cloutaroThis page explains how Cloutaro applies the EU General Data Protection Regulation (GDPR): what we process, on which legal bases, which rights you have, and how to use them. It works together with the Privacy Policy and the Cookie Policy.
What we process, and why
- Order data (target link, service, amount, receipt email): processed to perform the contract you enter when you buy. Legal basis: contract performance.
- Payment references (transaction ID, amount, status): processed to match payments to orders and handle refunds. Card numbers never reach us. Legal basis: contract performance and legal obligations.
- Support messages: processed to answer you and to document refill and refund decisions. Legal basis: contract performance and our legitimate interest in keeping honest records.
- Analytics (only after consent): processed to understand which pages work. Legal basis: consent, withdrawable at any time via the cookie settings.
- Fraud signals (order patterns, payment anomalies): processed to protect the service against abuse and fraudulent chargebacks. Legal basis: legitimate interest.
Your rights under the GDPR
- Access: ask what personal data we hold about you and receive a copy.
- Rectification: have wrong data corrected, for example a mistyped receipt email.
- Erasure: have your data deleted where no legal duty forces us to keep it; accounting laws require keeping order and payment records for the statutory period.
- Restriction: have processing limited while a dispute or verification is running.
- Portability: receive the data you gave us in a machine-readable format.
- Objection: object to processing based on legitimate interest, including fraud-signal processing, and we reassess it.
- Withdraw consent: analytics consent can be withdrawn at any time without affecting anything else.
How to exercise them
Email support@cloutaro.com from the address you used at checkout, name the right you invoke, and include your order ID if the request concerns an order. We answer within 30 days; where a request affects payment or accounting records, we tell you what must legally be retained and for how long.
Retention
Order and payment records are kept for the statutory accounting period, support threads for as long as they document an open commitment such as a refill window, and analytics data on Google's standard retention schedule. Data with no remaining purpose is deleted.
Transfers and processors
Our processors (hosting, payments, analytics) may process data outside the EU/EEA; where they do, transfers rest on EU standard contractual clauses or an adequacy decision. We do not sell personal data to anyone.
Complaints
If you believe we handle your data unlawfully, you can complain to your local data-protection authority in the EU/EEA country where you live, in addition to contacting us first so we can fix it faster.