Privacy & GDPR Policy

The data controller responsible for the personal data described in this policy is:

No Data Protection Officer (DPO) has been appointed. The processing activities do not currently meet the thresholds in Article 37(1) GDPR (no public-authority status, no core activities consisting of regular and systematic monitoring of data subjects on a large scale, and no processing of special categories of data on a large scale). I review this designation annually as the service scales. Direct any data-protection inquiries to the contact email above.

captchaapi.eu has a dual role under GDPR:

• For your account data (registered users / integrators), I act as data controller under Article 4(7) GDPR — this Privacy Policy describes that processing.
• For personal data of your end-user visitors processed through the CAPTCHA widget on your site, I act as data processor on your behalf under Article 28 GDPR — you, the integrator, remain the controller. Those processor terms are set out in the Terms of Service (§ 9) and the standalone Data Processing Agreement.

When the CAPTCHA is used, the service may process technical request data required to generate and verify challenges, prevent abuse, and measure usage.

This may include information such as IP address (or a derived, non-reversible representation), request metadata, and challenge-related identifiers. Data is handled in a privacy-conscious way and limited to what is necessary for security and operation.

For registered users (API integrators), I additionally store account details (name, email, password hash), the selected subscription tier (Free, Starter, Growth, or Business), a billing cycle anchor date used to calculate monthly usage, and account state (active, grace period, over-limit, or suspended) reflecting the current billing status. When upgrading to a paid plan, billing details are also collected: postal address, and — for business customers — company ID and VAT number. These are required for invoicing and VAT compliance and are processed solely to provide and administer the service.

Beyond the headline fields above, the service also stores the following supporting categories of personal data — disclosed here for full transparency under Article 13 GDPR:

• Authentication credentials. If you enable two-factor authentication, an encrypted TOTP secret and a set of one-time recovery codes are stored on your account; both are encrypted at rest. An email_verified_at timestamp and a Laravel "remember me" token (when you tick that box at sign-in) are also stored as standard authentication infrastructure.
• Authenticated session metadata. While you are signed into the dashboard, a session row contains the IP address you connected from, your browser's user-agent, a last-activity timestamp, and a serialized session payload (no plaintext credentials). This is invalidated on logout and pruned by Laravel's session garbage collection thereafter. This applies only to the dashboard — the public CAPTCHA widget on your visitors' pages stores nothing.
• Subscription lifecycle data (paid plans). Subscription metadata received from the payment provider: current billing-period start / end dates, cancel-at-period-end flag, scheduled tier changes, payment-overdue and VAT-grace timers, the provider name (Stripe or Lemon Squeezy), and the provider's subscription identifier. Used to enforce plan access, drive grace-period reminders, and reconcile webhooks against the local account state.
• VIES verification audit trail (EU B2B only). For EU B2B customers an append-only log of every VIES query is kept — country code, VAT ID, verdict (Valid / Invalid / Down), VIES consultation number, and the full VIES response payload (which may include the business name returned by VIES). I keep this log as part of my own due-diligence and accounting documentation for cross-border B2B invoicing and EU recapitulative-statement filings. A snapshot of the latest Valid result is also embedded into each invoice issued to the customer. These records are kept in line with the retention applied to the related invoices — see Section 8.
• Free-tier hard-cap state. Two small flags on Free accounts: a timestamp of the first hard-cap event and a one-time-warning-seen marker. They drive the post-cap re-activation UX so the upgrade options are surfaced exactly once when service resumes after a billing-cycle reset.
• Invoice ledger snapshots (paid plans). Each issued invoice carries a snapshot of the billing data at the time of issuance: invoice number, currency, total (and CZK equivalent for EUR invoices), VAT mode (no-VAT for CZ-resident neplátce, reverse-charge for EU B2B), billing reason, and the cross-reference to the upstream Stripe invoice. Past invoices are never rewritten — they are the legal accounting record.

Processing of personal data is based on the following legal grounds under GDPR Article 6:

• Performance of contract (Art. 6(1)(b)) — Account data, project data, subscription tier, account state, and billing cycle data are processed because they are necessary to provide the service you registered for.
• Legal obligation (Art. 6(1)(c)) — Billing address, company ID, and VAT number are retained as required by Czech accounting and VAT law, which sets a 10-year retention period for accounting and tax documents.
• Legitimate interests (Art. 6(1)(f)) — Technical data such as hashed IP addresses, server logs, and challenge tokens are processed pursuant to specific legitimate interests (see detail below).

Consent (Art. 6(1)(a)) is not relied upon. All processing falls under one of the three legal bases above.

Pursuant to Article 13(1)(e) GDPR, the categories of recipients of personal data are summarised below. The Sub-processors page is the single authoritative source for the current list, including each entity's role (sub-processor or independent controller), location, certifications, signed DPA, and any applicable international transfer mechanism (Standard Contractual Clauses, EU–U.S. Data Privacy Framework). I will provide at least 30 days' advance notice of any change.

No analytics platforms or advertising networks receive personal data. No other third-party services receive personal data beyond what is shown above.

No advertising, analytics, or tracking cookies are used anywhere on this service. The CAPTCHA widget sets no cookies on your visitors' browsers whatsoever. The dashboard (account area) sets two strictly necessary cookies described below. Under Article 5(3) of the EU ePrivacy Directive (2002/58/EC, as amended by 2009/136/EC), strictly necessary cookies are exempt from consent requirements.

Both cookies expire after 120 minutes of inactivity and are invalidated immediately on logout. They persist beyond browser close (the session is time-based, not browser-session-based). These cookies contain only a random identifier and are not used to identify you directly or for tracking purposes.

First-party site analytics. For the marketing pages on captchaapi.eu itself (landing page, demo, documentation, blog, legal pages) I keep aggregated server-side page-view counters in PostgreSQL: the URL path, the host part of the Referer header (with path and query stripped), utm_source / utm_medium / utm_campaign if present, and the ISO-3166-1 country code derived from your IP via a local MaxMind GeoLite2 lookup. No IP address, no cookie, no browser fingerprint, no User-Agent string and no full URL is persisted to the database, and no third-party service or analytics platform receives any of this data. To count unique visitors per day without storing identifiers, a SHA-256 hash of the IP combined with a salt that rotates at midnight is held in Redis cache for up to 24 hours; the hash exists only to deduplicate repeat visits within the same day and is discarded automatically, the raw IP is never written anywhere, and the daily salt rotation makes hashes uncorrelatable across days. The counters exist so I can tell whether marketing content is reaching its audience; they are read only by me through the admin console. Lawful basis: legitimate interest under Art. 6(1)(f) GDPR (operating and improving the service).

Data is retained only for as long as necessary to operate the service, ensure security, and meet legal obligations. The table below lists specific retention periods for each category of data.

Application data and CAPTCHA verification data are processed exclusively on EU-hosted infrastructure: Hetzner Online GmbH, Nuremberg datacenter, Germany. Transactional email is handled by WEDOS, a.s. (Hluboká nad Vltavou, Czech Republic, EU). No CAPTCHA verification data, IP hashes, account credentials, or session metadata leaves the EU/EEA.

Limited international transfers occur only in the payment-processing path, which is operated by independent payment providers as described in Section 6:

• Stripe. Business-customer payment data is processed by Stripe Payments Europe Ltd. (Ireland); ancillary transfers to Stripe, Inc. (US) are protected by the EU–U.S. Data Privacy Framework (Commission Implementing Decision 2023/1795) and Stripe's binding Standard Contractual Clauses under Commission Implementing Decision 2021/914.
• Lemon Squeezy. Consumer-customer payment data is processed by Lemon Squeezy LLC (US) acting as Merchant of Record (independent controller). Transfers are protected by the EU–U.S. Data Privacy Framework adequacy decision (where applicable) and Standard Contractual Clauses Module 1 (Controller-to-Controller) as a fallback.

I implement appropriate technical and organisational measures (TOMs) to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. These include:

• Encryption in transit (TLS 1.2+) for all client and inter-service communication;
• One-way keyed hashing (SHA-256 with a server-side secret salt) for visitor IP addresses, with cache-only retention (maximum 2 minutes for rate limiting, maximum 24 hours for cross-sitekey abuse reputation);
• Encryption at rest for two-factor authentication secrets and recovery codes;
• Bcrypt password hashing for account credentials;
• Strict access controls — production access is limited to me, the sole operator, and authenticated via SSH keys;
• Short retention windows for operational data (maximum 2 minutes / 24 hours for IP hashes per their purpose, 14 days for error logs);
• Routine HTTP access logging is disabled — only error-level events are logged;
• Underlying infrastructure (Hetzner Online GmbH) is ISO 27001 / BSI C5 Type 2 / ISO 14001 certified; see Sub-processors for audit details.

As a data subject under GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — You may request a copy of the personal data I hold about you.
• Right to rectification (Art. 16) — You may request correction of inaccurate personal data. Account profile data can be updated directly in the dashboard.
• Right to erasure (Art. 17) — You may request deletion of your personal data. Note that billing records are subject to mandatory retention periods and cannot be deleted early.
• Right to restriction of processing (Art. 18) — You may request that processing be restricted in certain circumstances.
• Right to data portability (Art. 20) — You may request your personal data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21) — You may object to processing based on legitimate interests.

To exercise any of these rights, contact me at info@captchaapi.eu. I will respond without undue delay and at the latest within one month of receipt of your request, as required by Article 12(3) GDPR. Where requests are complex or numerous, this period may be extended by a further two months — I will inform you of any such extension and the reasons for it within one month of receipt.

As described in Section 1, I have a dual role under GDPR. For personal data of your end-users processed through the CAPTCHA widget on your website, I act as data processor on your behalf under Article 28 GDPR — you, the integrator, remain the data controller. The full processor–controller terms are set out in the standalone Data Processing Agreement, which is incorporated into the Terms of Service (§ 9) by reference.

As the controller of end-user data, you remain responsible for informing your users about the use of CAPTCHA on your website and for meeting your own applicable legal obligations under GDPR or other applicable data protection laws.

If you integrate captchaapi.eu into your website, you can copy the following text into your own privacy policy to inform your users:

You are free to adapt this text to match the tone and structure of your own privacy policy. It is provided as a convenience and does not replace your own legal review.