Controller. MONLAC OÜ, registry code 17275184, Juhkentali tn 8-23, 10132 Tallinn, Estonia · karel@zerobuild.me (see the legal notice).
What we process, why, and on what legal basis
- Click verification. When you follow an outbound tool link we log a salted hash of your IP address, your user agent, the referring page and a timestamp — never the raw IP. Purpose: verifying delivered clicks and filtering bots, the integrity core of the product. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — the data is minimised (one-way hash, no raw IPs, no profiles) and is not used for anything but delivery verification and fraud filtering.
- Payments and invoicing. If you buy a placement we process your checkout declaration (business/consumer, optional company name and VAT ID), the transaction record, the delivery log, and the invoice we must issue. Legal bases: performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c) — Estonian accounting rules). Card details never touch our servers: checkout runs on Stripe's hosted pages.
- Contract confirmation email. After a captured payment we send one confirmation email to the address you gave Stripe at checkout — the durable-medium contract confirmation EU consumer law requires (Art. 8(7), Directive 2011/83/EU). Legal bases: contract and legal obligation. It is not marketing and there is no mailing list.
- Support email. If you write to us we keep the correspondence as long as needed to handle the matter (legitimate interest).
Our legitimate-interest assessments follow the three-step test in EDPB Guidelines 1/2024 (interest, necessity, balancing); fraud prevention and service integrity are interests the Guidelines expressly recognize. You can object at any time.
Cookies and local storage
This site sets no cookies at all — no session cookie, no tracking, no third-party analytics, no local storage. Because nothing non-essential (or indeed anything) is stored on your device, no cookie consent banner is required.
Recipients and transfers
- Stripe (Stripe Payments Europe, Ltd.) processes payments as an independent controller for its own compliance and as our processor for payment services — see Stripe's privacy policy.
- Hetzner Online GmbH (Germany) hosts the service as our processor. Data is stored in the EU.
- We transfer no personal data outside the EU/EEA ourselves; Stripe may, under its own safeguards (SCCs).
Retention
- Click logs (hashed): kept while the related season statistics are published, reviewed after 24 months.
- Payment records, invoices, delivery logs: 7 years (Estonian Accounting Act).
Your rights
You may request access, rectification, erasure, restriction, portability, and object to legitimate-interest processing: karel@zerobuild.me. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or your local supervisory authority.
Reviewed against EU and Estonian law in force as of August 2026. This review was performed with AI assistance and does not constitute advice from a licensed attorney. Questions: contact.