Privacy Policy
Captcha.party is a service that allows site owners (Service Users) to protect their internet property using Captcha.party’s CAPTCHA service. The service works by site owners embedding a Captcha.party script and Widget onto their site, which a End-User will load and Captcha.party will run several challenges in the users’s browser to verify they are not using automation tools.
Data subjects
- Website Visitors: Those who visit the Captcha.party website.
- Service-Users: Those who sign-up to the service and have an active account.
- End-Users: Those who encounter a Captcha.party Widget.
- Bug Reporters: Those who encounter a bug in the Captcha.party Widget and consent to reporting it.
For End-Users Captcha.party acts as a Data processor on behalf of the Data controller who is a Service-User.
Personal data and data processing
For Website Visitors
Our website at https://captcha.party is hosted on Cloudflare Pages which is provided by Cloudflare.
During your visit Captcha.party does not process any data, because the content is not served by us directly. Instead your request metadata is processed by Cloudflare, you can learn more about the data processing by Cloudflare in their Privacy Policy.
Additionally, we use Cloudflare’s privacy-first Web Analytics service which is also governed by their Privacy Policy.
For Service-Users
The administration panel (dashboard) available at https://dash.captcha.party is hosted on our Server fleet in Germany or the Netherlands.
For your requests to reach our servers, they pass through Cloudflare to provide security services, and thus are processed by Cloudflare, you can learn more about their data processing in their Privacy Policy.
Additionally, we use Cloudflare’s privacy-first Web Analytics service which is also governed by their Privacy Policy.
We collect personal information about Service-Users when they sign-up to Captcha.party, such as: your Name, Email, Country, and Billing information.
For End-Users
Loading the challenge Widget will incur request processing through our Content Delivery Network to load the assets required for it to be displayed.
Until the challenge is started no security checks or device data will be processed. Security challenges running are indicated by a “Verifying…” text and progress bar. Security challenges normally are delayed until a user interaction occurs, but the site owner is able to configure the Widget to run all challenges immediately.
Challenges
To make the best judgment, security challenges will collect information about your user preferences, device and hardware to look for inconsistencies and implementation violations.
Content Delivery Network
Captcha.party is using either Cloudflare or Bunny as Content Deliviery System. Particularly, Bunny is used to power our European services while Cloudflare powers our global presence.
Cloudflare
Your requests are processed by Cloudflare. As such, their Privacy Policy applies.
Bunny
Your requests are processed by Bunny.net. As such, their Privacy Policy applies.
For Bug Reporters
Clicking on “Submit bug report” will submit additional debug information such as browser name, version and identifiers, performance diagnostics, challenge information, and other information related to debugging issues.
Data retention
For Website Visitors
No data is processed by us, so we cannot store any either.
For Service-Users
We will retain information you retain while you have an account with us. You can delete your account at any time in your account settings which will initiate the data deletion process.
For End-Users
Challenges
We do not store the information gathered by our security checks.
If an error occurs, challenge information will be included in the associated bug report, which is optional and asks for your consent. See bug reporting.
Dynamic Difficulty Scaling
To dynamically scale difficulty of our security challenges in response to high traffic, we need to temporarily store some characteristics of your request in a one-way linkable way.
We reduce the scope and then one-way hash them based on the current time and request region to preserve as much privacy as possible. Learn more about the hashing.
Each counter is deleted after at most 10 minutes of not being accessed.
For Bug Reporters
Bug reports are stored until the associated issue are investigated and resolved.
Cookie Policy
Cookies are small pieces of text used to store information on web browsers. They are used by many websites to store and receive identifiers and other information on devices, such as a handheld phone or computer. You can learn more about cookies and their functions generally by visiting an information website such as https://knowcookies.com.
We use four categories of cookies: Strictly Necessary, Functional, Performance, and Targeting. Strictly Necessary cookies are required to deliver security and enable core site functionality and cannot be turned off.
Local Storage provides an alternative way of storing information in a browser, just like a Cookie.
For Website Visitors
Our website at https://captcha.party does not use any cookies, user preferences are stored locally in your browser instead.
However, Cloudflare may use strictly necessary Cookies to offer their services.
For Service-Users
The administration panel (dashboard) at https://dash.captcha.party is using strictly necessary cookies for the purpose of authentication.
Additionally, Cloudflare may use strictly necessary Cookies to offer their services.
Our cookies:
| Name | Domain | Expiry | Type | Purpose | Flags |
|---|---|---|---|---|---|
session | dash.captcha.party | 7 days | Strictly Necessary | authentication | Secure, HTTP only |
Our local storage:
| Name | Domain | Expiry | Type | Purpose |
|---|---|---|---|---|
__auth | dash.captcha.party | 7 days | Strictly Necessary | authentication |
For End-Users
Captcha.party does not use cookies or any other kind of data storage available in your browser.
However, Cloudflare may use strictly necessary Cookies to offer their services.
For Bug Reporters
Not applicable, refer to End-Users section above.
Applicable legal bases
Below you will find an overview of the legal basis, the GDPR, on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection requirements may apply in your or our country of residence or domicile. If more specific legal bases are relevant in individual cases, we will inform you of this in the privacy policy.
- Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR) - The data subject has given their consent to the processing of their personal data for a specific purpose or for several specific purposes.
- Fulfillment of the contract and pre-contractual inquiries (Art. 6 Para. 1 S. 1 lit. b. GDPR) - Processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures that are carried out at the request of the data subject.
- Legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR) - The processing is necessary to safeguard the legitimate interests of the person responsible or a third party, unless the interests or fundamental rights and freedoms of the person concerned, which require the protection of personal data, outweigh the above.
National data protection regulations in Germany
In addition to the data protection regulations of the General Data Protection Regulation, national data protection regulations apply in Germany. This includes in particular the law on the protection against misuse of personal data during data processing (Federal Data Protection Act - BDSG). In particular, the BDSG contains special regulations on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission as well as automated decision-making in individual cases, including profiling. Furthermore, it regulates data processing for the purposes of the employment relationship (Section 26 BDSG), in particular with regard to the establishment, implementation or termination of employment relationships and the consent of employees. In addition, the state data protection laws of the individual federal states can apply.
Rights of data subjects
As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:
-
Right to object - You have the right, for reasons that arise from your particular situation, to object at any time to the processing of your personal data, which is based on Art. 6 Para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions. If the personal data relating to you are processed in order to operate direct mail, you have the right to object at any time to the processing of the personal data relating to you for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct mail.
-
Right to withdraw consent - You have the right to withdraw your consent at any time.
-
Right to requesting information - You have the right to request confirmation as to whether the data in question is being processed and to request information about this data as well as further information and a copy of the data in accordance with the legal requirements.
-
Right to rectification - In accordance with the legal requirements, you have the right to request the completion of the data relating to you or the correction of incorrect data relating to you.
-
Right to erasure and restriction of processing - In accordance with the legal requirements, you have the right to request that the data relating to you be deleted immediately or, alternatively, to request a restriction on the processing of the data in accordance with the legal requirements.
-
Right to data portability - You have the right to receive data relating to you that you have provided to us in accordance with the legal requirements in a structured, common and machine-readable format or to request that it be transmitted to another person responsible.
-
Complaint to the supervisory authority - Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged violation, if you are of the opinion that the processing of your personal data violates the requirements of the GDPR.
Responsible supervisory authority for us:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf
Tel.: 0211/38424-0
Fax: 0211/38424-999
E-Mail: [email protected]
Security Measures
We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security, and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Website is at your own risk. You should only access the Website within a secure environment.
Deletion of data
The data processed by us will be deleted in accordance with the legal requirements as soon as the consent permitted for processing is revoked or other permissions are no longer applicable (e.g. if the purpose of processing this data is no longer applicable or is not required for the purpose).
If the data is not deleted because it is required for other legally permissible purposes, its processing will be limited to these purposes. This means that the data is locked and not processed for other purposes. This applies, for example, to data that must be stored for commercial or tax law reasons or whose storage is necessary to assert, exercise or defend legal claims or to protect the rights of another natural or legal person.
Our data protection information may also contain further information on the storage and deletion of data, which have priority for the respective processing.
Change and update of this privacy policy
We ask you to inform yourself regularly about the content of our privacy policy. We will adapt this privacy policy as soon as the changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.
If we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time and ask you to check the information before contacting them.