CrossAd の個人情報保護方針
- Controller
CrossAd, contact: privacy@crossad.app
Full address: see Legal notice. - Data we process
Email address and password hash on registration
OAuth ID when signing in with Google or Apple
Subscription and payment status (no full card data stored by us)
Consents (privacy, terms, newsletter) with timestamp
Technical logs (IP, user agent) on registration for compliance
Optionally after login: aggregated block stats for the dashboard (not full browsing history)
2a. Browser extension (local)
The Chrome extension stores settings, allowlists and optional hide-rules locally on the device. Filter rules may be updated from our API as configuration only (no remote executable scripts). Page content is not sold to advertising networks. - Legal bases (Art. 6 GDPR)
Contract (Art. 6(1)(b)): Providing CrossAd and Premium
Consent (Art. 6(1)(a)): Newsletter (opt-in at registration)
Legitimate interest (Art. 6(1)(f)): Abuse prevention, security - Email verification
To prevent fake accounts we send a confirmation code after registration. Without confirmation the account cannot be used. - Newsletter
The newsletter is optional. After opt-in we send a separate confirmation email (double opt-in). You can unsubscribe at any time. - OAuth (Google / Apple)
When signing in via Google or Apple we receive your email and a provider ID. Their privacy policies also apply. - Your rights
Access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority. Contact: privacy@crossad.app - Retention
Account data until deletion. Consent records at least 3 years. Verification codes are deleted after use or expiry. - Data processors (Art. 28 GDPR)
We use the following processors on the basis of data processing agreements (DPA). They process data only on our instructions and for the stated purposes:
Vercel Inc. (USA) — hosting & delivery of the dashboard/API. Transfer on the basis of EU Standard Contractual Clauses (SCC).
Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc., USA) — payment processing. We do not receive or store full card numbers; Stripe processes them directly.
Email provider (e.g. Google/Gmail API) — sending transactional and verification emails.
Twitch (Twitch Interactive, Inc., USA) — only when you use CrossAd.TV and connect your Twitch account. Your Twitch login (OAuth) is handled by Twitch. - Third-country transfers
Some processors are based in the USA. Transfers take place on the basis of EU Standard Contractual Clauses and, where applicable, additional technical measures. You can request a copy of the relevant safeguards at privacy@crossad.app. - Cookies & local storage
The dashboard uses a login session (token) stored locally in your browser and no tracking cookies. The extension stores settings locally. We do not use advertising cookies.