GDPR Notice (EU / EEA)

Last updated: September 3, 2026

This notice applies to individuals in the European Union, Iceland, Liechtenstein, and Norway (the EEA). It supplements the privacy policy and tells you, in GDPR terms, how we process your personal data and what rights you have.

1. Who we are

Tiny-Puter is the controller of the personal data described here. To contact us, use the contact form or the support email address; mention "GDPR" in the subject.

2. What we process, and the legal basis

Account + payment handling (name, email, Stripe references) — necessary for the performance of the contract (Art. 6(1)(b) GDPR).
Technical data (IP address, country, browser/OS/device, login times) — legitimate interest in running the service securely and preventing abuse (Art. 6(1)(f) GDPR). You may object at any time; note that some processing (e.g. rate limiting) is required for the service to function.
Consent banner — where we show you a consent notice, we process on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

3. Where your data is processed

We operate on infrastructure in the EU. Processors we use (Stripe for payments, Resend for email, Cloudflare for network fronting) may transfer data outside the EEA; each relies on appropriate safeguards (standard contractual clauses and/or adequacy decisions) in accordance with Chapter V GDPR.

4. Retention

Technical/visit data is retained up to 1 year and pruned automatically; account data until you request deletion; payment records as required by tax law. Container data is deleted on destruction.

5. Your rights

Access — a copy of the personal data we hold about you (including the IP/browser data we record).
Rectification — correct inaccurate data (most account data you can edit yourself).
Erasure ("right to be forgotten") — deletion of data we no longer need.
Restriction & objection — limit or object to legitimate-interest processing.
Portability — receive your account data in a machine-readable form.
Withdraw consent — where processing is based on consent.

To exercise any right, send a request through the contact form or the support email with the subject "GDPR request". We verify your identity and respond within one month, as required.

6. Complaints

If you believe we have processed your data unlawfully, you can lodge a complaint with your local data protection supervisory authority — and we'd also appreciate the chance to fix it first.