1. Introduction & Controller Details
Welcome to OMNIVOTE.IO ("we," "our," or "us"). We operate a collaborative list-building and voting platform. This Privacy Policy explains how we collect, process, and protect your personal data in compliance with the EU General Data Protection Regulation (GDPR), the ePrivacy Directive, and transparency obligations under the EU AI Act.
Company / Controller Name: [Legal Entity Name]
Address: [Physical Street Address, City, Country]
Contact Email: privacy@yourwebsite.com
Data Protection Officer (DPO): [DPO Contact Email or "Not Applicable"]
2. Personal Data We Collect
We process data based on your interactions with lists, votes, and AI features:
- Account & Profile Data: Username, email address, password hash, and profile details provided upon registration (including via Google, Facebook, or Apple login).
- User-Generated Content (UGC): Lists, list titles, descriptions, candidate items, and text inputs submitted for public display.
- Voting & Interaction Data: Records of upvotes, downvotes, item submissions, and timestamped interactions associated with your account or session.
- Device & Fraud Prevention Identifiers: IP addresses (hashed or anonymized where applicable), user-agent strings, and device fingerprints collected to enforce vote limits and prevent automated spam/bot abuse.
- AI Processing Data: Prompts, draft text, and list entries routed through our artificial intelligence systems for text enhancement or validation.
3. How We Process Data & Legal Grounds (GDPR Art. 6)
| Processing Activity | Personal Data Categories | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Account Creation & Service Operation | Email, Username, Credentials | Performance of a Contract (Art. 6(1)(b)) — Necessary to deliver account functions. |
| Public List & Item Publishing | Submitted List Titles, Items, Username | Performance of a Contract (Art. 6(1)(b)) — Publishing requested user content. |
| Vote Registration & Integrity Enforcement | IP Address, Device Signatures, Vote History | Legitimate Interest (Art. 6(1)(f)) — Preventing vote manipulation, duplicate voting, and bot abuse. |
| AI Text Enhancement | Draft Text, List Items | Performance of a Contract (Art. 6(1)(b)) or Consent (Art. 6(1)(a)) when activated. |
| AI Automated Data Validation | Submitted Text, Metadata | Legitimate Interest (Art. 6(1)(f)) — Content safety, moderation, and schema validation. |
| Site Analytics | Aggregated Usage, Cookies | Consent (Art. 6(1)(a)) — Granted via cookie banner. |
4. Artificial Intelligence & Automated Processing
In compliance with transparency requirements under European AI regulations:
- Text Enhancement: When you use our optional AI text enhancement features, your submitted draft text is processed by an automated model to assist in formatting, grammar correction, or expanding descriptions.
- Data Validation & Content Moderation: We utilize automated AI validation tools to verify that submitted list items adhere to formatting rules, filter out harmful or illegal content, and verify data authenticity prior to public display.
- Model Training Disclosure: Prompts and text inputs processed for list generation or enhancement are processed strictly to perform the service and are not used to train public, third-party AI models without your prior explicit consent.
- Automated Decisions: Automated content filtering does not produce legal or similarly significant effects under GDPR Art. 22. If your submitted item is flagged or rejected by automated validation, you may contact us to request human review.
5. Public Visibility of Content & Voting Data
By using our platform to generate lists or participate in voting, you acknowledge that certain data is made public by design:
- Public Information: Your public username, created lists, submitted items, and public vote counts are accessible to other users and search engines.
- Non-Public Integrity Data: IP addresses and technical identifiers used to verify vote legitimacy are kept strictly confidential and are never rendered visible to the public.
6. Data Recipients & International Transfers
We share personal data only with trusted service providers acting as Data Processors bound by strict Data Processing Agreements (DPAs):
- AI Service Providers: Processing infrastructure used for text enhancement and validation (e.g., [OpenAI, Anthropic, or Self-Hosted AI Nodes]).
- Hosting & Security: Cloud platform providers and Content Delivery Networks (CDNs) (e.g., [AWS, Cloudflare, Hetzner]).
- Analytics Providers: Analytics services (e.g., [Matomo, Plausible, or Google Analytics]).
- Authentication Providers: Google, Facebook, and Apple when you sign in with those services.
Transfers Outside the EEA
Where data is transferred to vendors located outside the European Economic Area (EEA), we ensure appropriate safeguards under Chapter V of the GDPR are in place, including European Commission Adequacy Decisions, Standard Contractual Clauses (SCCs), or the EU-U.S. Data Privacy Framework.
7. Data Retention
- Public Lists & Votes: Retained as long as the list remains active or until you delete your account/content.
- Vote Integrity Logs (IPs/Fingerprints): Retained for a limited duration of [e.g., 30 to 90 days] strictly for fraud and bot prevention, after which they are purged or anonymized.
- AI Processing Buffers: Prompts and validation inputs are retained in temporary processing logs for no longer than [e.g., 30 days] to verify model security and performance.
8. Your Data Rights under the GDPR
As an EU/EEA resident, you possess the following rights regarding your data:
- Right of Access (Art. 15): Request an export of your personal data, created lists, and registered votes.
- Right to Rectification (Art. 16): Update or correct inaccurate account info or list items.
- Right to Erasure (Art. 17): Request deletion of your account and associated non-public data ("Right to be Forgotten"). Note: Publicly generated lists with contributions from other users may be anonymized rather than deleted to preserve platform structure.
- Right to Object (Art. 21): Object to processing based on legitimate interests (e.g., vote integrity tracking).
- Right to Withdraw Consent: Revoke consent for analytics cookies or optional AI features at any time.
To exercise your rights, email privacy@yourwebsite.com. You also have the right to lodge a complaint with your local EU Data Protection Authority.
You can change analytics cookie choices at any time via Cookie Settings in the site footer.