Privacy Policy

Clicks & Swagger is the data controller for your personal information collected through this website.

Contact Email: inquiries [at] clicksandswagger.com

Location: Bulgaria, European Union

For any questions about how we handle your data, please contact us at the email above.

Email Address: When you subscribe to our newsletter, submit a song request, vote, or contact us, we collect your email address.

Name: If you provide your name (optional for some forms), we store it to personalize communications.

Messages: Content you send through our contact form.

Usage Data: With your consent, we collect anonymized analytics data about how you interact with our website.

We process your personal data under the following legal bases (GDPR Article 6):

• Consent (Art. 6(1)(a)): Newsletter subscriptions, analytics cookies, song request submissions

• Legitimate Interest (Art. 6(1)(f)): Responding to contact form inquiries, security measures (CAPTCHA, rate limiting)

• Contract Performance (Art. 6(1)(b)): Delivering services you've requested (email notifications, song voting)

You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Essential Cookies: Necessary for the website to function (e.g., cookie consent preference, security verification).

Analytics Cookies: If you accept cookies, we use Google Analytics to understand how visitors use our site.

For detailed information about each cookie, see our Cookie Policy.

We use Google Analytics 4 (GA4) to analyze website traffic. This service is only activated if you accept cookies. GA4 collects:

• Pages you visit and how long you stay

• Your approximate location (country/city)

• Device type and browser information

• How you found our website

Google Analytics does not collect personally identifiable information. Data retention: 14 months (GA4 default).

We retain your personal data only as long as necessary:

• Email subscribers: Until you unsubscribe + 30 days (then anonymized)

• Unverified subscriptions: Deleted after 7 days

• Contact messages: 2 years, then permanently deleted

• Song requests & votes: Indefinitely (public content with email hashed for privacy)

• Analytics data: 14 months (managed by Google)

Automated cleanup processes run weekly to enforce these retention periods.

If you subscribe to our newsletter, we use a double opt-in process for GDPR compliance:

1. You submit your email address

2. You receive a verification email

3. You click to confirm your subscription

You can unsubscribe at any time via the link in every email or through your preferences page.

We do not sell, trade, or share your email address with third parties for marketing purposes.

We use the following third-party services to process your data. All have signed Data Processing Agreements (DPAs) compliant with GDPR:

• Supabase (Database): Stores subscriber data, contact messages, and song requests. US-based with EU Standard Contractual Clauses.

• Resend (Email delivery): Sends verification and notification emails. GDPR-compliant.

• Google Analytics (Analytics): Processes anonymized usage data. US-based with EU Standard Contractual Clauses.

• Cloudflare (Security/CAPTCHA): Provides Turnstile verification and CDN. GDPR-compliant.

Under GDPR, you have the following rights:

• Right to Access (Art. 15): Request a copy of all personal data we hold about you

• Right to Rectification (Art. 16): Request correction of inaccurate data

• Right to Erasure (Art. 17): Request deletion of your personal data

• Right to Portability (Art. 20): Receive your data in a machine-readable format

• Right to Object (Art. 21): Object to processing based on legitimate interest

• Right to Withdraw Consent: Withdraw consent at any time

To exercise any of these rights, use our Data Request form or contact us directly.

We implement appropriate technical and organizational measures to protect your data:

• Email hashing: Voter emails are hashed (SHA-256) before storage for privacy

• CAPTCHA protection: All forms are protected by Cloudflare Turnstile

• Rate limiting: Protection against abuse at both application and database levels

• HTTPS encryption: All data transmitted is encrypted in transit

• Access controls: Row-level security restricts data access

• Log sanitization: Personal data is masked in server logs