Privacy Policy
This Privacy Policy explains what personal data DesiDekhoo collects, why we collect it, how long we keep it, and what rights you have. We minimise data collection: our only third-party processing is two aggregate-measurement analytics tools — Google Analytics 4 and Umami (the latter is cookieless and anonymised). We run no advertising and no ad trackers, and the Service contains no referral or commission links. Video content is hosted by us: files are stored in Cloudflare R2 object storage and served from our Cloudflare-proxied media domain (media.desidekhoo.com), and playback happens on-site — watching a video involves no advertising or referral network. The data on our own infrastructure is limited to web-server access logs, two functional first-party cookies, the standard Google Analytics cookies described below, and event pings sent to Umami (no cookies set in your browser).
1. Scope
This Policy applies to personal data we process when you access the Service. It does not apply to third-party websites you may visit by following a link from the Service; those sites operate under their own privacy policies, which you should consult separately.
2. Data controller
DesiDekhoo is the controller of personal data processed in connection with the Service. Contact: peterdgarrido@proton.me. The full corporate registered address is provided in the Imprint and on request.
3. Categories of personal data we collect
(a) Server access logs — IP address (as forwarded by Cloudflare in the CF-Connecting-IP header), timestamp, requested URL, response status, user-agent string, referrer. (b) Cookies — see Cookie Policy. (c) Communications — content of any email you send us. (d) Google Analytics 4 measurement data — IP address (truncated by Google before storage), pseudonymous client identifier (in the _ga cookie), page URL, referrer, user-agent, device class, country/region, and aggregate event data (pageviews, session duration, scroll depth). Google Analytics is processed by Google LLC; we do not link GA data to any other identifier on our side. (e) Umami analytics measurement data — page URL, referrer, user-agent string (anonymised), and inferred country/region from a hashed and rotated IP-derived identifier. Umami does NOT set cookies, does NOT store IP addresses, and does NOT use cross-session tracking. Processed by Umami Software Inc. We collect NO accounts, NO passwords, NO payment data, NO precise geolocation, and NO biometric data, and we do not build behavioural advertising profiles — no advertising network processes data on or via the Service.
4. Purposes of processing
(i) Operating and securing the Service (logs); (ii) remembering your age confirmation and audience preference (cookies); (iii) responding to your communications; (iv) detecting and preventing abuse, fraud, and security incidents (logs); (v) aggregate traffic measurement — understanding how many visitors use the Service, which pages perform, and which sources refer them, so we can improve the experience (Google Analytics + Umami).
5. Legal bases — GDPR Article 6
Server logs: legitimate interest in operating, securing, and improving the Service (Art. 6(1)(f)). Functional cookies: necessary for the service requested by you (Art. 6(1)(b) and Recital 30 / ePrivacy strict-necessity exemption). Communications: necessary for pre-contractual / contractual measures and our legitimate interest in responding (Art. 6(1)(b) / 6(1)(f)). For the age-confirmation cookie we additionally rely on your consent acknowledged when you pass the age-gate (Art. 6(1)(a)). Google Analytics: legitimate interest in measuring aggregate traffic and improving the Service (Art. 6(1)(f)). Where local law requires affirmative consent for analytics cookies (in particular, ePrivacy / GDPR jurisdictions), and where consent has not been provided, we will not load Google Analytics; if you are accessing from such a jurisdiction and wish to opt out, see Section 7 below. Umami: legitimate interest in measuring aggregate traffic (Art. 6(1)(f)); because Umami is cookieless and does not store IP addresses, it qualifies under the ePrivacy strictly-necessary exemption for measurement in most EU implementations and does not require additional consent under most national frameworks.
6. Cookies and local storage
See our Cookie Policy at /cookie-policy for a per-cookie disclosure. Browser localStorage is used to persist one optional engagement feature: a favourites list. It is stored in your browser only and never transmitted to our servers.
7. Analytics and opt-outs
We use two analytics services: Google Analytics 4 (Google LLC, USA) and Umami (Umami Software Inc., USA). To opt out of Google Analytics: (a) install Google's official opt-out browser add-on at https://tools.google.com/dlpage/gaoptout; (b) block third-party cookies in your browser settings; or (c) use a browser-level tracker blocker such as uBlock Origin. To opt out of Umami: block requests to cloud.umami.is in your browser or via any tracker blocker (Umami sets no cookies, so cookie-blocking alone does not stop it). These two analytics services are used for aggregate measurement only. We run no advertising networks and no ad trackers of any kind.
8. Sharing of personal data
We do not sell, rent, or share your personal data for money or for cross-context behavioural advertising. We run no advertising network and the Service contains no referral or commission links, so no click or browsing data is shared with any advertising or referral partner. We do not disclose personal data to third parties for commercial purposes. We may disclose personal data: (a) to subprocessors that operate the Service (see /subprocessors); (b) to comply with valid legal process (see /law-enforcement-requests); (c) to protect rights, safety, or property; (d) in connection with a corporate transaction (merger / acquisition), in which case the acquirer will be bound by no-less-protective terms.
9. International transfers
Our infrastructure is operated within the European Union (Cloudflare global edge + an EU-based VPS provider). Google Analytics data is processed by Google LLC in the United States and is transferred under the EU–US Data Privacy Framework (Google LLC is a self-certified participant). Umami analytics data is processed by Umami Software Inc. in the United States; the transfer relies on Umami's published Data Processing Addendum and Standard Contractual Clauses where applicable, and is mitigated by the fact that Umami does not store IP addresses or set cookies. Where other personal data is transferred to a recipient outside the EEA we rely on the European Commission's Standard Contractual Clauses (2021/914) or an adequacy decision.
10. Retention
Server access logs: up to 30 days, then deleted or anonymised. Functional cookies: 12 months from last visit (you can clear earlier in your browser). Google Analytics user data: 14 months from the user's last activity, then deleted by Google (per our configured retention setting in GA4). Umami analytics data: retained by Umami Software Inc. per its standard policy (typically 6-12 months for Umami Cloud) — since no personal identifier is stored, the data is fully anonymised aggregate data. Communications: retained for as long as needed to address the matter and as required by law (typically up to 36 months). Records related to legal claims, takedown notices, transparency reporting, and tax/accounting obligations: as required by the applicable statute of limitations and accounting laws.
11. Your rights
Depending on where you live, you may have the rights to access, rectify, erase, restrict processing, port, object, and withdraw consent. EU/EEA/UK residents: see /gdpr-rights for the detailed Article-by-Article description and supervisory-authority lodging. California residents: see /ccpa-rights for CCPA/CPRA rights.
12. How to exercise your rights
Email peterdgarrido@proton.me with the subject line "Data Request — [right]". We acknowledge within 5 business days and respond substantively within 30 days (extensible to 90 in complex cases, with notice). We may need information sufficient to verify your identity; we will not ask for more than necessary.
13. Security
We use industry-standard technical and organisational measures: TLS for all traffic; Cloudflare WAF; a private origin reachable only from Cloudflare IP ranges; principle of least privilege for operational access; periodic dependency updates and review.
14. Children
The Service is strictly for adults. We do not knowingly collect personal data from minors. If you believe a minor has provided us personal data, contact peterdgarrido@proton.me and we will delete it promptly.
15. Automated decision-making
We do not engage in any solely-automated decision-making that produces legal or similarly significant effects on you.
16. Changes
We may update this Policy from time to time. The effective date will be revised at the top. Material changes will be brought to the visitor's attention via a site-wide banner for at least 14 days after they take effect.
17. Contact
Privacy questions, requests, and DPO matters: peterdgarrido@proton.me.