Privacy Notice | onPaigeOne

This Privacy Notice explains how Duska, LLC ("we", "us", "our"), operator of onPaigeOne, collects, uses, shares, and protects personal data when you use the site. Duska, LLC is the data controller for the personal data described here.

1. Data We Collect

Account data: email address, username/handle, display name, bio, avatar, profile tags and accent choices, and authentication credentials (managed by our authentication provider; social sign-in data such as your Google name and avatar when you sign in with Google).
Content you post: comments, replies, reports, ban appeals, and profile information you choose to publish.
Usage data: pages viewed and basic telemetry used to understand site traffic, device/browser type, and approximate location derived from IP address.
Support and correspondence: messages you send us, including appeals and permission requests.

Payment data (card numbers, billing details) is collected and processed directly by Stripe — we never see or store your full payment card details.

2. Why We Use It & Legal Bases

Providing the Service (account creation, authentication, profiles, comments, badges, memberships) — contract performance.
Security, moderation, and fraud prevention (word filters, first-comment review, bans, report handling) — legitimate interests.
Product improvement and traffic analysis — legitimate interests.
Customer support — contract performance and legitimate interests.
Legal obligations (tax records, lawful requests) — legal obligation.
Optional communications such as a newsletter — consent, which you can withdraw at any time.

3. Who We Share Data With

Service providers/subprocessors: hosting, database, authentication, and analytics providers that process data on our behalf to operate the Service.
Payment processor: Stripe processes sales, subscriptions, donations, payments, tax collection, and invoicing on our behalf.
Professional advisers: legal and accounting advisers where needed.
Authorities: where required by law or to protect rights, safety, and security.

We do not sell your personal data.

4. Retention

We keep personal data only as long as needed for the purposes above — generally for as long as your account is active, plus a limited period afterward for legal, tax, and security requirements. When data is no longer needed, it is deleted or anonymised. You may request deletion of your account and associated data at any time.

5. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and row-level security rules on our database. No method of transmission or storage is 100% secure, but we work to protect your information.

6. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or port your personal data, to object to processing, and to withdraw consent where processing is based on consent. To exercise any of these rights, contact us through the channels on our About page. We will respond within the timeframe required by applicable law (within one month where GDPR applies). If you are in the UK/EEA, you also have the right to complain to your local data protection authority.

7. International Transfers

Our service providers may process data outside your country, including in the United States. Where data leaves the UK/EEA, we rely on appropriate safeguards such as standard contractual clauses or adequacy decisions.

8. Cookies

We use essential cookies and browser storage required for sign-in and security. We do not use third-party advertising or marketing trackers. You can clear cookies and site data at any time through your browser settings; signing in again will restore the essential ones.

9. Children

The Service is not directed at children under 13 (or the age of digital consent in your jurisdiction), and we do not knowingly collect their personal data.

10. Changes

We may update this Privacy Notice from time to time. Material changes will be posted on this page with a revised "last updated" date.