Privacy notice — draft for counsel
This is the working notice of the paste route while it serves the founder and the test accounts only. The statements on the paste page (what we keep, what we publish, the legal basis, the controller) are the binding text; the full notice arrives with the public site after counsel's review.
Paste the notice you received from Amazon (or another company). Do not paste passwords, one-time codes or bank details — we never ask for them, we never log in, and we never send anything for you: you send. Notices about a buyer account are not kept: we tell you it is out of scope and discard the text.
In short: we keep your notice with identifiers replaced, we publish counts and never your text, and you can download or delete your file at any time. The detail is below, and the full documents are linked at the end.
What we keep
The notice and what you tell us about how it ended, in a case file hosted in the EU, to look up the record for cases like yours and so you can come back to it. We remove the file from our systems 90 days after you tell us how it ended — or 90 days after you pasted it if you never do, or sooner if you ask — and copies in backups are removed within 30 days after that. Spanish data-protection law requires a removed file to be blocked before it is destroyed: one sealed, encrypted copy is kept for 3 years where nobody at Overturna can read it, available only to a court, a prosecutor or the data-protection authority, and then destroyed. Email addresses, phone numbers and bank, VAT, order and product identifiers in the notice are replaced with placeholders before we store it; your name and address stay in your file, encrypted, and leave with it. If you upload the original message, we keep it unchanged in your file (it is what lets us verify your ending) and it leaves with the file. To find and remove other people's names, the notice is first processed by the EU providers listed in our privacy notice; our systems then work from the copy with those names removed. The original stays in your file until the file is removed.
What we publish
Counts only — never your text, your name or any identifier. We add your ending to the counts about a week after you report it; until then you can correct or withdraw it. Once your file is removed, the count cannot be traced back to you, which is why it is not removed with the file.
The anonymous record built from what you and others report is never sold or licensed to the companies it describes.
Legal basis: we process the notice to provide the service you asked for on the terms you accept here (GDPR Art. 6(1)(b)); we derive the anonymous counts under our legitimate interest in keeping the record (Art. 6(1)(f)). You can object, and ask for a copy or deletion of your file, at any time.
Read the full privacy notice →
Only anonymous counts are ever published. Your ending is added to them about a week after you report it; until then you can correct or withdraw it.