100% EU-hosted
Hetzner Nuremberg; no CAPTCHA data leaves the EEA.
No cookies on widget
No tracking, no fingerprints, no profiling — ever.
Pre-signed DPA
Print-ready Article 28 GDPR processor agreement.
# 1 Operating Entity
captchaapi.eu is operated as a sole-proprietor business under Czech law. The same legal person is the data controller for registered users, the seller of record for B2B transactions, and the responsible party for security disclosures.
Vladislav Rajtmajer
Registered address: U Porcelánky 862, 35735 Chodov
Company ID (IČO): 73396249
VAT status: Neplátce DPH (CZ-resident, not VAT-registered — invoices issued without VAT)
Jurisdiction: Czech Republic (European Union)
General contact: info@captchaapi.eu
Lead supervisory authority for data-protection matters is the Czech Úřad pro ochranu osobních údajů (ÚOOÚ) — www.uoou.cz. Disputes are subject to the exclusive jurisdiction of the competent courts of the Czech Republic, without prejudice to mandatory consumer-protection law in your country of residence.
# 2 Hosting & Infrastructure
All application data, including ephemeral CAPTCHA challenge state and the operational database, is hosted on infrastructure provided by Hetzner Online GmbH in Nuremberg, Germany — exclusively. No replication or fail-over to non-EEA Hetzner regions is configured. CAPTCHA verification data is not intentionally transferred outside the EU/EEA. Payment-provider data flows (Stripe / Lemon Squeezy) are documented separately on the Sub-processors page.
Sub-processor certifications (Hetzner)
- ISO 27001
- BSI C5 Type 2
- § 8a BSI-KritisV
- ISO 14001
captchaapi.eu does not currently hold an independent ISO 27001 / SOC 2 / BSI C5 certification of its own — these certifications belong to the upstream infrastructure provider and are referenced honestly as such, not claimed for the application layer.
Independent annual audit
Hetzner's compliance with the agreed Technical and Organizational Measures is audited annually by TÜV Rheinland, an independent German certification body. The most recent audit report is dated 19 February 2026 and is available to Controllers on request under the DPA. A written Article 28 GDPR Data Processing Agreement with Hetzner was signed 17 April 2026.
# 3 Sub-processors
The minimal sub-processor footprint is a deliberate design choice. The full list is maintained on the Sub-processors page; what follows is the working summary.
- Hetzner Online GmbH — cloud infrastructure (Nuremberg, Germany, EU — exclusive). Processes all application data.
- WEDOS, a.s. — transactional email mailhosting (Hluboká nad Vltavou, Czech Republic, EU). Processes recipient email address and message body for account notifications only.
- Stripe Payments Europe Ltd. — payment processor for B2B customers (captchaapi.eu remains seller of record). Independent payment provider for consumer transactions: Lemon Squeezy LLC (acting as Merchant of Record under their own terms — independent controller, not a sub-processor in the strict GDPR sense).
Tax-invoice issuance is handled by in-house tooling running on the Hetzner-hosted application; no third party receives invoice data.
Change-notification policy
At least 30 days' advance notice before any sub-processor is added or replaced. Notification is dual-channel: this page is updated and an email is sent to the billing contact of every active account. If you object to a proposed change, you may request additional information, propose alternative arrangements, or terminate without penalty before the change takes effect — see Sub-processors § 3.
# 4 Data Handling on the Visitor Side
The CAPTCHA widget that runs on your visitors' devices is intentionally minimal. The full technical detail lives in the Privacy Policy; the headline guarantees are:
No cookies
The widget sets nothing in the visitor's browser. Strictly necessary dashboard session cookies apply only to logged-in integrators.
No fingerprinting
No canvas, font, or device-fingerprint signals are collected. The Proof-of-Work challenge is purely mathematical.
Hashed IP, 2-minute retention
Visitor IP is one-way hashed (SHA-256 + server-side secret salt) and held in cache for at most 2 minutes for rate-limiting. Never written to the database.
No cross-site profiling
Visitor data is never combined with other services, not shared with ad networks, never used for risk scoring across sites.
The exact bundle served to your visitors is publicly available at /captcha.js — minified but not obfuscated, no anti-debugger or anti-tamper layer, and the Proof-of-Work worker code is preserved verbatim with comments inside the bundle. Beautify it and you can audit byte-for-byte what runs on visitors' devices.
# 5 How This Compares
Comparison against the three most common CAPTCHA alternatives, with every claim cross-referenced to each provider's published documentation.
| captchaapi.eu | reCAPTCHA | hCaptcha | Turnstile | |
|---|---|---|---|---|
| Operator | CZ sole-proprietor (EU) | Google LLC (US) | Intuition Machines, Inc. (US) | Cloudflare, Inc. (US) |
| Hosting region | EU only (Nuremberg) | Global, US-anchored | Global, US-anchored | Global edge network |
| Cookies on widget | None | Yes (e.g. _GRECAPTCHA; v3 also relies on Google account cookies for risk scoring) |
Yes by default; cookie-free mode available on paid plans only | None |
| Visitor data sent off-site | Hashed IP only, kept 2 min in EU | IP, browser data, behavioural signals, Google account state — used for cross-product risk modelling | IP, browser fingerprint, behavioural signals — processed in the operator's global infrastructure | IP, browser data, fingerprint — processed on Cloudflare's edge for ML scoring |
| Cross-site profiling | No | Yes — ties into Google's advertising and account graph | Risk model spans the operator's customer base | Risk model spans Cloudflare's customer base |
| GDPR transfer mechanism for CAPTCHA data | No (EU-internal) | Yes — Standard Contractual Clauses + Data Privacy Framework | Yes — Standard Contractual Clauses | Yes — Standard Contractual Clauses + Data Privacy Framework |
| Cookie banner / CMP entry needed | No | Practically yes (CMP categorises as "marketing") | Yes by default; "no" only on paid cookie-free mode | Generally not required (no cookies) |
| Widget bundle | ~16 KB minified (~6 KB gzipped), not obfuscated; PoW worker code preserved verbatim — beautify and audit | Obfuscated, anti-debugger, frequently rotated | Minified, behaviour rotated server-side | Minified, edge-ML scoring rotated |
Sources for cross-checking: Google reCAPTCHA privacy / terms · hCaptcha privacy · Cloudflare Turnstile data & cookies. Where the underlying privacy policies are ambiguous or change behaviour by plan tier (notably hCaptcha's cookie-free mode), the table reflects the default configuration most integrations use.
Disclosure on the captchaapi.eu side: the "GDPR transfer mechanism for CAPTCHA data" row reflects the CAPTCHA verification path only (EU-internal, Hetzner Nuremberg). Billing-provider data flows are separate: Stripe (B2B) operates from Ireland with ancillary US transfers under EU–U.S. DPF + SCCs; Lemon Squeezy (B2C) operates from the US under DPF + SCCs Module 1 — see the Sub-processors page for the full international transfer disclosure.
# 6 Compliance Documents
Every legal document referenced from this page is publicly available and version-stamped:
Terms of Service
Liability cap, refund policy, change-notice rules, integrator obligations.
Privacy & GDPR Policy
Article 13 disclosure, data categories, legal basis (Art. 6), retention table, cookie inventory, data-subject rights, supervisory authority.
Data Processing Agreement
Article 28 GDPR processor agreement with signature block — print-ready.
Sub-processors
Full list with change-notification policy and objection flow.
security.txt
RFC 9116 disclosure metadata for security researchers.
# 7 Security Contact
Suspected vulnerability, data-handling concern, or security question? Use the dedicated disclosure channel — it goes directly to me, not to a customer-support queue:
Disclosure metadata in machine-readable form is published at /.well-known/security.txt per RFC 9116. I aim to acknowledge legitimate reports within 72 hours and to keep the reporter informed throughout remediation.
Please give me a reasonable window to triage and remediate before public disclosure; coordinated disclosure is appreciated and reciprocated with credit (where the reporter consents) in the changelog or release notes.
Vladislav Rajtmajer
Founder & sole operator · Czech Republic (CET)
captchaapi.eu is a one-person operation. There is no marketing department, no outsourced support tier, no cookie-collection layer hidden behind the widget — what you see in the legal documents is what runs in production. The same person writes the code, signs the DPA, and answers the security email. The service is also used in production by my own product billify.cz to protect login and registration — so when uptime or correctness slips, I am the first one to notice.
Vendor due-diligence questions?
Happy to fill in a CAIQ Lite, security questionnaire, or supply audit references.