Privacy

Data controller

Alex-Andre Viik, Raua 1-6, Tallinn, Estonia, Estonia.

Public listings

Your title, description, public posting name, provider or application URLs, service contract, advertised price or reward, and publication dates are public after publication. Free listings require no payment. Do not submit private information or credentials in these fields.

Private records

We store a random listing reference, a hash of its private access token, state and timestamps, payment/refund references and amounts, and operator notes. For earlier paid listings, hosted Checkout collects payment details through Stripe. MPP accepts a payment authorization credential; the application does not store raw SPT credentials. Never send card numbers or security codes to this API.

The private token in an existing management-link fragment is not part of the page request. An authorized client extracts it and sends it to the management API in an Authorization header. The page does not read or transmit it. Anyone holding that token or link can manage the listing. No advertising trackers have been added by this application.

Security and reports

For rate limiting we store a salted hash of request-source information and short-lived counters; expired counters are cleared as requests are processed. We store submitted reports so the operator can investigate them. Hosting and payment providers independently process request/payment metadata for delivery and security.

Aggregate traffic counts

We count public requests by UTC day, normalized route, method, response status class, client category, and referring-source category. Analytics stores no IP addresses, raw user agents, full referrer URLs, query strings, request bodies, or visitor identifiers. No analytics cookies or browser scripts are used. The operator-only summary measures requests, not unique people. Aggregate buckets cover 30 days; older buckets are removed on the next tracked request. Hosting logs are separate operational records.

Purpose, retention, and rights

We use these records to deliver the listing service, administer payments/refunds, review abuse, and meet legal obligations. Public listings expire after 30 days or withdrawal. Expiry removes public access; it does not erase billing or complaint records. Records are retained as needed for those purposes and applicable legal requirements, not sold as an audience database.

Contact the operator to request access, correction, or deletion, subject to records we must retain. You may raise a data-protection complaint with the Estonian Data Protection Inspectorate. A specific operational retention schedule must be established before commercial activation.