Privacy notice

Short version: this site sets no cookies and writes nothing to your device's storage. It uses no third-party analytics; anonymous counters only. The one thing you can send us is the optional feedback form at the bottom of the home page. The generator keeps your selection in your browser. We count a few button presses and page views as anonymous tallies, with no IP address or identifier.

Last reviewed: 2026-10-17

Who is responsible

Keve András Tóth is the controller for the data described here. Contact: tothkeveandras60@gmail.com.

Cookies, analytics and device storage

We set no cookies and use no third-party analytics or advertising service: anonymous counters only, described below. The site does not write to your browser's local storage, session storage or any other storage on your device. It makes no requests to third-party servers, so there is no consent banner to show.

What the generator does with your input

The vendors you select, the search you type and the purposes and data locations you edit stay in your browser. They are not stored by us, not added to the URL and not sent to any server. We don't have accounts and we don't collect email addresses on this site.

One exception to "not added to the URL": the "Add to my list" button on a vendor page opens the generator with that vendor's name after a # in the address. Browsers never send the part after # to a server, so it never leaves your browser, and the generator removes it from the address bar as soon as it loads.

Anonymous counters

When you press certain buttons or open a page, your browser sends a short message to this site's own server naming the action. The server adds one to a tally for that action and that day. It stores nothing else: no IP address, no user agent, no cookie, no identifier, no text you typed and no record of which vendors you picked. Because nothing identifying is stored, a tally is not linked to any visit or person.

These are the actions that are counted:

• Vendor added in the generator (once per page load).
• Copy HTML, copy Markdown, download CSV in the generator.
• Template downloads (subprocessor list or breach log, CSV or Markdown).
• "Host my list and keep it current" dialog: opened (with the place you clicked from), closed without answering, or answered. The answer is one of four fixed choices and the dialog has no text field and no email field.
• Page views: each page you open adds one to that day's tally for its page type: home page, generator, vendor page, vendor list, category page, template page, information page (about, methodology, privacy) or error page. The type is a fixed label; the address of the page is not sent.
• Where a visit came from: on the first page of a visit, your browser works out a coarse source from the page you came from and sends only that label, such as "reddit", "google" or "direct" (no referring page). The label comes from a fixed list of 14 values, and everything not on the list is "other". Moving between pages of this site sends no source.

No URL, referrer, IP address or identifier is stored with these tallies, so they cannot show which pages one person looked at or in what order.

Counting stops for an action after a daily limit, to limit the effect of floods on the numbers; the server also keeps a tally of how often that limit was reached, nothing more. Netlify may rate-limit requests to the counter by IP address at its edge; we don't see or store that. For how people find the site through Google we also use the aggregate search statistics from Google Search Console, which come from Google's search results and not from your visit here.

Feedback form

The home page has an optional feedback form. If you use it, the message you type and the page it was sent from (the home page) are sent to this site's own address and handled by Netlify Forms. The form has no name or email field. Please don't put personal data or confidential contract text in the message.

• Who handles it: Netlify is our host and processes the submission on our behalf (processor). Netlify Forms stores the message, and the site owner reads it in the Netlify dashboard. Netlify may also record technical request data, such as your IP address, to filter spam. See Netlify's privacy policy.
• Why: to improve the site: add missing vendors, fix wrong facts, decide on features.
• How long: we delete a submission after it has been read and handled, and at the latest within 6 months.
• Deletion: ask at tothkeveandras60@gmail.com and we delete your message sooner. Without an email address in the message we can't tell which one is yours, so quote some of its words.

Hosting

The site is served by Netlify. As the host, Netlify processes request data such as your IP address and user agent to deliver the site, to run the counter function and to receive feedback form submissions. See Netlify's privacy policy for how it handles that data.

If you email us

If you email us, for example from the "report an error" link on the methodology page, your message and email address are used only to reply and to fix the error.

Your rights

You can ask for access to, correction or deletion of personal data we hold about you, object to processing, and complain to your data protection authority. Contact us at tothkeveandras60@gmail.com.

Changes

If this notice changes in a way that matters, we update the date above.