Skip to content
AnyReps

Privacy policy

Version of 2026-10-26. This policy explains what personal data AnyReps processes, why, and your rights under the GDPR (Regulation (EU) 2016/679).

1. Controller

The controller is Matthew Sarkowski, e-mail: contact@anyreps.com. Contact us by e-mail about any data matter.

2. Data, purposes, legal bases and retention

  • Using the Service without an account. The server receives technical connection data (IP address, browser details, page address). The IP address is briefly used to prevent abuse (sign-in attempt limits — up to 24 hours). Legal basis: legitimate interest — security and operation of the Service (Art. 6(1)(f) GDPR).
  • Outbound click statistics. We store the product, agent, date and a pseudonymous identifier computed from IP address and browser with a secret key that changes daily (the IP address itself is not stored). Purpose: product popularity and protection against inflated counts. Basis: Art. 6(1)(f). Retention: 90 days.
  • Visit statistics. When a page is shown, the browser sends the page address (without search parameters), the referring site's domain, device type and browser family. Visits are counted with a pseudonymous identifier computed from IP address and browser using a secret key that changes daily — the IP address is not stored, no cookies or other device storage are used, and Do Not Track / Global Privacy Control signals are honoured. Purpose: understanding traffic and improving the Service. Basis: Art. 6(1)(f) GDPR. Retention: 90 days.
  • Link converter. Pasted links are processed in memory only to produce the result and are not stored.
  • User account (when registration is available): e-mail, display name, password hash (we never store the password), language, two-step verification data, sessions (including IP address and browser identifier for account security), favorites. Basis: performance of the account agreement (Art. 6(1)(b)) and, for security, Art. 6(1)(f). Retention: until account deletion; sessions expire after 14 days or on sign-out.
  • Reports (“Report a problem”): content, optional reply e-mail and, if signed in, the link to your account. Basis: Art. 6(1)(f) (and legal obligations on unlawful content — Art. 6(1)(c)). Retention: up to 12 months after resolution.
  • Form protection (Cloudflare Turnstile), if enabled: Cloudflare analyses technical browser/connection data when forms are submitted to tell humans from bots. Basis: Art. 6(1)(f).
  • Staff (panel accounts): additionally an audit log of catalog changes. Basis: Art. 6(1)(f) — accountability and security.

3. Recipients

  • Server hosting provider in the EU: Hostinger International Ltd. — serwer VPS we Frankfurcie (Niemcy, UE) — stores the database on the controller's behalf.
  • Cloudflare, Inc. — storage and delivery of product images (Cloudflare R2) and, if enabled, form protection (Turnstile). Cloudflare may process your IP address when images load.
  • Public authorities — only where required by law.

We do not sell data and use no advertising or tracking tools (e.g. Google Analytics, ad pixels). Shopping agents and platforms receive no personal data from us — links carry only a product identifier and possibly the Service's affiliate code. External websites apply their own privacy policies.

4. Transfers outside the EEA

Cloudflare, Inc. is based in the USA. Transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Cloudflare participates) or on Standard Contractual Clauses.

5. Your rights

  • access and a copy of your data,
  • rectification,
  • erasure (you can delete your account yourself in account settings),
  • restriction of processing,
  • data portability (for data processed under the contract),
  • objection to processing based on legitimate interest,
  • complaint to a supervisory authority — in Poland: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

6. Voluntary data and automated decisions

Providing data is voluntary; an account requires an e-mail and password. We do not make solely automated decisions or profile users.

7. Security

HTTPS, secure password hashing, mandatory two-step verification for staff, encryption of integration keys, least-privilege access and encrypted backups.

8. Cookies

We use only strictly necessary cookies and browser storage — see the Cookie policy.

9. Changes

Material changes will be announced on this page and, for account holders, in the Service. Current version: 2026-10-26.