Privacy Policy

Clicks & Swagger is the data controller for your personal information collected through this website.

Contact Email: inquiries [at] clicksandswagger.com

Location: Bulgaria, European Union

For any questions about how we handle your data, please contact us at the email above.

Email Address: When you subscribe to our newsletter, submit a song request, vote, or contact us, we collect your email address.

Name: If you provide your name (optional for some forms), we store it to personalize communications.

Messages: Content you send through our contact form.

Usage Data: With your consent, we collect anonymized analytics data about how you interact with our website.

We process your personal data under the following legal bases (GDPR Article 6):

• Consent (Art. 6(1)(a)): Newsletter subscriptions, analytics cookies, song request submissions

• Legitimate Interest (Art. 6(1)(f)): Responding to contact form inquiries, security measures (CAPTCHA, rate limiting)

• Contract Performance (Art. 6(1)(b)): Delivering services you've requested (email notifications, song voting)

You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Essential Cookies: Necessary for the website to function (e.g., cookie consent preference, security verification).

Analytics Cookies: Only if you accept analytics cookies, we use Google Analytics 4 and Microsoft Clarity to understand how visitors use our site. Nothing analytics-related loads before you consent, and you can withdraw consent at any time via the *Cookie preferences* link in the footer.

For detailed information about each cookie, see our Cookie Policy.

We use Google Analytics 4 (GA4) to analyze website traffic. This service is only activated if you accept cookies. GA4 collects:

• Pages you visit and how long you stay

• Your approximate location (country/city)

• Device type and browser information

• How you found our website

Google Analytics does not collect personally identifiable information. Data retention: 14 months (GA4 default).

Microsoft Clarity: we also use Microsoft Clarity for session replay and heatmaps, again only after you accept analytics cookies. Clarity records anonymised interaction data (clicks, scrolls, mouse movement, page structure) to show us where pages confuse people. Sensitive input fields are masked by default and we do not use it to identify you. Microsoft acts as a processor and may process data in the United States under the EU–US Data Privacy Framework, with EU Standard Contractual Clauses as a fallback. Data retention: 30 days.

We retain your personal data only as long as necessary:

• Email subscribers: Until you unsubscribe + 30 days (then anonymized)

• Unverified subscriptions: Deleted after 7 days

• Contact messages: 2 years, then permanently deleted

• Song suggestions: the idea itself stays public; your email address is removed once the idea is rejected or after 180 days, whichever comes first

• Votes: stored only as a one-way SHA-256 hash of your email address, so the vote cannot be traced back to you

• Release reminders: deleted after the notification for that song is sent

• Analytics data: 14 months in Google Analytics, 30 days in Microsoft Clarity, 14 months for our own first-party event counters

• Consent records: 3 years, kept as legally required evidence that consent was given (Art. 7(1) GDPR)

An automated cleanup job runs weekly to enforce every one of these retention periods.

If you subscribe to our newsletter, we use a double opt-in process for GDPR compliance:

1. You submit your email address

2. Your address is verified before anything is sent to it

3. Your subscription is only activated once that confirmation is complete

Automated email sending is currently switched off. Until it is enabled, confirmations are handled manually by us and no marketing email leaves the site.

You can unsubscribe at any time via the link in every email or through your preferences page.

We do not sell, trade, or share your email address with third parties for marketing purposes.

We use the following third-party services to process your data. All have signed Data Processing Agreements (DPAs) compliant with GDPR:

• Supabase (Database): Stores subscriber data, contact messages, and song requests. Hosted in the European Union (Ireland, eu-west-1) — this data stays inside the EEA and is not transferred to a third country.

• Google Analytics (Analytics): Processes anonymised usage data, only after you accept analytics cookies. Google LLC is US-based and certified under the EU–US Data Privacy Framework; EU Standard Contractual Clauses apply as a fallback.

• Microsoft Clarity (Analytics / session replay): Processes anonymised interaction and heatmap data, only after you accept analytics cookies. Microsoft Corporation is US-based and certified under the EU–US Data Privacy Framework; EU Standard Contractual Clauses apply as a fallback.

• Cloudflare (Security/CAPTCHA/CDN): Provides Turnstile verification, edge hosting and content delivery. Cloudflare, Inc. is US-based and certified under the EU–US Data Privacy Framework; EU Standard Contractual Clauses apply as a fallback.

• Lovable (Hosting & platform): Hosts and builds the website and its backend infrastructure. EU Standard Contractual Clauses apply where data leaves the EEA.

We do not currently send automated emails. Verification, notification and reply emails are handled manually from the addresses listed in this policy, so no email delivery provider processes your data at this time.

• Fonts are self-hosted on our own domain, so no data about your visit is sent to Google Fonts.

Under GDPR, you have the following rights:

• Right to Access (Art. 15): Request a copy of all personal data we hold about you

• Right to Rectification (Art. 16): Request correction of inaccurate data

• Right to Erasure (Art. 17): Request deletion of your personal data

• Right to Portability (Art. 20): Receive your data in a machine-readable format

• Right to Object (Art. 21): Object to processing based on legitimate interest

• Right to Withdraw Consent: Withdraw consent at any time, including cookie consent via the "Cookie preferences" link in the footer

• No automated decision-making: We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects (Art. 22 GDPR).

To exercise any of these rights, use our Data Request form or contact us directly.

We implement appropriate technical and organizational measures to protect your data:

• Email hashing: Vote emails are stored only as SHA-256 hashes; song suggestion emails are stored alongside a hash and cleared automatically

• CAPTCHA protection: All forms are protected by Cloudflare Turnstile

• Rate limiting: Protection against abuse at both application and database levels

• HTTPS encryption: All data transmitted is encrypted in transit

• Access controls: Row-level security restricts data access

• Log sanitization: Personal data is masked in server logs