Privacy Policy

This policy explains how WinnerFlags ("we", "us"), which operates Data Reporter, the private reporting service at cuigg.me, handles personal data when you use your reporting workspace. If you have questions, contact us at winnerflags@gmail.com.

Who this covers

This policy is for people who sign in to a Data Reporter workspace, typically staff at an organisation we produce audience reports for. The underlying survey and audience data shown in your reports is provided to us by your organisation; for that data your organisation is the data controller and we act as its processor.

What we collect

• Account details, your name, work email, and a securely hashed password.
• Your team, the organisation (access-code group) your account belongs to.
• Onboarding survey, your team's stated reporting-style preferences, used to tailor how your reports are presented.
• Report content, the audience/survey data your organisation supplies, which we process to generate your reports.
• Usage analytics, in-app activity on your account: sign-ins, which reports, charts and tabs are viewed, exports, and approximate time spent in the app (measured by a once-a-minute heartbeat while it's open). This is used to maintain and improve the service and is visible only to you and your account manager, we use no third-party analytics.
• Essential cookie, a single sign-in session cookie so you stay logged in. We do not use advertising or third-party tracking cookies.

Why we use it & our legal basis

We process this data to provide and secure your reporting workspace, to generate and tailor your reports, and to keep the service working. Under the GDPR our legal bases are the performance of a contract (providing the service to your organisation) and our legitimate interests in operating, securing and improving it.

Who we share it with

We do not sell your personal data. We share it only with service providers that help us run the platform, Hetzner for hosting, and our sign-in and transactional-email providers, under agreements that require them to protect it, and where required by law.

Where it's stored

Your reports and account data are stored on Hetzner servers in the EU. Where a supporting provider processes limited data (such as your sign-in email) outside the EEA, we rely on that provider's standard contractual clauses as the transfer safeguard.

How long we keep it

We keep account and report data for as long as your organisation's workspace is active, and then for 30 days after the end of our contract with your organisation unless a longer period is required by law. You can ask us to delete your account at any time.

How we protect it

Passwords are stored only as salted hashes, all traffic is encrypted in transit, sign-in uses a secure session cookie, and each organisation's reports are isolated so one team can never see another's. Access to data is limited to what's needed to run the service.

Your rights

Subject to applicable law, you can request access to your personal data, correction of inaccurate data, deletion, restriction of or objection to processing, and portability. To exercise any of these, contact winnerflags@gmail.com. You also have the right to complain to your data protection authority, such as the Data Protection Commission in Ireland.

Changes to this policy

If we make material changes we'll update the version date above and ask you to review and accept the updated policy the next time you sign in.

Contact

WinnerFlags
winnerflags@gmail.com