Privacy notice

Controller and contact

The controller for personal data processed through FediPass, FediPay and FediID is:

Heino Falcke

Heinrich-Imig-Str. 31 50226 Frechen, Germany

Email for privacy requests: fedipass@fedipass.org

Data protection officer, where appointed: DUMMY: CONTACT OR NOT APPLICABLE.

Data we use and its purposes

FediID manages your linked Fediverse accounts, service-specific identifiers, verified email addresses, language preferences and security methods. These include login sessions, two-factor authentication and recovery options. We use this information to authenticate you, associate accounts, communicate with you and protect access.

FediPass processes your Fediverse identifier, participation and profile settings, and the follow and usage information needed to allocate contributions. This information comes from you and, within the permissions you grant, your Fediverse server. It is used to identify participating content providers, software projects and services and to prepare allocation reports.

FediPay processes your customer reference, name, contact and billing details, plan, subscription status, invoices, payment status and references needed to reconcile payments. Recipient accounts also contain information about the service provided, the receiving person or organisation, payout details and statements.

Operating the websites also involves technical connection data such as IP address, access time, requested page and browser information. Security records document events such as logins and security-related account changes. These records help protect the services and investigate faults and misuse.

Legal bases

Processing necessary for login, contract performance and billing relies on Article 6(1)(b) GDPR. Legally required retention and records rely on Article 6(1)(c). System protection and prevention of misuse rely on Article 6(1)(f); our interest is secure and reliable operation.

Where additional, optional processing relies on your consent, Article 6(1)(a) applies. You may withdraw that consent for the future without affecting the lawfulness of earlier processing.

Sharing and recipients

FediID supplies a connected service with the identifiers and attributes needed for its login and authorized use. FediPass and FediPay exchange the information needed to associate contributions and plans. Invoices, detailed accounting ledgers and payment credentials are not stored as FediID attributes. FediPass does not receive billing addresses or payment credentials from FediPay.

When you log in through a Fediverse server, its operator handles that login under its own privacy information. The OAuth permission FediPass uses for analytics is separate from central login through FediID.

We use providers for hosting, email delivery and payment processing. They receive the data needed for their tasks. Authorities and other entitled bodies receive data where a legal duty or another lawful basis requires or permits disclosure.

Hosting and operations: DUMMY: PROVIDER, ADDRESS AND PROCESSING LOCATION.
Email delivery: DUMMY: PROVIDER, ADDRESS AND PROCESSING LOCATION.
Payment processing and payouts: DUMMY: PROVIDER, ROLE AND PRIVACY LINK.
Transfers outside the European Economic Area and safeguards: DUMMY: AFFECTED PROVIDERS AND TRANSFER BASIS OR NONE.

Retention

We retain personal data for as long as its purpose requires. Afterwards it is deleted or anonymized unless a legal retention duty or necessary evidence requires continued storage. Data retained for such limited purposes is no longer used for ordinary account operation.

Account data after use ends: DUMMY: DELETION PERIOD AND EXCEPTIONS.
Access and security records: DUMMY: PERIOD FOR EACH RECORD TYPE.
Invoices, statements and contractual evidence: DUMMY: APPLICABLE RETENTION PERIODS.
Backups: DUMMY: REPLACEMENT AND DELETION CYCLE.

Your rights

Subject to the legal conditions, you may request access, correction, erasure, restriction and portability. You may object to processing based on legitimate interests for reasons relating to your particular situation, and to direct marketing at any time.

Contact us using the address above. To avoid disclosure to an unauthorized person, we may request proportionate identity evidence. You may also complain to a data protection authority, particularly where you normally live, work or believe an infringement occurred.

Data protection authority responsible for the operator: DUMMY: AUTHORITY NAME AND CONTACT.

Required information and account settings

Without information necessary for login and contract performance, we cannot provide the relevant service. Additional profile details are optional. An unverified email address can prevent email-based recovery, email two-factor authentication and reliable delivery of contractual information.

Your FediID profile displays identities, email addresses and security settings. Service-specific billing and participation data remain in FediPay and FediPass respectively. Cancelling a subscription does not automatically delete your accounts at other services.

Solely automated decisions with legal or similarly significant effects: DUMMY: NONE OR DESCRIPTION INCLUDING LOGIC AND EFFECTS.