Privacy notice
The short version. We collect as little as we can. The free checklist runs in your browser and sends us nothing. We never ask for your password, never log in to your accounts, and never sell or share your data for advertising. There are no cookies and no ad trackers on this site.
Who we are
Creator Lockdown is run by [TODO: obrt name, OIB, address, Zagreb, Croatia], the data controller. Contact: privacy@creatorlockdown.com.
What we collect, and why
| When | What | Why (legal basis) | Kept for |
|---|---|---|---|
| You use the Sponsor X-Ray checklist | Nothing. It runs entirely in your browser. | — | — |
| You sign up for Campaign Alerts, a waitlist or a Sponsor Check reservation | Email address, which list or tag you joined, sign-up date, and email open/click data from our email provider | To send what you asked for (consent, GDPR Art. 6(1)(a), given by double opt-in) | Until you unsubscribe. Reservations: until checks open or 12 months, whichever is first |
| You buy something | Gumroad, our reseller, processes your name, email, payment and tax details as its own controller. We receive your name, email, country and order details. | To deliver your order and keep tax records (contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c)) | Order records: as long as Croatian accounting law requires [TODO: confirm period with knjigovođa] |
| You send us an email for a Sponsor Check (when checks open) | The text and headers of the email you forward. We refuse attachments and never open links in it. | To give the review you asked for (contract, Art. 6(1)(b)) | Deleted after 30 days |
| You visit any page | Cookieless, aggregate analytics (page, referrer, country, device type). No personal profile, no cookies. | To see which pages help people (legitimate interest, Art. 6(1)(f)) | Aggregate only |
The site is for people aged 16 and over. Please don’t sign up if you’re younger.
Who processes data for us
- Cloudflare (hosting, cookieless web analytics). [TODO: confirm DPA and transfer mechanism]
- Kit (email lists and sending), USA. [TODO: confirm DPA and EU–US Data Privacy Framework or SCCs]
- Gumroad (checkout, VAT, delivery), USA. It acts as reseller and an independent controller for payments; see Gumroad’s privacy policy.
- [TODO when checks open: intake form provider, e.g. Tally (EU-hosted)]
We don’t use any AI service on emails you send us, and we don’t sell data.
Your rights
You can ask for a copy of your data, or ask us to correct it, delete it, limit how we use it, or move it. You can object to processing based on legitimate interest, and you can withdraw consent at any time: every email has an unsubscribe link. Write to the contact above and we’ll answer within one month.
You can also complain to the Croatian data protection authority, AZOP (Agencija za zaštitu osobnih podataka, azop.hr), or to the authority where you live.
Security
We’re run by a working penetration tester, so we treat this seriously: least data, short retention, no attachments, two-factor sign-in with security keys on every account we use. If you find a security issue on this site, see security.txt.
Changes
If we change this notice in a way that matters, we’ll update the date above and tell Campaign Alerts subscribers.