Privacy Notice — Dumpbox

The data controller for personal data collected through dumpbox.ai is Domenico Zitiello, trading as Dumpbox — sole proprietorship (eenmanszaak), Netherlands. Privacy contact email: privacy@dumpbox.ai.

This notice covers registered users, people who upload content anonymously via QR or contribution link, guests who respond to an RSVP, people depicted in photos and videos uploaded by others, and visitors to the site.

Account data: email, UID, name, profile photo, username, creation date, plan.

Session cookie: dumpbox_session, httpOnly, 14 days, technical and does not require consent.

Uploaded content: photos/videos, date taken (EXIF) and, only if present and only as a suggestion you confirm, location rounded to ~1 km — never the exact point.

Anonymous QR contributions: the uploaded file and the technical metadata above, no other personal data required.

Event RSVPs: name and attendance status, even without an account.

People depicted in photos: whoever uploads content guarantees they have the right to; a depicted person can request removal at privacy@dumpbox.ai.

Analytics (consent-based only): PostHog EU Cloud (cookieless), Microsoft Clarity (includes session replay), Google Analytics 4 — none activates without your explicit choice in the banner.

Anonymous counting (if you refuse): if you choose "Ignore", what stays on is the Google tag alone, in a denied state across all four Consent Mode signals. No cookie written or read, no measurement identifier, ads not personalised, and only the bare name of each event goes out — never the properties, so never your username. What remains is your IP address, which every web request carries: Google uses it to derive an approximate location and does not retain it in the reports. Legal basis: legitimate interest (Art. 6(1)(f)). Until you choose, nothing goes out. Details and how to object in the Cookie Policy.

Advertising (consent-based only): Google Ads (same gtag.js as Analytics, _gcl_au cookie) and Meta Pixel. Beyond measuring which ads lead to a sign-up, with your consent they let Google and Meta personalise the ads you see, including outside Dumpbox, and build remarketing audiences. If you withdraw consent, the withdrawal is signalled to Google (Consent Mode v2) and to Meta.

In-app browsers (no data collected): if you open dumpbox.ai from an app's built-in browser — Instagram, Facebook — we offer, at sign-in, to continue in your usual browser, because a session created inside an app does not exist outside that app. To do so we read only the string your browser already sends with every request (the user agent) and rebuild the address of the page you are on, campaign parameters included. We write and read nothing on your device, create no identifier and contact no third-party service: that is why the offer appears even before any cookie choice.

Push notifications: if enabled, a technical device token via Firebase Cloud Messaging.

Beta programme application: name, email, phone number and, if you write them, notes on what you do. We use them only to get back to you about the beta programme, on the basis of the consent you tick in the form; we delete them on request at privacy@dumpbox.ai.

Account and content management: performance of a contract. Security and legal obligations: legal obligation/legitimate interest. Analytics and advertising (campaign measurement and ad personalisation): consent, always revocable.

Google Firebase (authentication, database, hosting), Cloudflare R2 (media storage), Resend (sign-in email), PostHog EU, Microsoft Clarity, Google Analytics 4, Google Ads, Meta (Pixel) — all as data processors. We do not sell your data to third parties.

Some providers (Google, Microsoft) may process data in the United States, under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

We retain data for as long as necessary to provide the service and, after an account or content is deleted, for the technical time needed to complete it.

You have the right to access, rectification, erasure, restriction, portability, objection, and to withdraw consent at any time. You can delete your account and all your data yourself from Settings, or lodge a complaint with the Autoriteit Persoonsgegevens (Netherlands) or, if you're in Italy, the Italian Garante Privacy. Write to privacy@dumpbox.ai to exercise these rights.

The service is not directed at people under 16 years of age.

We adopt appropriate technical and organizational measures: server-side access control, httpOnly cookies, encrypted HTTPS transmission.

We may update this notice; in case of substantial changes we will notify you via the site or by email/in-app notification.

privacy@dumpbox.ai