Privacy policy

Data controller

The controller of personal data processed on Celebrumi is:

Name

—

Address

—

Email

—

Browsing the site

You don't need an account to browse the calendar, holidays and ideas. We don't ask for your name, email address or any other details.

The server running Celebrumi technically receives your IP address and browser details in order to send you the page. They are used to handle the connection, for security and to fix outages (legitimate interest, Art. 6(1)(f) GDPR).

User accounts

When you sign up, we process your email address, the name you choose to show to others, a hash of your password (we never store the password itself), your language and a dated record of the documents and consents you accepted. We need this data to provide your account (performance of a contract, Art. 6(1)(b) GDPR). When you report content to moderators, we store the reason, the optional details and which account sent the report. Only moderators see reports.

We send the emails your account needs to your address: a link confirming it, a link to change your password and news of moderation decisions on your ideas and comments (you can turn those off on the “My account” page). We only send news if you give separate consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

We keep account data until you delete the account. On the “My account” page you can download your data as a JSON file and delete the account at any time. Consents, favourites, votes, notifications and sessions are deleted with the account; published ideas and comments are deleted or kept without your name, as you choose, and unpublished ones are always deleted. Your reports of content stay, no longer linked to the account, until moderators handle them. Deleted data leaves the backups when they expire.

Clicks on shop links

When you click a button that leads to a shop, we record which product and idea were chosen, the page language, the page the click came from, and the time. This tells us which ideas are useful and lets us settle accounts with affiliate programs.

We don't store your IP address. To tell repeated clicks by the same person apart, we create a one-way hash of the IP address and browser combined with a random key that exists for one day only and only in the server's memory. After that day the hash can't be linked to anyone. The legal basis is legitimate interest (Art. 6(1)(f) GDPR).

Cookies

We use two cookies that the service needs to work: NEXT_LOCALE remembers your language and is removed when you close the browser, and the session cookie (sw_session) keeps you signed in for 30 days or until you sign out. The session cookie holds only a random identifier. When you close the introduction on the home page, your browser remembers it in session storage (sessionStorage, key celebrumi:intro-dismissed). It is not a cookie, is never sent to the server and disappears when you close the tab.

We don't use analytics or advertising cookies. If that changes, we will ask for your consent first.

Error reports

When an error occurs, we send a technical report (page address, browser type, error description) to Sentry so we can fix it. We send error reports only, with no performance measurements or visit statistics. The report may include connection data such as your IP address. We use it only to fix errors (legitimate interest, Art. 6(1)(f) GDPR).

Sentry is run by a company based in the USA. If data leaves the European Economic Area, this happens under the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.

Shops and affiliate programs

Some links lead to shops such as Allegro or Amazon and are affiliate links. Once you are in the shop, its privacy policy applies, and the shop may use its own cookies to attribute the purchase to our affiliate program.

Product images on idea pages load directly from the shops' servers, and holiday pictures taken from other sites load from those sites' servers. Your browser then connects to those servers and sends them your IP address and browser details, even if you don't click the link. Celebrumi's own holiday illustrations load from our server.

Recipients

Our hosting provider, Sentry (error reports) and the email provider that delivers account messages process data on our behalf. We do not sell data or pass it to advertisers.

Traffic to the service passes through Cloudflare (content delivery network and DNS), which technically receives your IP address and browser information to protect the service from attacks and speed up loading. Cloudflare is based in the USA; data is transferred under the EU-US Data Privacy Framework or standard contractual clauses.

Hosting

Scaleway SAS (Francja / France)

Server location

Warszawa / Warsaw, PL

Error reports

Sentry (Functional Software, Inc., USA)

CDN and DNS

Cloudflare, Inc. (USA)

Email delivery

Brevo (Sendinblue SAS, France)

How long we keep data

We keep data only as long as needed:

Server logs

—

Error reports

—

Click log

kept for statistics; after one day an entry can't be linked to anyone

Database backups

up to 30 days

Your rights

You have the right to access, rectify, erase and port your data, to restrict its processing and to object to it. You can download your data and delete your account on the “My account” page; for anything else, write to us at the address above. If your account is blocked and you cannot sign in, write to us and we will send you your data or delete the account for you.

You can also lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

Changes to this policy

When we add new features, we will update this page and the date of the last update.