacy and to exercise your rights, write to hello@lansirano.com.

What we process and why

Account. When you sign in, we keep your email address, when you signed in, and the IP address and browser of the session, to keep sign-in secure. If you sign in with Google, Google gives us your name, email address and a link to your profile picture. Legal basis: contract, meaning the terms of use (Article 6(1)(b) GDPR).

Public profile. The username, name, bio, website and country you enter are public on your maker page. Until you enter anything, only an automatic username (such as maker_…) is public, and it does not reveal your email address. Legal basis: contract.

Apps. The app details, logo and screenshots you submit are public from launch day. Before that only you and the editors see them. Legal basis: contract.

Votes and comments. Comments are public along with your name. Your votes are visible only to you; only the total is public. Legal basis: contract.

Claiming a listing. When you claim an app, we process the address at the app's domain that we send the link to, and which account claimed the listing. Legal basis: contract, and our legitimate interest in listings going to their real owners (Article 6(1)(f)).

Newsletter. For the Friday newsletter we keep your email address, language, when you subscribed, confirmed and unsubscribed, and which issues we sent you. Legal basis: your consent (Article 6(1)(a)), which you give by clicking the link in the confirmation email and can withdraw at any time by unsubscribing.

Payments. You pay for a promotion through Stripe; we never see your card details. Stripe gives us your name, company name, email address, billing address, VAT number and the payment status, which we need to issue the invoice. Legal basis: contract, and the legal obligation to keep invoices (Article 6(1)(c)).

Visit statistics. We use Umami on our own server, without cookies and without personal data. It counts page views and some clicks (such as a vote or a visit to an app's website) without identifying anyone, and it respects the "Do Not Track" setting. Legal basis: our legitimate interest in understanding how the site is used.

Server logs. For security and troubleshooting, the server records the IP address, time and requested page of each request. Legal basis: legitimate interest (keeping the site secure).

Visits from badges and the newsletter. Visits that arrive through a maker's badge or the newsletter are counted per app, without any data about the visitor.

Cookies and browser storage

We use only cookies the site cannot work without, so they need no consent:

• sb-…-auth-token: keeps you signed in; until you sign out, 400 days at most.
• sb-…-code-verifier: only while signing in with Google, for a few minutes.
• NEXT_LOCALE: the language you chose.
• lansirano_next: the page to return you to after signing in; one hour.

In the browser's session storage we remember that a badge visit was already counted, so a reload does not count it twice. Stripe's payment page (checkout.stripe.com) sets its own cookies under Stripe's rules.

Who else processes data

• Hetzner Online GmbH (Germany): the servers that run the site, the database and the statistics, in the European Union.
• NEOSERV d.o.o. (Slovenia): sending email (sign-in, newsletter, notifications).
• Stripe Payments Europe, Limited (Ireland): processing payments. For part of the processing, such as fraud prevention, Stripe is an independent controller under its own privacy policy.
• Google Ireland Limited (Ireland): only if you sign in with Google, under Google's privacy policy.

Stripe and Google may transfer data to the United States, under the EU-US Data Privacy Framework or standard contractual clauses. We do not sell data and do not use it for advertising.

How long we keep data

• Account, profile, votes and comments: as long as the account exists. When the account is deleted, its profile, votes and comments are deleted too. Published apps stay on the site without a link to your profile, unless you ask us to remove them.
• Newsletter: until you unsubscribe. We keep the record of the unsubscription so we don't write to you again.
• Claims: links expire after 24 hours; the record of a claim stays as long as the app is listed.
• Payments and invoices: as long as tax and accounting rules require, up to 10 years.
• Server logs: 30 days at most.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, and to object to processing based on legitimate interest. You withdraw your newsletter consent by unsubscribing from any issue. You edit your profile on your account page; to delete your account or for anything else, write to hello@lansirano.com. We reply within one month.

If you believe we process data unlawfully, you can complain to the Information Commissioner of the Republic of Slovenia (Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si) or to the supervisory authority where you live.

Changes

We publish a changed policy on this page with a new date, and tell signed-up users about substantial changes by email.