Privacy
The controller is StakeSquid OÜ (Estonia). The service runs in Germany on Hetzner. Nightly database backups stay in the European Union.
A channel is the seller account. Email is optional. It is used only to send a magic-link sign-in. There are no passwords and no third-party trackers. This page loads no script from another site.
What is stored
We keep counters. You keep evidence.
- Channel profile: home country, previous-year turnover, forecast flag, optional email. The email is the only personal datum on a channel, and only when you stored one for magic-link sign-in.
- API keys as a sha256 hash, plus a short prefix so you can recognise one.
- Registrations you enter (jurisdiction, kind, identifier, valid-from).
- Decisions: the yes/no, the reason, the rule version, the declared country and region, and the time.
- Reports: sale id, amount, currency, declared country and region, period, and the time (so a 30-day projection has dates).
- Counters per channel, jurisdiction, and period.
What is not stored
- The buyer IP address, a hash of that IP, or any other evidence hash.
- The attestation.
decidereturns a signed attestation. You keep it. The public key isGET /v1/keys. - A phone number.
- A state or province from GeoIP. GeoIP is country-level and is used in memory. The region is whatever the caller declared.
Legal basis
Contract, for running the channel you opened. Legitimate interest, for keeping the service available and for the integrity of the decision log.
Retention
| Record | Kept |
|---|---|
| Decisions | 13 months, then deleted |
| Reports | For the life of the channel |
| Profile, email, registrations, keys | Until the channel is deleted |
| Counters after deletion | Anonymous totals only. They are not tied to the channel. |
| Backups | Nightly dump, European Union only |
Your tools
A channel can export its data (export_data, or Export on the profile) and erase itself (delete_channel with confirmation). Erasure removes the email, the keys, the decisions, and the reports.
Server logs do not keep IP addresses. Log lines that contain an IP-shaped string are scrubbed.
Rules are versioned data. This page does not tell you what to file, where.