Data Controller
The controller responsible for processing your personal data under the GDPR is:
Enis Cicek
Fritz-Riedel-Straße 16
10407 Berlin, Germany
support@veritawire.com
Full provider details are in our Impressum. We have not appointed a Data Protection Officer, as we are not legally required to.
Overview
VeritaWire provides a public feed and plan-based WebSocket alerting for detected Donald Trump Truth Social posts. We collect the information needed to operate the service, authenticate users, process subscriptions, deliver alerts, secure the WebSocket API, and understand reliability.
Information We Collect
- Account information: email address, Supabase user identifier, authentication session data, and account timestamps.
- Billing information: Stripe customer identifiers, subscription identifiers, plan, subscription status, price identifiers, checkout events, and billing portal access. We do not store full payment card numbers.
- API access information: API key prefix, hashed API key value, key creation time, revocation time, and access validation records needed to operate the WebSocket API.
- Usage and technical information: request paths, timestamps, browser or device metadata, IP address information available to our hosting provider, WebSocket connection events, errors, and security logs.
- Alert and reliability data: recent alert payloads, timestamps, latency samples, health metrics, and public feed state needed to deliver and monitor the service.
- Communications: messages you send to us, support requests, and related contact information.
Legal Bases for Processing
Under Article 6(1) GDPR, we rely on the following legal bases:
- Performance of a contract (Art. 6(1)(b)): to create and operate your account, provide the public feed and plan-based WebSocket API, manage subscriptions and API keys, and deliver the service you signed up for.
- Legitimate interests (Art. 6(1)(f)): to secure the service, prevent fraud and abuse, maintain reliability and latency monitoring, keep security logs, and operate the public and alerting surfaces. This includes processing publicly available posts from the tracked public account for the purpose of detecting and delivering alerts about a matter of public interest.
- Legal obligation (Art. 6(1)(c)): to meet tax, accounting, and other statutory record-keeping duties.
- Consent (Art. 6(1)(a)): where we ask for it, for example before setting any non-essential cookies or optional analytics. You can withdraw consent at any time.
How We Use Information
- Provide the public feed and plan-based WebSocket API.
- Create and manage accounts, subscriptions, billing sessions, and API keys.
- Authenticate users, prevent unauthorized access, investigate abuse, and protect the service.
- Measure latency, uptime, errors, and operational health.
- Respond to support requests and service communications.
- Comply with legal, tax, accounting, fraud prevention, and security obligations.
Service Providers
We use trusted infrastructure and service providers, acting as our processors under Article 28 GDPR, to run VeritaWire. These include Supabase (authentication and user/account data), Stripe (payments and subscription billing), Upstash Redis (alert delivery and recent alert buffers), Neon Postgres (latency and operational data), Railway (hosting), Grafana (reliability visualization), Google Analytics (optional website analytics, only after consent), Postmark (transactional email), Porkbun (domain services), and GitHub (source code hosting and deployment). We do not sell your personal data.
International Transfers
Some of our providers process data in the United States or other countries outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we rely on appropriate safeguards under Chapter V GDPR — the European Commission's Standard Contractual Clauses and/or, where the provider is certified, the EU–US Data Privacy Framework. You can request more information about these safeguards using the contact details above.
Cookies and Local Storage
We use only what is necessary to run the service. Authentication uses browser storage and session data provided by Supabase, and the site may store account-session, security, and functional preferences in your browser. These are strictly necessary and do not require consent.
For analytics we use analytics tools, currently Google Analytics, but only with your consent. When analytics is enabled, no analytics script is loaded and no analytics cookies are set unless you opt in through our cookie banner, as required by the GDPR and the German TDDDG. If you decline, no analytics runs. You can review or withdraw your consent at any time using the “Cookie settings” link in the footer.
When We Share Information
We share information with the service providers listed above when needed to operate VeritaWire, process payments, authenticate users, measure reliability, or host the service. We may also disclose information if required by law, to protect rights and security, to investigate abuse, or as part of a merger, acquisition, financing, or sale of assets.
Retention
We keep personal data only as long as needed for the purpose it was collected, then delete or anonymize it. Account data is kept while your account is active; billing and accounting records are retained for the statutory periods required under German law (generally up to ten years); security and reliability logs are kept for a limited period. API keys are stored as hashes; generated raw keys are shown only once.
Security
We use administrative, technical, and organizational safeguards intended to protect information, including hashed API keys, authenticated account access, provider-managed infrastructure security, and origin checks for WebSocket access. No internet service can guarantee perfect security.
Your Data Protection Rights
Subject to the conditions in the GDPR, you have the right to:
- Access the personal data we hold about you (Art. 15).
- Rectification of inaccurate or incomplete data (Art. 16).
- Erasure of your data (Art. 17).
- Restriction of processing (Art. 18).
- Data portability — receive your data in a portable format (Art. 20).
- Object to processing based on legitimate interests (Art. 21).
- Withdraw consent at any time, without affecting prior processing (Art. 7(3)).
To exercise any of these rights, contact support@veritawire.com. Some data may need to be retained for legal, security, billing, or fraud-prevention reasons.
You also have the right to lodge a complaint with a supervisory authority. Our competent authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Alt-Moabit 59–61, 10555 Berlin, Germany — datenschutz-berlin.de), though you may contact the authority in your own country of residence.
Children
VeritaWire is not intended for children. We do not knowingly collect personal data from anyone under the age of 16.
Changes
We may update this policy as the service changes. When we make material changes, we will update the date above and may provide additional notice where appropriate.
Contact
For privacy questions, requests, or concerns, contact support@veritawire.com.