Privacy Policy & Data Protection
At Siscaller, data privacy is an engineering invariant, not a disclaimer. We do not sell data, we do not run third-party advertising trackers, and our systems are designed around strict data minimization and cryptographic consent proofs.
1. Core Architecture Principles
- Zero Advertising Trackers: We deploy no Meta Pixels, Google Tag Manager scripts, or behavioral cross-site trackers.
- Salted IP Hashing: IP addresses collected during newsletter subscription and page views are salted and hashed with SHA-256 before storage or rate-limit checks. Raw IP addresses are discarded immediately.
- Strict Double Opt-In: Newsletter subscribers receive a 48-hour HMAC cryptographic token. Unverified emails never receive newsletter dispatches.
- RFC 8058 One-Click Unsubscribe: Every outbound email includes mandatory automated unsubscribe headers.
2. Data We Collect & Lawful Basis
| Data Category | Specific Elements | GDPR Lawful Basis |
|---|---|---|
| Newsletter Subscribers | Email address, preferred topics, frequency, double opt-in timestamp, salted IP hash. | Consent (Art. 6(1)(a) GDPR) via cryptographic proof. |
| Registered Accounts | Email address, hashed password (Argon2id/Bcrypt via Supabase Auth), MFA TOTP factors, display name, username. | Contractual necessity (Art. 6(1)(b) GDPR). |
| Security Audit Logs | Auth events (login, password reset, MFA changes), role transitions, timestamp. | Legitimate interest (Art. 6(1)(f) GDPR) — infrastructure protection. |
3. Authorized Third-Party Subprocessors
We engage vetted technical service providers under strict Data Processing Agreements (DPAs) with Standard Contractual Clauses (SCCs):
Supabase Inc.
Privacy Notice ↗Primary database (PostgreSQL), user authentication, and media storage
Region: EU (Frankfurt, Germany - AWS eu-central-1)
Vercel Inc.
Privacy Notice ↗Edge compute, global content delivery (CDN), and preview deployments
Region: Global Edge Network / United States
Resend Inc.
Privacy Notice ↗Transactional email delivery, double opt-in confirmations, and newsletter dispatches
Region: United States (isolated subdomain news.siscaller.com)
Upstash Inc.
Privacy Notice ↗In-memory Redis for IP-hash sliding window rate limiting and view deduping
Region: EU (Frankfurt, Germany)
Cloudflare Inc.
Privacy Notice ↗DNS resolution and Turnstile privacy-preserving bot detection
Region: Global Anycast Network
4. Your Rights Under GDPR & CCPA
You hold complete control over your personal data:
- Right to Access & Portability: You may request an export of all account and subscription records associated with your email.
- Right to Erasure (“Right to be Forgotten”): You can delete your account and all associated tokens at any time via Security Settings, triggering cascading database deletion.
- Right to Rectification: Manage topics, frequency, and contact preferences anytime via the Newsletter Preferences Center.
5. Contact & Security Inquiries
For data protection requests, privacy queries, or vulnerability reports under our responsible disclosure policy: