Privacy notice
This notice explains what personal data Obligation Radar keeps when you create and use an account, why, for how long, and what you can ask for. It is written to be short; if something is unclear, write to the address below.
Who is responsible
Obligation Radar is run by Daniel Barcia Abella, an individual based in Vilnius, Lithuania, who is the controller of the personal data described here. Contact: daniel@obligationradar.com.
What we keep, and why
- Your account: email address and password (stored only in hashed form) or, if you sign in with Google, the name and email Google shares with us. Needed to give you an account (GDPR Art. 6(1)(b), contract).
- What you set up in the app: your jurisdictions, licence and themes, the rules you add to your portfolio or dismiss, your notes, and your app preferences (what Today shows you). Needed to show you your radar (Art. 6(1)(b)).
- Messages we send you: account emails (address confirmation, password reset, one welcome email when your account opens) and, once your radar is set up, a weekly email with what changed for your profile and portfolio, only in a week when there is something. The weekly email is part of the service you signed up for; switch it off at any time in Settings or with the one-click link in every weekly email. We keep whether it is on, a random unsubscribe code, and when each email was sent. Art. 6(1)(b).
- Reports you send: when you use "Report" (a rule missing or wrong), we keep what you wrote, the rule and jurisdiction, any link or note you add, and your account, so we can check it at the official source, fix the data and tell you where it stands. You get a copy of its status under "My reports". Kept while your account exists. Art. 6(1)(f), legitimate interest in accurate data.
- Technical and security logs: our hosting and database providers record requests and sign-in events, which include IP addresses and browser details, to deliver the service, keep it secure and fix problems, and keep them for a limited time (Art. 6(1)(f), legitimate interest in running a secure service).
An email address is needed to create an account; without it we cannot give you one. We do not take automated decisions about you, do not build profiles of you for marketing, do not sell personal data and do not use it for advertising.
Cookies, local storage and third parties
We use no cookies and no analytics or tracking of any kind. The app keeps only what it needs to work in your browser's local storage: your sign-in session, a copy of your own settings and portfolio so the app opens fast, and display choices such as light or dark theme. These are strictly necessary for the service you asked for, so no consent banner is needed; signing out ends the session, and clearing your browser data removes the rest.
The website and the app load nothing from third parties while you browse: fonts and code libraries are served from obligationradar.com itself, and the app talks only to our database in the EU. Google is contacted only if you click "Sign in with Google" or "Sign up with Google".
Who processes it for us
- Supabase (database and sign-in), data hosted in the EU (Ireland).
- Resend (sending account and weekly emails), sending region in the EU (Ireland).
- Netlify (hosting: serves the website and the app's files).
- Google, only if you choose "Sign in with Google".
Some of these providers are established outside the European Economic Area. Where personal data is transferred outside the EEA, the transfer relies on the safeguards those providers offer under the GDPR, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework where it applies.
How long we keep it
Account data is kept while your account exists. When you ask us to delete your account, we delete it and the data linked to it within 30 days. Copies in backups are overwritten in the normal backup cycle.
Your rights
You can ask to access, correct, delete or receive a copy of your personal data, object to processing based on legitimate interest, or restrict processing. Write to daniel@obligationradar.com from the address of your account; we answer within one month. You can also complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or to the data protection authority where you live or work.
Changes
If this notice changes in a way that matters, we will say so in the app or by email before the change applies.