Privacy

The short version

There are no accounts on beerVote.me, so there is no profile to build. The site does not know who you are, does not track you from page to page, and does not send anything about you to an advertiser or an analytics company. There is nothing here to sell and none of it is sold.

Votes are anonymous. When you pay for one, your name, address and card details are entered on Stripe’s checkout and this site never sees them.

The rest of this page is the detail behind that.

Who is responsible

The controller for the data described here is Jens Kafitz, Blektestraat 52, 9308 Aalst, Belgium — mail@beervote.me. Full details are on the legal notice.

Your IP address

The front page opens with the ranking for your own country, because “#14 in Germany, twelve votes off #13” is a far more interesting thing to read than a position in the world. Working out which country you are in means looking at the address your request came from.

That lookup happens on this server, against a table of address ranges stored in the site’s own database. Your address is not sent to a geolocation service or to anybody else, and it is not written down. It is used for the length of the request and then gone.

Votes

When a vote is counted, the site stores four things:

• which beer it was for;
• when it happened;
• a reference to the purchase that paid for it;
• a one-way fingerprint of the address the vote came from.

That last one is not your address. It is a salted SHA-256 hash, shortened, and there is no way to turn it back into an address. What it can do is show that a hundred votes in one minute came from a single place, which is the only question it exists to answer. It is kept because a paid ranking that cannot spot manipulation is not worth voting in.

The legal basis is our legitimate interest in keeping the ranking honest (Article 6(1)(f) GDPR).

Cookies

There are no tracking cookies on this site, no analytics, no advertising pixels and no third-party scripts loaded on an ordinary page. There is no cookie banner because there is nothing to ask you about. Two cookies exist, both strictly functional:

• A session cookie, set only when you use a form — adding a beer, or voting. It carries a token proving the form came from this site, and it disappears when you close the browser.
• A country cookie, set only if you pick a country yourself, holding those two letters and nothing else. It lasts 180 days and exists so a wrong guess only has to be corrected once. Delete it in your browser at any time; the site simply guesses again.

Beers you add

Anyone can add a missing beer without an account. What you type — the beer, the brewery, the country and the style — is published on the site for everybody, which is the whole purpose of adding it. Nothing else is recorded, and the entry is not tied to you.

Please do not type personal information into those fields. Anything you put there becomes a public page.

Paying for a vote

Votes are sold by the operator named on the legal notice; the payment itself is handled by Stripe. What happens is this:

• When you press a vote button, this server asks Stripe to open a checkout. It tells them which beer, how many votes, and our own reference for the purchase. Nothing about you is sent — not your address, not the country this site guessed you are in.
• Your browser is then sent to Stripe’s own checkout page. From that moment it is their page, and your IP address and browser details reach them directly. This is unavoidable — you are paying them.
• The name, address, email and card details you enter go to Stripe and stay there. This site is never sent them and has nowhere to put them.
• When the payment succeeds, Stripe tells this server so, quoting our reference. The votes are counted from that message.

Stripe is a separate controller for everything it collects, under its own privacy policy. What this site keeps about a purchase is the reference, the beer, how many votes it bought, whether it has been paid for, and when — no name, no email, no address, no card data. The legal basis is performance of the contract (Article 6(1)(b) GDPR).

Nothing on this site is loaded from anybody else’s server — no fonts, no analytics, and no payment script. Paying takes you to Stripe’s own page, so until you choose to go there, nothing about you has been sent anywhere at all.

Server logs

The company hosting this site keeps ordinary web server logs, which include IP addresses, for a short period. That is standard for any website and is needed to keep the server running and secure. It is not used to build any picture of a visitor.

How long things are kept

• Votes and their fingerprints are kept for as long as the ranking exists — a vote that is deleted is a ranking that no longer adds up.
• Purchase records are kept as long as needed for the ranking and for accounting. Checkouts that were opened and never paid for are deleted automatically after a day.
• Beers you add stay on the site until removed or merged with a duplicate.

Who else sees any of this

The hosting company, which necessarily stores the site’s files and database, and Stripe for the payment. Nobody else. Nothing is sold, rented, or shared with advertisers, data brokers or analytics companies. Data would only be handed over if the law required it.

Your rights

Under the GDPR you have the right to ask what is held about you, to have it corrected or deleted, to restrict or object to its use, and to receive it in a portable form. Write to mail@beervote.me.

An honest limitation: because voting is anonymous, this site usually cannot tell which data is yours, and it will not ask you for extra identifying information just so that it can (Article 11 GDPR). If you have a purchase reference, that is the one thread that leads back to a specific order — quote it and the request can be acted on.

You can also complain to a supervisory authority. Ours is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels — or the authority in the country where you live.

Children

This site is about alcoholic drinks and is not intended for children. Nothing is knowingly collected about them.

Security

The site is served over HTTPS and holds nothing that could identify you to begin with, which is the strongest privacy measure available to it. No system is perfect, and no site can promise otherwise.

Changes

If this policy changes, the new version is posted here and the date at the top is updated.