Privacy Notice

This Privacy Notice explains how HELP ME RETIRE (https://helpmeretire.online) collects, uses, stores and shares personal data when you visit the website, make a contribution, submit a note, or contact us.

It applies together with the Terms of Service.

Processing is governed by Regulation (EU) 2016/679 ("GDPR") and Czech Act No. 110/2019 Coll., on the Processing of Personal Data.

1. Controller

The controller of personal data processed through HELP ME RETIRE is:

Jakub Koudela
Company ID: 19510951
Vincence Bednáře 448
696 11 Mutěnice
Czech Republic

Email: jakubk@fastmail.com

For privacy requests, complaints, data-removal requests or questions about this notice, contact the controller at the email above.

Public contact: @jakub_ko86 on X

We do not have a designated Data Protection Officer. You may contact the controller directly with any privacy question or request.

2. What personal data we process

We aim to keep the Service small and process only information reasonably necessary to operate, secure and improve it.

Contributions and public notes

When you make a contribution, we may process:

• contribution amount;
• optional name or nickname;
• optional message;
• payment status;
• moderation status;
• Stripe payment and checkout identifiers;
• information necessary to identify and administer the contribution.

A name and message are optional.

Payment information

Payments are processed by Stripe.

We do not receive or store your full payment-card number.

Stripe may process payment, billing, contact and fraud-prevention information according to its own privacy documentation and the applicable payment service.

Depending on the checkout information you provide, we may receive information such as payment confirmation, amount, payment identifiers and email address.

Analytics

We use two privacy-focused analytics services to measure how the website is used: Umami Cloud, operated by Umami Software, Inc., and Vercel Web Analytics, operated by Vercel Inc.

The Umami tracker is configured without advertising features and does not set cookies. It does not create a persistent advertising profile across days. We also configure the tracker to omit URL query strings, so payment-confirmation parameters are not sent, and to respect the browser Do Not Track setting.

Vercel Web Analytics does not set cookies. Vercel states that it stores anonymized data and identifies visitors with a hash created from the incoming request, which resets after a day. We configure it to omit URL query strings, so payment-confirmation parameters are not sent.

Analytics may involve information such as:

• pages visited, as a path and title, without query strings;
• referrer;
• browser, operating system and device type;
• screen size and browser language;
• approximate country;
• custom event names such as donation_started, donation_completed, note_submitted, note_approved and note_rejected.

We do not send email addresses, names, message contents, payment identifiers, Stripe customer IDs or donation amounts to Umami or Vercel Analytics. Custom event names are sent only to Umami.

Umami states that it anonymizes collected data, does not use cookies in its tracking code, and does not track visitors across websites. Vercel states that Web Analytics records anonymous data points for aggregated statistics and does not collect information that would identify an end user or reconstruct browsing across websites. Network-level information such as IP address may be processed by these providers to produce those anonymized metrics, for example approximate country, and is not used by us to identify you.

Public LIVE figures on the website, such as people currently watching, visitors today and page views today, are approximate aggregates from Umami. They are not an exact headcount of people on the page. They are separate from donation totals, which come from our own records.

Where analytics or similar technologies require consent under applicable law, we will obtain that consent before using them.

Technical and security data

Our hosting, edge and infrastructure providers may process ordinary technical request information, including:

• IP address;
• user agent;
• referrer;
• request information;
• security and diagnostic information.

We use this information to operate the Service, maintain security, prevent abuse, investigate incidents, restrict administrative access and maintain security or administrative logs.

Messages and requests sent to us

If you contact us regarding a complaint, privacy request, content-removal request, payment issue or other matter, we process the information contained in your correspondence so that we can respond and maintain an appropriate record.

3. Cookies and browser storage

The public website does not intentionally set advertising cookies.

We may use technically necessary storage or similar technologies required to operate the Service.

The administrative interface uses an authentication cookie named retire_admin. It is used only for authenticated administration and is not used to track public wall visitors.

The admin authentication cookie normally lasts for up to 14 days, unless you sign out or delete it earlier.

We do not use cookies for advertising.

The Umami tracker and Vercel Web Analytics do not set cookies. Measurement is done without advertising cookies and without a persistent advertising identifier stored in the browser.

If the Service introduces non-essential cookies or similar technologies that require consent under applicable law, we will obtain the required consent before using them.

4. Why we process personal data

We rely on different legal bases depending on the processing activity.

Contract performance: Article 6(1)(b) GDPR

We process information necessary to:

• accept and record contributions;
• provide the requested Service;
• publish an optional approved note;
• administer your contribution;
• provide functionality requested by you.

Legitimate interests: Article 6(1)(f) GDPR

We process information where necessary for legitimate interests such as:

• preventing fraud and abuse;
• moderating submitted content;
• protecting the website and infrastructure;
• preventing malicious automated activity;
• maintaining security logs;
• administering the website;
• understanding website usage through analytics where permitted;
• handling disputes and defending legal claims.

Where we rely on legitimate interests, you may object as described below.

Legal obligation: Article 6(1)(c) GDPR

We process information where necessary to comply with legal obligations, including applicable accounting, tax and other legal requirements.

5. Public notes

If you submit a name or message and it is approved for publication, it may become publicly visible on the HELP ME RETIRE wall.

Public information may include:

• contribution amount;
• name or nickname;
• message;
• date or time associated with the note.

Public notes may be viewed by anyone, including search engines and other third parties.

Do not submit information that you do not want to make public.

A public note does not become private merely because it appears on the wall.

Pending messages may appear in blurred or otherwise obscured form while awaiting moderation.

Rejected or removed messages are not publicly displayed.

Refunded contributions are removed from the active public donation display.

6. Automatic moderation

Submitted messages may be checked using automated moderation systems.

The moderation system may detect potentially inappropriate content, sexual or adult content, prohibited links, spam, abusive content, threats and other prohibited material.

Depending on the result, a message may be:

• automatically approved;
• placed into pending review;
• rejected.

Where a message is placed into pending review, a human administrator may make the final decision.

Automatic moderation does not automatically issue refunds.

Moderation decisions concern publication of the message and are separate from payment processing.

7. Who receives personal data

We share personal data only where reasonably necessary to operate the Service, comply with law, protect the Service or handle legitimate business needs.

Depending on the relevant processing activity, recipients may include:

Stripe

Stripe processes payment information and payment-related data required to process contributions and prevent fraud.

Stripe's processing and international transfer arrangements are described in its applicable privacy and data-processing documentation.

Analytics providers

We use Umami Cloud, operated by Umami Software, Inc., and Vercel Web Analytics, operated by Vercel Inc., for website analytics and measurement.

Umami's privacy notice is published at https://umami.is/privacy. Umami publishes a data-processing agreement at https://umami.is/dpa.

Umami Cloud servers are located in the United States and the European Union. The region used depends on the Umami Cloud account configuration.

Vercel's privacy notice is published at https://vercel.com/legal/privacy-policy. Vercel publishes a data-processing addendum at https://vercel.com/legal/dpa.

Hosting and infrastructure providers

We use hosting, database, CDN/edge, security and other infrastructure providers necessary to operate the website.

These providers may process technical information and, where necessary, application data on our behalf.

Professional advisers and authorities

We may disclose information to lawyers, accountants, regulators, courts, law-enforcement authorities or other professional advisers where necessary to comply with law, protect our rights, investigate abuse or resolve disputes.

Transfer of the project

If HELP ME RETIRE or substantially all of its assets are transferred, personal data may be transferred to the relevant successor where legally permitted and necessary for continuity of the Service.

We do not sell personal data.

8. International transfers

Some service providers may process personal data outside the European Economic Area.

Umami Software, Inc. and Vercel Inc. are established in the United States. Where analytics data is transferred outside the EEA, we rely on the transfer mechanism described in the relevant provider's data-processing terms, such as an adequacy decision or the EU Standard Contractual Clauses where applicable.

Where personal data is transferred to a third country, we rely on an applicable lawful transfer mechanism, such as an adequacy decision, the EU Standard Contractual Clauses, or another mechanism permitted by GDPR.

Where relevant, additional safeguards may apply.

9. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the relevant purpose, unless a longer period is required or permitted by law.

Public notes

Approved notes remain public while they are displayed on the wall or archive.

If a note is removed, the underlying information may remain temporarily in backups or administrative records.

Payment and accounting records

Payment identifiers, contribution amounts and related records are retained for as long as necessary for accounting, tax, fraud prevention, dispute handling and legal obligations.

Security and administration logs

Security and administrative logs are normally retained for a limited period appropriate to the purpose, unless a longer period is necessary to investigate abuse, maintain security or establish, exercise or defend legal claims.

Analytics

Analytics data is retained according to our Umami Cloud plan, Umami's retention policies, and Vercel's retention policies for Web Analytics. Umami Cloud publishes plan-based retention periods. We do not keep a separate analytics archive of our own.

10. Your rights

Where GDPR applies, you may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate data;
• request deletion of personal data;
• request restriction of processing;
• request portability of applicable personal data;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent.

These rights are subject to applicable legal exceptions and limitations.

To exercise a right, contact: jakubk@fastmail.com

We may need sufficient information to identify the relevant records and verify that the request is genuine.

11. Public note removal

You may ask us to remove a public note by contacting jakubk@fastmail.com.

We will consider the request and remove the note where appropriate, subject to legal obligations, legitimate retention requirements and the rights of other persons.

Removing a public note does not automatically refund the related contribution.

12. Right to complain

You have the right to lodge a complaint with a data-protection supervisory authority.

In Czechia, the competent authority is:

Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27
170 00 Praha 7
Czech Republic

Website: https://uoou.gov.cz/

You may also contact the supervisory authority in the EU/EEA country where you live, work or believe an infringement occurred, where applicable.

13. Automated decision-making

We do not use automated decision-making that produces legal effects or similarly significant effects on individuals within the meaning of Article 22 GDPR.

Automated moderation may determine whether a submitted message is automatically approved, placed into pending review or rejected for publication.

Where appropriate, an administrator may review the decision.

Automatic moderation never issues a refund by itself.

14. Children

HELP ME RETIRE is intended for people aged 18 and over.

We do not knowingly permit children to make contributions or submit public notes.

If you believe that a child has provided personal data to us, contact jakubk@fastmail.com and provide enough information for us to identify the relevant data.

15. Security

We use reasonable technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

No internet service can guarantee absolute security.

16. Changes to this Privacy Notice

We may update this Privacy Notice when the Service, our processing activities or applicable law changes.

The effective date and last-updated date at the top of this notice show the current version.

If we make a material change to how we process personal data, we will publish the updated notice on the website and take any additional steps required by applicable law.