Privacy Notice

Controller and contact

Flavio Thomi, established in the Canton of Zurich, Switzerland, is the controller responsible for personal data handled by InvitedRaters. Privacy questions and requests can be sent to support@flaviothomi.com.

Legal framework

The controller's processing is primarily governed by the Swiss Federal Act on Data Protection (FADP). Other mandatory privacy and data-protection laws may also apply based on the affected person, the processing, or the service's reach. This legal framework and the jurisdiction provision in the Terms do not change where providers process data or the legal obligations that may apply to them.

Who this notice concerns

This notice covers visitors, invite recipients, members, people described in public profiles, people who submit reports or appeals, and anyone who contacts support.

Data we receive and its sources

• Account and authentication data: display name, invitation and policy-acceptance history, passkey public keys and metadata, recovery-code records, sessions, and security events. InvitedRaters does not receive passkey biometrics or private keys.
• Community data: ratings, votes, posts, replies, profile edits, source links, public rater details, reports, appeals, claims, moderation actions, and related audit records.
• Public-profile data: names, descriptions, images, source identifiers, and other facts supplied by members or obtained from attributed public sources such as Wikipedia, Wikidata, Wikimedia Commons, and linked websites.
• Technical and support data: IP-derived request and abuse signals, timestamps, route and operational logs, browser and protocol information, and the contents and metadata of support email.

Purposes and legal bases

We use data to issue invitations, authenticate accounts, provide community and profile features, publish selected contributions, calculate scores, keep the service secure, prevent manipulation, moderate content, handle corrections and rights requests, troubleshoot failures, and comply with law. Where a legal basis is required, we rely on performing our agreement with members, legitimate interests in operating a safe and accountable public-information service, legal obligations, and consent where we specifically ask for it. We balance legitimate interests against the rights and reasonable expectations of affected people.

Public visibility and search indexing

Public profiles, aggregate scores, ratings, posts, replies, public rater profiles and chains, and contribution vote or edit histories can be visible without an account. In production, successful public pages may be indexed, followed, copied, and cached by search engines and other visitors. Account controls, reports, forms, moderation areas, and other private or system pages are marked not to be indexed. Search engines operate independently, so removing material from InvitedRaters may not immediately remove cached or copied results.

Authentication

Members authenticate with passkeys. InvitedRaters stores the public-key credential and related security metadata; the private key and biometric checks, when used, stay on the member's device.

Cookies and local browser storage

InvitedRaters uses an essential session cookie for signed-in access and security. The theme preference is stored in local storage. Session storage temporarily keeps scroll-restoration information and pending Wikimedia image details so navigation works as expected; it is cleared by the browser session or after use. The service does not currently use advertising cookies or behavioural advertising trackers.

Providers and recipients

Necessary data is available to the operator and providers that support the service. Render hosts the application, PostgreSQL database, logs, and backups in Virginia, United States. Apple iCloud provides the support-email mailbox and may process email and account data internationally. Wikimedia services and external image hosts receive the ordinary network data described below. Information may also be disclosed when legally required or necessary to protect rights and safety.

Eligible members search English Wikipedia directly from their browser, so Wikipedia receives the search text and ordinary network information. Wikidata receives candidate item identifiers to verify that results represent people. When a result is selected, its Q-ID, article title, display name, and description are sent to InvitedRaters. A newly created profile can load image and license metadata directly from Wikimedia Commons before a member submits it. Browsers request externally hosted profile images from their source with the page referrer suppressed, so that host still receives the visitor's IP address.

International transfers

Because Render processes data in Virginia and Apple may process support email in multiple countries, data can leave Switzerland or the country where a person is located. Render's Data Processing Addendum provides applicable transfer safeguards, including recognized adequacy mechanisms or standard contractual clauses where needed. Apple describes its international processing and safeguards in its Privacy Policy. We assess providers and use contractual or legally recognized safeguards where the destination does not provide adequate protection.

Retention

Accounts are kept while active and then handled through the removal process. Used or expired invitations are retained for 30 days; unappealed notifications for 90 days; security, audit, abuse-signal, and released or expired velocity-hold records for 180 days; and appeals, expired sanctions, closed claims, closed reports, restoration requests, identity-verification requests, and maintenance records for one year. Successfully processed event records, expired or revoked web sessions, and consumed or revoked recovery-code records are cleaned after 30 days; expired bootstrap enrollments and stale worker heartbeats after 7 days. Public contributions may be retained in anonymized form after account removal to preserve discussion and score integrity.

Removal is targeted within 30 days after a verified request. Backups can retain data for up to 30 additional days before rotation. A documented legal or safety hold may suspend deletion only for its recorded scope; holds are reviewed at least every 90 days and expire no later than one year after creation unless a new lawful basis and review are recorded.

Security

We use access controls, encrypted transport, secure session handling, passkey authentication, request protection, audit trails, rate limits, backups, and restricted operational access. No online service can guarantee absolute security. Please report suspected compromise promptly and do not send passwords, passkey secrets, recovery codes, or unnecessary identity documents by email.

Your rights and complaints

Depending on applicable law, you may ask whether we process your data and request access, export, correction, deletion, restriction, or objection, and may withdraw consent without affecting earlier processing. Use the Account Export & Deletion instructions or email support@flaviothomi.com. We may need to verify identity and will target a response within 30 days. You may also complain to the Swiss Federal Data Protection and Information Commissioner or another competent data-protection authority.

Score aggregation

The service automatically combines eligible member ratings and votes into public averages, counts, rankings, and history views. Account status and moderation rules can determine which contributions count. These displays summarize community input; they are not decisions that produce legal or similarly significant effects about the profiled person or contributor.

Changes to this notice

We will publish a new effective date and version when this notice changes. If a change materially affects account processing, we will provide reasonable notice through the service or the registered contact channel where required.