1. Overview

FlagRiser ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

• Device Information: Browser type, operating system, device type, screen resolution
• Usage Data: Pages viewed, time spent on site, click patterns, referring sites
• Location Data: Country and region (derived from IP address, not precise location)
• Log Data: IP address, access times, browser information

2.3 Information from Third Parties

• Stripe: Payment processing status and transaction confirmations
• Google Analytics: Aggregated usage statistics
• Social Media: Public profile information if you interact with our social accounts

3. How We Use Your Information

We use the collected information for the following purposes:

3.1 Service Provision

• Process your contributions and update flag positions
• Display real-time leaderboard updates
• Send payment confirmations and receipts
• Maintain competition integrity and prevent fraud

3.2 Communication

• Respond to your inquiries and support requests
• Send important updates about the service
• Notify winners and publish competition results

3.3 Improvement and Analytics

• Analyze usage patterns to improve user experience
• Test new features and functionality
• Generate aggregated statistics about the competition
• Create transparency reports about donations

3.4 Legal and Security

• Comply with legal obligations and regulations
• Detect and prevent fraudulent activities
• Enforce our Terms of Service
• Protect the rights and safety of users and the charity

4. Information Sharing and Disclosure

4.1 Service Providers

We share information with trusted third-party service providers who assist us in operating our platform:

• Stripe: Payment processing (PCI-DSS compliant)
• Google Analytics: Website analytics (anonymized data)
• Netlify: Website hosting and CDN services
• MongoDB Atlas: Database hosting (encrypted storage)

4.2 Public Information

The following information is publicly visible:

• Flag positions and contribution totals (aggregated, not individual)
• Total funds raised for charity

4.3 Legal Requirements

We may disclose information if required by law or if we believe in good faith that such action is necessary to:

• Comply with legal obligations or court orders
• Protect and defend our rights or property
• Prevent fraud or protect against security threats
• Protect the safety of users or the public

4.4 Business Transfers

In the unlikely event of a merger, acquisition, or sale of assets, user information may be transferred. We will provide notice before any such transfer and any changes to this privacy policy.

5. Cookies and Tracking Technologies

5.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our website. We use cookies to enhance your experience and analyze site usage.

5.2 Types of Cookies We Use

5.3 Managing Cookies

You can control cookies through your browser settings:

• Most browsers allow you to refuse or delete cookies
• Blocking essential cookies may prevent you from making contributions
• Visit aboutcookies.org for detailed instructions

5.4 Do Not Track

We respect Do Not Track (DNT) browser settings. When DNT is enabled, we disable analytics tracking for your session.

6. Data Security

We implement industry-standard security measures to protect your information:

6.1 Technical Safeguards

• Encryption: All data transmitted is encrypted using SSL/TLS
• Secure Storage: Databases are encrypted at rest
• Access Controls: Limited access on a need-to-know basis
• Regular Updates: Security patches applied promptly
• PCI Compliance: Payment processing meets PCI-DSS standards via Stripe

6.2 Incident Response

In the event of a data breach:

• We will notify affected users within 72 hours
• We will cooperate with relevant authorities
• We will take immediate steps to secure the breach
• We will document and learn from the incident

7. Data Retention

We retain your information only as long as necessary for the purposes outlined in this policy:

You may request deletion of your personal data at any time, subject to legal retention requirements.

8. Your Rights

8.1 GDPR Rights (European Union)

If you are in the European Union, you have the following rights:

8.2 CCPA Rights (California)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and share
• Delete your personal information (with some exceptions)
• Opt-out of the sale of personal information (we don't sell data)
• Non-discrimination for exercising your privacy rights

8.3 How to Exercise Your Rights

To exercise any of these rights, please contact us using the information provided below. We will respond to your request within 30 days.

9. Children's Privacy

FlagRiser is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws than your country.

10.1 Safeguards

When we transfer data internationally, we ensure appropriate safeguards:

• Standard Contractual Clauses approved by the European Commission
• Ensuring recipients are in countries with adequate data protection laws
• Implementing appropriate technical and organizational measures

10.2 Your Consent

By using our service, you consent to the transfer of your information as described in this policy.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons.

11.1 Notification of Changes

• Minor Changes: Posted on this page with updated "Last Modified" date
• Material Changes: Prominent notice on our website and/or email notification

11.2 Your Continued Use

Continued use of our service after changes constitutes acceptance of the updated policy. If you disagree with changes, please discontinue use of our service.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Supervisory Authority

EU residents have the right to lodge a complaint with their local supervisory authority if they believe their rights under GDPR have been violated.