Privacy Policy

Lachezar Simeonov, an individual based in Ruse, Bulgaria, European Union (Clicks & Swagger is his personal project) is the data controller for your personal information collected through this website.

Contact Email: inquiries [at] clicksandswagger.com

Location: Ruse, Bulgaria, European Union

For any questions about how we handle your data, please contact us at the email above.

Email Address: When you subscribe to our newsletter, submit a song request, vote, or contact us, we collect your email address.

Name: If you provide your name (optional for some forms), we store it to personalize communications. For new submissions, your name appears in the Hall of Fame only if you tick the optional consent box. Names from earlier submissions remain listed unless you ask us to remove them.

Messages: Content you send through our contact form.

Usage Data: With your consent, we collect analytics data about how you use our website (pages viewed, approximate location, device and browser). It is linked to a random cookie ID, not to your name or email, which makes it pseudonymous rather than anonymous.

Anyone can ask to have their name removed from the Hall of Fame by emailing inquiries@clicksandswagger.com.

This website is not intended for anyone under 16. Some songs contain explicit language, and several EU countries set 16 as the age for consenting to online services, so we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact inquiries@clicksandswagger.com and we will delete it.

If the project is sold or transferred, personal data may transfer to the new owner, who will be bound by this policy, and users will be notified in advance.

We process your personal data under the following legal bases (GDPR Article 6):

• Consent (Art. 6(1)(a)): Newsletter subscriptions, analytics cookies, song request submissions

• Legitimate Interest (Art. 6(1)(f)): Responding to contact form inquiries, security measures (CAPTCHA, rate limiting)

• Contract Performance (Art. 6(1)(b)): Delivering services you've requested (email notifications, song voting)

You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Essential Cookies: Necessary for the website to function (e.g., cookie consent preference, security verification).

Analytics Cookies: Only if you accept analytics cookies, we use Google Analytics 4 and Microsoft Clarity to understand how visitors use our site. Nothing analytics-related loads before you consent, and you can withdraw consent at any time via the *Cookie preferences* link in the footer.

For detailed information about each cookie, see our Cookie Policy.

We count page requests on the server (page, referring site, campaign tags, country, device type) without cookies or identifiers to know how many people visit. Nothing is stored on your device for this.

We use Google Analytics 4 (GA4) to analyze website traffic. This service is only activated if you accept cookies. GA4 collects:

• Pages you visit and how long you stay

• Your approximate location (country/city)

• Device type and browser information

• How you found our website

We configure Google Analytics to minimise the data it collects and do not use it to identify you. Data retention: 14 months (GA4 default).

Microsoft Clarity: we also use Microsoft Clarity for session replay and heatmaps, again only after you accept analytics cookies. Clarity records interaction data (clicks, scrolls, mouse movement, page structure) to show us where pages confuse people. Sensitive input fields are masked by default and we do not use it to identify you. Microsoft acts as a processor and may process data in the United States under the EU-US Data Privacy Framework, with EU Standard Contractual Clauses as a fallback. Data retention: 30 days.

We retain your personal data only as long as necessary:

• Email subscribers: Until you unsubscribe + 30 days (then anonymized)

• Unverified subscriptions: Deleted after 7 days

• Contact messages: 2 years, then permanently deleted

• Song suggestions: the idea itself stays public; your email address is removed once the idea is rejected or after 180 days, whichever comes first

• Votes: stored as a one-way SHA-256 hash of your email address rather than the address itself (pseudonymised data).

• Release reminders: deleted after the notification for that song is sent

• Analytics data: 14 months in Google Analytics, 30 days in Microsoft Clarity, 14 months for our own first-party event counters

• Consent records: 3 years, kept as legally required evidence that consent was given (Art. 7(1) GDPR)

An automated cleanup job runs weekly to enforce every one of these retention periods.

If you subscribe to our newsletter, we use a double opt-in process for GDPR compliance:

1. You submit your email address

2. Your address is verified before anything is sent to it

3. Your subscription is only activated once that confirmation is complete

You can unsubscribe at any time via the link in every email or through your preferences page.

We do not sell, trade, or share your email address with third parties for marketing purposes.

We use the following third-party services to process your data. All have signed Data Processing Agreements (DPAs) compliant with GDPR:

• Supabase / Lovable Cloud (Database & backend): Stores subscriber data, contact messages, and song requests. Hosted in the European Union (Ireland, eu-west-1); this data stays inside the EEA and is not transferred to a third country.

• Google Analytics (Analytics): Processes pseudonymous usage data (linked to a random cookie ID), only after you accept analytics cookies. Google LLC is US-based and certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply as a fallback.

• Microsoft Clarity (Analytics / session replay): Processes pseudonymous interaction and heatmap data, only after you accept analytics cookies. Microsoft Corporation is US-based and certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply as a fallback.

• Cloudflare (Security/CAPTCHA/CDN/DNS): Provides Turnstile verification, edge hosting, content delivery, and domain DNS. Cloudflare, Inc. is US-based and certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply as a fallback.

• Lovable (Hosting & platform): Hosts and builds the website and its backend infrastructure. EU Standard Contractual Clauses apply where data leaves the EEA.

• Resend (Resend, Inc., USA): sends our emails. Transfers are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.

• Fonts are self-hosted on our own domain, so no data about your visit is sent to Google Fonts.

Where processors are outside the EEA, transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

Under GDPR, you have the following rights:

• Right to Access (Art. 15): Request a copy of all personal data we hold about you

• Right to Rectification (Art. 16): Request correction of inaccurate data

• Right to Erasure (Art. 17): Request deletion of your personal data

• Right to Portability (Art. 20): Receive your data in a machine-readable format

• Right to Object (Art. 21): Object to processing based on legitimate interest

• Right to Withdraw Consent: Withdraw consent at any time, including cookie consent via the "Cookie preferences" link in the footer

• No automated decision-making: We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects (Art. 22 GDPR).

To exercise any of these rights, use our Data Request form or contact us directly.

We implement appropriate technical and organizational measures to protect your data:

• Email hashing: Vote emails are stored only as SHA-256 hashes; song suggestion emails are stored alongside a hash and cleared automatically

• CAPTCHA protection: All forms are protected by Cloudflare Turnstile

• Rate limiting: Protection against abuse at both application and database levels

• HTTPS encryption: All data transmitted is encrypted in transit

• Access controls: Row-level security restricts data access

• Log sanitization: Personal data is masked in server logs