Privacy & legal notice

Who we are

The operator of meisslo.io and the controller of your personal data is:

Company ID (IČO): 57 704 716. Registered in the Commercial Register of the Municipal Court Bratislava III, section Sro, file no. 200839/B.

Contact for anything about this notice or your data: [email protected]

What we process and why

• Your account. Email address, password (stored only as a salted hash), the date you joined, and one-time tokens for activating your account or resetting your password. We need these to give you access (Art. 6(1)(b) GDPR).
• Invitations. If an invitation is addressed to you, your email address and when the invitation was created, used and expires. We keep this to run invite-only access (legitimate interest, Art. 6(1)(f) GDPR).
• Emails we send. Invitation, account activation and password reset emails. We send nothing else, and no newsletters.
• Technical data. Your IP address and request details pass through our hosting and network providers so the site can be delivered and protected from attacks. We use your IP address and the email address you type to limit repeated sign-in and password-reset attempts; those counters expire within one hour. Server error logs may record the requested address and time. Legitimate interest in security, Art. 6(1)(f) GDPR.

We don’t use your data for profiling or automated decisions.

Cookies

We only use what the site needs to work, so we don’t ask for consent:

• sessionid keeps you signed in or keeps your guest access, for up to 2 weeks.
• csrftoken protects our forms against cross-site request forgery, for up to 1 year.
• Cloudflare may set short-lived security cookies (such as __cf_bm or cf_clearance) to tell people from bots.

Who else handles your data

These providers process data for us under data processing agreements:

• Hetzner Online GmbH (Germany) hosts our servers and database.
• Cloudflare, Inc. (USA) sits in front of the site as a network and security proxy and sees IP addresses and request data.
• Resend (USA) delivers our emails and sees the recipient address and the email’s content.

Transfers to the USA rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

How long we keep it

Account data stays for as long as your account exists. Invitation records stay for as long as we need them to manage access. Ask us and we’ll delete your account and invitations. Rate-limit counters expire within one hour.

Your rights

You can ask us for access to your data, and to correct, delete or export it, to restrict how we use it, or object to processing based on legitimate interest. Write to [email protected]; we reply within one month.

You can also complain to the Slovak supervisory authority, Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.

Changes

If what we process changes, we update this page and the date at the top.