Privacy Notice

1. Controller

The controller responsible for the processing of personal data described in this Privacy Notice is:

Boldfinch HB
Skärsnäsvägen 1008
291 56 Arkelstorp
Sweden
Organisation number: 969803-9444
Represented by: Oliver Gesch and Antonia Gesch
Website: https://checktopus.dev

For privacy-related questions, requests, or to exercise your data protection rights, you can contact:info@boldfinch.net

2. Scope of this Privacy Notice

This Privacy Notice applies to visits to the websitehttps://checktopus.dev and the pages made available under this domain, including blog pages.

At the time of publication, this website is essentially a static marketing and blog site. It does not provide user accounts. Visitors may join the Checktopus Waitlist by submitting an email address, as described in section 3. The website does not provide other interactive forms or a general newsletter product. You may also contact Boldfinch HB by email at hello@checktopus.dev orinfo@checktopus.dev (and atinfo@boldfinch.net), as described in section 8.

Unless otherwise stated, the personal data described in sections 4–10 is collected automatically from your device and browser when you request pages or assets from the website. Waitlist contact data is processed only if you submit the Waitlist form.

3. Waitlist signup

If you submit the Waitlist form on this website, Boldfinch HB processes your email address to add you to the Checktopus early-access Waitlist and to send you product updates about Checktopus.

Signup uses double opt-in: after you submit the form, we send a confirmation email and we only send further Waitlist or product-update emails after you confirm. Submitting the form and confirming that email constitutes your consent to this processing.

EmailOctopus (operated by Three Hearts Digital Ltd, 86-90 Paul Street, London EC2A 4NE, United Kingdom) processes Waitlist submissions and stores Waitlist contact data on behalf of Boldfinch HB as a processor. EmailOctopus states that contact lists are stored on Amazon Web Services in Ireland (EEA). EmailOctopus may use email delivery subprocessors when messages are sent. Further detail is available in EmailOctopus’sPrivacy PolicyandGDPR materials, including their data processing terms.

The legal basis for Waitlist processing is Article 6(1)(a) GDPR (consent). You may withdraw consent at any time by using the unsubscribe link in a Waitlist or product-update email, or by contactinginfo@boldfinch.net. Withdrawal does not affect the lawfulness of processing before withdrawal. After you unsubscribe or we erase your contact at your request, we stop sending these emails and retain the address only as long as needed to honour the withdrawal (for example suppression) or to meet a legal obligation.

4. Categories of personal data processed

When you access the website, personal data and technical information may be processed automatically in order to deliver the website securely and reliably. Because the website is delivered through Cloudflare, this includes End User interaction and traffic metadata of the kind Cloudflare describes for customer internet properties and Customer Logs, in particular:

• IP address
• Date and time of the request
• Request metadata, such as requested URL/URI, HTTP method, status code, and transferred data volume
• Browser, device, and system configuration information transmitted by your client (for example User-Agent data)
• Referrer URL, where transmitted by your browser
• Traffic routing and delivery metadata (for example Cloudflare data-centre/routing information, cache status, and connection/TLS-related technical data)
• Security-related event and threat-assessment data derived from the request (for example bot/threat signals or mitigation actions, where applicable)
• Approximate location information derived from the IP address (for example country or region), where generated by Cloudflare for delivery, security, or operational analytics

When you join the Waitlist, we also process the email address you submit and related EmailOctopus list metadata (for example confirmation and unsubscribe status), as described in section 3.

When you email a published contact address for this website, we process the content of your message and related email metadata as needed to receive and respond, including via Cloudflare Email Routing as described in section 8.

Cloudflare may also process website content that is routed through, cached on, or otherwise delivered via its network (“Customer Content”). For this static marketing and blog site, that content is controlled by Boldfinch HB and does not itself constitute a visitor account dataset. Waitlist contact data is processed by EmailOctopus as described in section 3, not as Cloudflare-cached website content.

According to Cloudflare, the End User metadata made available to customers via the service dashboard or other online interfaces is referred to as Customer Logs and typically contains only limited personal data, most often in the form of IP addresses and related request metadata.

5. Purposes of processing

Personal data is processed for the following purposes:

• Providing the website to visitors
• Ensuring the stability, security, and availability of the website
• Preventing misuse, fraud, abuse, and malicious traffic
• Detecting, mitigating, and responding to technical or security incidents
• Maintaining and improving the technical delivery of the website
• Managing the Checktopus Waitlist and sending related product updates, where you have submitted the Waitlist form and confirmed double opt-in (see section 3)
• Receiving and responding to emails you send to the contact addresses published for this website (see section 8)
• Measuring aggregated website usage and performance with Cloudflare Web Analytics (see section 14)
• Establishing, exercising, or defending legal claims where necessary in connection with the operation of the website

6. Legal basis

The legal basis for processing that is necessary to deliver, secure, and operate the website (sections 4–10 and 14, excluding Waitlist signup) is Article 6(1)(f) GDPR (legitimate interests).

The legitimate interests pursued are the secure, stable, and efficient operation of the website, protection against abuse and attacks, reliable delivery of content to visitors, the ability to investigate and respond to security or misuse incidents, and understanding aggregated website usage and performance so we can maintain and improve the site.

The legal basis for Waitlist signup and related product-update emails is Article 6(1)(a) GDPR (consent), as described in section 3. Website delivery, security processing, and Cloudflare Web Analytics are not based on consent. If consent-gated marketing or advertising tracking is introduced later, this Privacy Notice will be updated and, where required, a further consent mechanism will be implemented.

7. Cookies and similar technologies

Boldfinch HB does not itself set first-party cookies, localStorage identifiers, or similar tracking technologies through the Checktopus website application code. The Cloudflare Web Analytics beacon described in section 14 likewise does not use cookies or localStorage for analytics.

Cloudflare, which delivers and protects the website, may set strictly necessary cookies or similar technical mechanisms for security, bot mitigation, challenge flows, rate limiting, or load balancing, depending on which Cloudflare features are active for this site. Cloudflare states that the cookies it documents for these purposes are strictly necessary to provide the services requested by customers, unless otherwise stated, and encourages customers to disclose them.

Depending on the enabled Cloudflare configuration, this may include in particular:

• __cf_bm — bot management / bot fight modes; typically expires after about 30 minutes of inactivity
• cf_clearance and related challenge cookies — set after a visitor passes a Cloudflare security challenge
• Rate-limiting or load-balancing cookies (for example _cfuvid,__cfruid, or __cflb), where the corresponding Cloudflare feature is enabled

These cookies are used for website security and technical delivery, not for advertising or cross-site marketing tracking. Cookie data processed by Cloudflare may be processed in Cloudflare data centres, including in the United States, subject to the transfer safeguards described in section 9.

8. Hosting, delivery, and processors

The website is hosted and delivered with the support of Cloudflare, Inc. (and affiliated Cloudflare entities), with registered office information published by Cloudflare (currently including 101 Townsend St, San Francisco, CA 94107, USA).

Cloudflare may process personal data on behalf of Boldfinch HB in its role as a processor, in particular in connection with content delivery, network security, traffic routing, caching, and technical protection of the website, inbound email routing as described below, and Cloudflare Web Analytics as described in section 14.

In that role, Cloudflare processes End User interactions with this website as described in section 4, including IP addresses, traffic routing data, system configuration information, and other information about traffic to and from the website. Cloudflare makes related Customer Logs available to Boldfinch HB via the Cloudflare dashboard or other online interfaces according to the plan and features enabled for this website.

Inbound emails sent tohello@checktopus.dev andinfo@checktopus.dev are received via Cloudflare Email Routing and forwarded toinfo@boldfinch.net. For that purpose, Cloudflare processes email message content and related transmission metadata (for example sender and recipient addresses, subject, timestamps, and routing information) as a processor on behalf of Boldfinch HB. Cloudflare Email Routing does not provide a mailbox for sending or replying from @checktopus.dev; replies are sent from the destination mailbox. The legal basis for this contact-email processing is Article 6(1)(f) GDPR (legitimate interests in receiving and handling correspondence about the website and Checktopus).

Waitlist submissions are processed by EmailOctopus (Three Hearts Digital Ltd) as described in section 3. EmailOctopus’s data processing terms form the contractual basis for that processing where applicable.

Cloudflare'sData Processing Addendumforms the contractual basis for processor-related data protection obligations where applicable. Further detail is available in Cloudflare'sPrivacy PolicyandGDPR materials.

Website fonts are self-hosted with the website and are not loaded from Google Fonts or other third-party font CDNs.

9. International data transfers

As Cloudflare operates an international infrastructure, personal data may be transferred to or accessed from countries outside the European Economic Area, including the United States.

EmailOctopus is established in the United Kingdom. Transfers of Waitlist contact data from the EEA to the United Kingdom may take place on the basis of an adequacy decision. EmailOctopus states that contact lists are stored in Ireland (EEA). Subprocessors used to send email may process data outside the EEA, subject to appropriate safeguards.

Where required, such transfers are based on appropriate safeguards under Chapter V GDPR. For Cloudflare, this may include the EU Standard Contractual Clauses and, where applicable, Cloudflare's certification under the EU-U.S. Data Privacy Framework (and UK/Swiss extensions where relevant), and/or other adequacy mechanisms recognised under applicable data protection law.

10. Retention period

Personal data is stored only for as long as necessary for the purposes described in this Privacy Notice, in particular for website delivery, IT security, error analysis, and the defence against misuse.

Technical and security-related request data processed via Cloudflare is retained according to Cloudflare's product retention limits for the plan used to deliver this website. On Cloudflare Free and Pro plans, those documented limits currently include in particular:

• Security Analytics / HTTP request analytics data: up to the last7 days
• Security Events (firewall and related security events): up to the last24 hours
• Bot-management cookie __cf_bm: typically about30 minutes of inactivity (where set)

Longer raw HTTP request log retention (for example Logpull or Log Explorer) is not enabled for this website. Retention periods may change if Cloudflare's plan, configuration, or documented limits change, or where legal, regulatory, or operational requirements require a different period.

Waitlist contact data is retained until you unsubscribe, we erase it at your request, or the Waitlist and product-update purpose ends, and thereafter only as long as needed to honour a withdrawal or meet a legal obligation (see section 3).

Contact emails forwarded toinfo@boldfinch.net are retained in that mailbox only as long as needed to handle the correspondence and any related follow-up, and thereafter according to ordinary business email retention and legal requirements.

11. Recipients

Personal data may be disclosed to service providers and processors insofar as this is necessary for operating, securing, and maintaining the website, and for Waitlist signup where you have submitted the form.

Recipients may include in particular:

• Cloudflare, Inc. and affiliated Cloudflare entities (hosting, CDN, security, related delivery services, Email Routing for published @checktopus.dev contact addresses, and Web Analytics)
• Three Hearts Digital Ltd, trading as EmailOctopus (Waitlist list hosting and related transactional/product-update email delivery)
• Professional advisers where disclosure is necessary for legal compliance or defence of claims
• Public authorities where there is a legal obligation to disclose data

12. Obligation to provide data

The provision of certain technical data, especially the IP address and request-related metadata, is necessary in order to access and deliver the website.

Without this data, the website cannot be made available securely and reliably.

Providing an email address is required only if you choose to join the Waitlist or to contact us by email. You can use the website without submitting the Waitlist form or sending email.

13. Your rights under the GDPR

Subject to the applicable legal requirements, you have the following rights:

• The right of access to your personal data (Article 15 GDPR)
• The right to rectification of inaccurate personal data (Article 16 GDPR)
• The right to erasure (Article 17 GDPR)
• The right to restriction of processing (Article 18 GDPR)
• The right to data portability (Article 20 GDPR)
• The right to object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR)
• The right to withdraw consent at any time, where processing is based on consent (Article 7(3) GDPR). Withdrawal does not affect the lawfulness of processing before withdrawal. For Waitlist processing, use the unsubscribe link in a Waitlist or product-update email, or contactinfo@boldfinch.net (see section 3). Website delivery and security processing is not consent-based.

To exercise these rights, contactinfo@boldfinch.net. We may need to verify your identity before completing a request.

No automated decision-making producing legal effects concerning you, or similarly significantly affecting you, takes place on the basis of the processing described in this Privacy Notice (Article 22 GDPR).

If you believe that the processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or with another competent supervisory authority in the European Union, in particular in your place of habitual residence, place of work, or place of the alleged infringement.

14. Cloudflare Web Analytics (no marketing tracking)

The website uses Cloudflare Web Analytics, a privacy-oriented measurement tool operated by Cloudflare, Inc. A lightweight JavaScript beacon loads on pages and sends usage and performance metrics to Cloudflare for processing on behalf of Boldfinch HB.

According to Cloudflare, Web Analytics does not use cookies or other persistent client-side storage for analytics, does not fingerprint visitors via IP address or User-Agent for analytics display purposes, and is designed not to collect personal data of the kind used for advertising profiles. Metrics may include page views, visited URLs, referrer information, approximate geography, browser/device class, and Core Web Vitals / page-load performance data. These metrics are used to understand how the website is used and how it performs so we can maintain and improve it.

The legal basis is Article 6(1)(f) GDPR (legitimate interests), as described in section 6. Cloudflare acts as a processor under its Data Processing Addendum (see section 8). Metrics may be processed on Cloudflare’s international infrastructure, including outside the EEA, subject to the transfer safeguards described in section 9.

The website does not intentionally use marketing or advertising tracking tools (for example advertising pixels, remarketing tags, or consent-gated product-analytics suites). Waitlist and product-update emails described in section 3 are consented email communications, not advertising pixels or on-site marketing tracking. Operational request metadata and security analytics processed by Cloudflare for website delivery and protection, as described in sections 4–10, remain separate from Web Analytics. If marketing or advertising tracking is enabled later, this Privacy Notice will be updated and, where required by law, additional consent mechanisms will be implemented.

15. Children

The website is directed at adults and professional audiences. Boldfinch HB does not knowingly collect personal data from children through this website, including via Waitlist signup. If you believe a child has provided personal data via this website, contactinfo@boldfinch.net.

16. External links

This website may contain links to external websites. This Privacy Notice does not apply to the websites of other providers.

The respective provider is solely responsible for the processing of personal data on its own website.

17. Changes to this Privacy Notice

This Privacy Notice may be updated from time to time to reflect legal, technical, or organisational changes.

The current version will be published on this website with an updated “Last updated” date.