Privacy policy

The data controller is Cristian Calcagnile, Viale Carducci 25, 55049 Viareggio (LU), Italy. VAT: IT02003710460. Contact: info@outpull.tech.

This notice is provided under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.

Questions about this notice, or any request concerning your data, can be sent to the address above and will be answered within one month.

You can cast a pull without an account, a name or an email address. To enforce one pull per person per battle and to keep automated traffic out of the count, a limited set of technical data is processed.

• A randomly generated voter secret stored in an HttpOnly cookie on your device, hashed into a voter key. This, and only this, identifies a repeat vote.
• A one-way hash of your IP address and of your browser's user-agent string, retained for abuse analysis. The original values are not stored and the hashes are not used to identify you.
• Which product the pull went to, and the time it was cast.
• The result of a Cloudflare Turnstile challenge, which distinguishes people from automated scripts.

Registering a product means creating an account. We process the email address you sign in with, the product details you submit, your competitive access periods, your bids and their payment status.

Payments are handled by PayPal. We never receive or store your card details — only the identifiers PayPal returns for an order, an authorisation and a capture, which let us reconcile what you paid for.

If you are a business, we also process the billing details required to issue a valid invoice under Italian law.

Each purpose rests on a specific legal basis under Article 6 GDPR.

• Abuse prevention signals from voters: legitimate interest (Art. 6(1)(f)). Without them the pull count is meaningless and the service has no value to anyone taking part. The data is minimised to hashes and short retention precisely to keep that interest balanced against your privacy.
• Founder accounts, access periods, bids and payments: performance of a contract (Art. 6(1)(b)).
• Invoicing, accounting and tax records: compliance with a legal obligation (Art. 6(1)(c)).
• Service emails such as sign-in links: performance of a contract. We do not send marketing email without separate consent.
• Advertising measurement through the Meta pixel: your consent (Art. 6(1)(a)), asked for before anything loads and withdrawable at any time.

Abuse-prevention signals attached to a vote are kept for the battle they belong to plus a short review window, then deleted or irreversibly aggregated into counts that identify nobody.

Founder account and product data is kept while the account exists. Payment and invoicing records are kept for ten years, the retention period Italian tax law requires.

Server logs are kept for a short operational period and then discarded.

The service runs on a small number of providers, each acting as a processor on our instructions under Article 28 GDPR.

• Supabase — database and authentication.
• Vercel — hosting and delivery of the site.
• PayPal — payment processing, acting as an independent controller for its own purposes.
• Cloudflare — the Turnstile anti-abuse challenge.
• Resend — delivery of transactional email such as sign-in links.
• Meta Platforms Ireland Limited — advertising measurement, and only for visitors who accepted it. Meta acts as an independent controller for its own purposes; see the Cookie Policy for what it receives.
• We do not sell personal data. The only cross-site tracking on OutPull is the Meta pixel, which does not exist on your device unless you accepted it.

Some of these providers operate infrastructure outside the European Economic Area, principally in the United States. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or by an adequacy decision, together with the supplementary measures those providers document.

You can ask us for details of the safeguards applying to a specific transfer.

When you click through to a product competing in the arena, we record that a click happened, against which product and which battle, and the referring page. This is aggregate performance reporting for the founder and is not linked to your identity.

The destination site then applies its own privacy policy, over which we have no control.

Under Articles 15 to 22 GDPR you may request access to your data, its correction or erasure, restriction of processing, portability of data you provided, and you may object to processing based on legitimate interest. Where processing rests on consent, you can withdraw it at any time without affecting what was done before.

Because votes are deliberately not tied to an identifiable account, we may be unable to locate a specific pull without further information from you. This is a consequence of collecting as little as possible, not a refusal.

To exercise any right, write to info@outpull.tech.

If you believe your data has been handled unlawfully you may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority where you live or work.

Automated checks decide whether a pull is counted as valid. This affects the tally of a public contest and produces no legal effect concerning you and nothing comparably significant, so it is not automated decision-making within the meaning of Article 22 GDPR.

We do not profile visitors and we do not build behavioural advertising audiences.

The service is not directed at children. Registering a product requires the legal capacity to enter a contract. If you believe a child has provided us with personal data, contact us and it will be deleted.

If this notice changes materially we will publish the new version here and update the date at the top before the change takes effect. Where the change affects processing that depends on your consent, we will ask for it again.