# Privacy policy | QuietJar Legal documentation # Privacy policy How QuietJar collects, processes, and protects personal data: what we collect, why, retention, your rights, and who to contact. Last updated 2026-09-06 QuietJar operates the QuietJar website, the embedded widget, and the API behind them. This policy explains what personal data we process, why, and what rights you have. Supporters can find this policy through the link in the widget. Our company details and contact addresses are in the [imprint](/legal/imprint/). ## Who we are QuietJar is a product of GoodFolk B.V. i.o., which operates the QuietJar website, the widget, and the API. GoodFolk B.V. i.o. is the controller for the personal data described in this policy. Where we process donation data on behalf of a creator, that creator is the controller and QuietJar is the processor. That processing is governed by the [data processing addendum](/legal/data-processing-addendum/). For fee accounting, platform security, and statutory bookkeeping, QuietJar is the controller itself. ## What data we collect **Account data.** Your email address, which is all that registration requires. **Authentication data.** One-time sign-in codes, which expire after five minutes, and session records for the dashboard. **Site and widget data.** The site address the widget runs on, the styling and copy you configure, the country and currency you choose, and whether you receive donations as an individual or a business. **Payment data.** For each donation, the amount, currency, payment status, timestamps, payment identifiers, and our fee, received from Stripe. Card and bank details entered by a supporter go directly to Stripe and never reach us. Where you open a payment account, Stripe collects your details and identity data as a controller under its own privacy policy; we receive only the status of that setup. **Suppression records.** The site, the date, and a pseudonymous identifier ([DESCRIBE, e.g. hash of Stripe payment method fingerprint]), kept on the supporter’s device and on ours, so the widget steps back for [N] days after a donation instead of asking again. **Support data.** Anything you send us by email or in writing. **Technical data.** Connection data such as IP address, user agent, and time of request, processed by our infrastructure to deliver the site, widget, and API securely. ## Why we process your data (purposes and legal basis) - To operate your account, authenticate you, and serve the widget and API. Legal basis: performance of our contract with you, Article 6(1)(b) GDPR. - To account for our fee and keep statutory books and records. Legal basis: performance of contract and legal obligation, Articles 6(1)(b) and (c) GDPR. - To protect the service against fraud and abuse, enforce rate limits, and keep it secure and available. Legal basis: our legitimate interest in a secure and reliable service, Article 6(1)(f) GDPR. - To answer your questions. Legal basis: performance of contract, or legitimate interest before a contract is formed. - To comply with the law and assert or defend legal claims. Legal basis: legal obligation or legitimate interest. We do not profile supporters, sell data, or use anything for advertising. ## How long we keep your data **Payment and fee records.** Seven years, as Dutch tax law requires. **Account data.** For the life of the account, then deleted within 30 days of closure. **Suppression records.** [N] days after the donation, then deleted. **Technical and security logs.** For brief, fixed periods, no longer than 30 days. ## Who we share your data with Only with processors engaged to run the service, each bound by a data processing agreement: our payment provider, our hosting and database provider, and our transactional email provider. The current list, with roles and locations, is on the [subprocessors](/legal/subprocessors/) page. If you are a creator, your payment account is a contract between you and Stripe. Identity checks for that account are processed by Stripe as a controller under its own terms. We share data with authorities only where the law requires it. We do not sell data and share nothing for advertising. ## International data transfers Processing takes place in the EEA, except that Stripe transfers data to the United States under the EU-US Data Privacy Framework and standard contractual clauses. If any other processor were ever to process data outside the EEA, we would rely on an adequacy decision or, failing that, on standard contractual clauses, and record the safeguards on the subprocessors page before the change takes effect. ## How we protect your data Traffic is encrypted in transit with TLS. Payment details are entered directly into Stripe’s certified payment element inside the widget and never reach our servers. Access to production systems is restricted to the personnel who need it, under individual credentials, and logged. Sign-in uses one-time codes rather than passwords. ## Your rights under the GDPR You may request access to your data and its rectification, erasure, restriction, and portability, and you may object to processing based on legitimate interests. Where consent is the legal basis, you may withdraw it at any time. To exercise a right, write to [privacy@quietjar.com](mailto:privacy@quietjar.com). We respond within one month and may ask for proof of identity. If you donated to a website that uses QuietJar, we process your donation for that website, not for ourselves. Direct your request to that website; we assist it in answering you. You may lodge a complaint with a supervisory authority, in particular the Autoriteit Persoonsgegevens, the Dutch data protection authority, or the supervisory authority of your country of residence. ## Cookies and tracking QuietJar sets no analytics or advertising cookies. The dashboard sets strictly necessary session cookies, described in the [cookie policy](/legal/cookie-policy/). The widget itself sets no cookies. ## Children’s privacy The service is aimed at website owners. We do not knowingly process the personal data of children, and registration is open only to persons aged 18 or older. On the sites of the creators who use QuietJar, the creator’s own privacy notice applies to visitors. ## Changes to this policy We publish every change on this page with a new last-updated date. If a change affects processing described here in a material way, we notify account holders by email beforehand. ## Contact us Write to [privacy@quietjar.com](mailto:privacy@quietjar.com). Postal and company details are in the imprint.