PRIVACY POLICY

1. Controller (Art. 4 No. 7 GDPR)

Hung Long Vu (resident in Germany)
Bahnstraße 15
65205 Wiesbaden
Germany
Email: info@hunglongvu.com

2. What We Collect and Why

2.1 IP Address

• — Purpose: Rate limiting (max. 3 roasts per IP per day) and bot protection
• — Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in preventing abuse)
• — Storage duration: Automatically deleted after 24 hours
• — Storage location: Upstash Redis (EU-Frankfurt)

2.2 Submitted URLs and Generated Roasts

• — Purpose: Display in Hall of Shame and Recent Roasts feed; service functionality
• — Legal basis: Art. 6 (1) (a) GDPR (consent via ownership checkbox) and Art. 6 (1) (f) GDPR
• — Storage duration: Until removal request or 12 months, whichever comes first
• — Storage location: Supabase (EU)

2.3 Server Logs

• — Purpose: Technical operation, security, debugging
• — Data: IP address, user agent, timestamp, requested URL
• — Legal basis: Art. 6 (1) (f) GDPR (legitimate interest)
• — Storage duration: 14 days, then automatically deleted
• — Storage location: Vercel (USA, with EU Standard Contractual Clauses + DPA)

2.4 Cookies and Similar Technologies

When you first visit getroasted.wtf, the following cookies may be set:

Strictly Necessary (No consent required under § 25 (2) TTDSG):

• — session: Vercel hosting session (deleted on browser close)
• — cookieNoticeAccepted: Your cookie notice acknowledgment (local storage, 1 year)

Set when you interact with the roast form:

• — cf_*: Cloudflare Turnstile bot protection (set ONLY on form submission, not on page load via lazy-loading)

We use lazy-loading to prevent unnecessary cookies on landing page visits.

We do NOT use:

• — Tracking cookies
• — Advertising cookies
• — Analytics tracking
• — Social media tracking pixels
• — Cross-site tracking

Legal basis: § 25 (2) TTDSG for strictly necessary cookies. Cookies set on form interaction fall under legitimate interest (Art. 6 (1) (f) GDPR) for spam and bot prevention.

3. Third-Party Services and Data Processing Agreements

We have entered into Data Processing Agreements (DPAs) with all third-party service providers.

3.1 Vercel Inc. (Hosting – Pro Plan)

• — Location: USA
• — Data transferred: IP address, requests, technical logs
• — Safeguard: EU Standard Contractual Clauses + DPA
• — DPA: https://vercel.com/legal/dpa (auto-incorporated via Pro Plan agreement)
• — Privacy policy: https://vercel.com/legal/privacy-policy

3.2 Anthropic PBC (AI Roast Generation)

• — Location: USA
• — Data transferred: Submitted URLs, page content snippets
• — Safeguard: EU Standard Contractual Clauses + DPA
• — DPA: https://www.anthropic.com/legal/data-processing-addendum (auto-incorporated via Commercial Terms of Service)
• — Note: As of May 2026, Anthropic's policy is that API inputs are not used for model training. For current policy, see: https://privacy.anthropic.com/
• — Privacy policy: https://anthropic.com/legal/privacy

3.3 Upstash Inc. (Rate Limiting)

• — Location: Database in EU-Frankfurt; company USA
• — Data transferred: Hashed IP addresses
• — Safeguard: EU Standard Contractual Clauses + DPA
• — DPA: https://upstash.com/static/trust/dpa.pdf (auto-incorporated via Terms of Service)
• — Privacy policy: https://upstash.com/trust/privacy.pdf

3.4 Supabase Inc. (Database)

• — Location: EU region
• — Data transferred: Submitted URLs, generated roasts
• — Safeguard: EU hosting + signed DPA (PandaDoc, dated May 21, 2026)
• — DPA: https://supabase.com/legal/dpa
• — Privacy policy: https://supabase.com/privacy

3.5 ScreenshotOne (Page Screenshots)

• — Location: EU
• — Data transferred: URLs to be screenshotted
• — Safeguard: EU hosting (Article 44 GDPR not triggered)
• — DPA: Available on request from screenshotone.com
• — Privacy policy: https://screenshotone.com/privacy

3.6 Cloudflare Inc. (Bot Protection – Turnstile)

• — Location: USA
• — Data transferred: IP address, browser fingerprint, device data
• — Safeguard: EU Standard Contractual Clauses + DPA + EU-U.S. Data Privacy Framework
• — DPA: https://www.cloudflare.com/cloudflare-customer-dpa/ (auto-incorporated via Cloudflare Terms)
• — Implementation: Lazy-loaded on form submission only
• — Privacy policy: https://cloudflare.com/privacypolicy

4. International Data Transfers

Some of our service providers are located outside the EU (primarily USA). In such cases, we ensure adequate protection through:

• — EU Standard Contractual Clauses (SCC) – 2021 version
• — EU-U.S. Data Privacy Framework (where applicable)
• — Encrypted transmission (TLS 1.3 / HTTPS)
• — Encrypted storage (AES-256 at rest)

You acknowledge that, despite these safeguards, US authorities may have access to data under US surveillance laws (CLOUD Act, FISA 702) as established in the Schrems II ruling of the European Court of Justice (Case C-311/18).

We minimize US transfers where possible by preferring EU-located providers and EU-region deployments.

5. Your Rights Under GDPR

You have the following rights regarding your personal data:

• — Art. 15 GDPR (Right of access): Request information about data we have on you
• — Art. 16 GDPR (Right to rectification): Correction of inaccurate data
• — Art. 17 GDPR (Right to erasure / "right to be forgotten"): Deletion of your data
• — Art. 18 GDPR (Right to restriction): Limit processing
• — Art. 20 GDPR (Right to data portability): Receive your data in machine-readable format
• — Art. 21 GDPR (Right to object): Object to processing based on legitimate interest
• — Art. 77 GDPR (Right to lodge a complaint): With the supervisory authority

To exercise these rights, contact info@hunglongvu.com. We respond within 30 days (Art. 12 (3) GDPR).

Supervisory authority for Hessen:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163, 65021 Wiesbaden
https://datenschutz.hessen.de

6. URL Removal Requests

If your URL has been submitted to getroasted.wtf without your authorization, you can request immediate removal:

• — Email: info@hunglongvu.com
• — Subject: “Removal Request”
• — Include: The URL to be removed

We respond and remove within 48 hours, no questions asked. No verification of ownership is required – we operate on good faith for removal requests.

After removal:

• — URL is added to a technical blacklist
• — Re-submission is automatically prevented
• — All cached versions are purged
• — Share cards become unavailable

7. Data Security

We use industry-standard security measures:

• — HTTPS/TLS 1.3 encryption for all data transmission
• — AES-256 encrypted database storage
• — Limited access controls (least-privilege principle)
• — Regular security updates
• — Bot protection via Cloudflare Turnstile

However, no internet transmission can be 100% secure. We notify users and authorities of any data breach within 72 hours as required by Art. 33 GDPR.

8. Children's Privacy

This service is not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has used this service, please contact us at info@hunglongvu.com for immediate data deletion.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be:

• — Indicated by updating the “Last updated” date and version number
• — Documented in the version history section below
• — For substantial changes affecting user rights: notified via website banner

By continuing to use the service after changes, you accept the updated policy.

10. Contact

For any privacy-related questions or to exercise your rights:

Hung Long Vu
Bahnstraße 15
65205 Wiesbaden
Germany
Email: info@hunglongvu.com
Response time: Within 30 days (typically 24–48 hours)

11. Automated Decision-Making (Art. 22 GDPR)

getroasted.wtf uses AI (Anthropic's Claude API) to generate automated roast scores (0–100) and text content for submitted URLs. This constitutes “automated processing” under Art. 22 GDPR.

However, this processing:

• — Does NOT produce legal effects on data subjects
• — Is for entertainment and satirical purposes only
• — Does NOT involve profiling of individuals
• — Does NOT affect employment, credit, legal status, or any consequential decisions
• — Does NOT use personal data beyond the publicly accessible URL content

User rights regarding automated outputs:

• — Right to human review of any generated roast
• — Right to removal within 48 hours (no questions asked)
• — Right to correction if factually inaccurate
• — Right to explanation of the AI scoring logic

The AI scoring is satirical in nature and does NOT represent factual evaluation of business quality, product merit, or individual capability.

For complete transparency, we can provide on request:

• — The exact prompt used for generation
• — The AI model and version
• — The timestamp of generation
• — The original URL content at time of roast

Contact info@hunglongvu.com for any of these requests.

12. Marketing Communications

We currently do not operate a newsletter or marketing communications. If we introduce such services in the future, this Privacy Policy will be updated accordingly with separate consent mechanisms (double opt-in) as required by § 7 Abs. 2 UWG.

13. Version History

• — v1.0 (May 21, 2026): Initial release with full GDPR + TMG + TTDSG compliance, including DPAs with all subprocessors