1. Data Controller
The data controller is Syntalink (EI), SIRET 910 409 549 00029, based in Lorgues (83510), France. For any privacy request or question, contact contact@actualrep.com. We have not appointed a Data Protection Officer, as we are not legally required to, but the contact above handles all data-protection matters.
2. What We Collect
- Your email address, for your account and optional reply notifications;
- Your chosen pseudo (public display name) and account settings;
- The public content you post: reviews, ratings, forum threads, and replies;
- For verified owners and paid actions: verification and billing information (such as the entity identifier you provide and the payment confirmation from our payment provider). We do not receive or store your full card number;
- Basic technical and log data (such as request timestamps, rate-limit counters, and error diagnostics) needed to operate the Service and detect abuse;
- A one-way, salted hash of your IP address and of its network block, used only to detect coordinated abuse. We never store your raw IP address (see section 6).
3. Why We Process It, and on What Legal Basis
- Providing your account and the Service (sign-in, posting, replies): performance of our contract with you (Article 6(1)(b) GDPR).
- Preventing fraud, fake reviews, and abuse, and keeping the platform safe and secure: our legitimate interest in protecting the integrity of the Service and the rights of others (Article 6(1)(f) GDPR).
- Optional reply notifications and any newsletter: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
- Processing paid premium actions and keeping the related records: performance of a contract and compliance with our accounting and tax obligations (Articles 6(1)(b) and 6(1)(c) GDPR).
4. Your Email Is Private
Your email address is never shown to other users. ActualRep is pseudonymous: what other people see is your chosen pseudo, never your email. We use your email for exactly two things: signing you in, and, only if you turn the setting on, sending you a notification when someone replies to your reviews or posts. We never sell your email address, and we do not use it for marketing you have not asked for.
5. Public Content Is Public
Anything you post (reviews, ratings, forum threads, replies) is public by design and visible to anyone visiting the site, signed in or not. Public pages built from this content may be indexed by search engines and appear in search results. This is separate from, and does not affect, the privacy of your email address. Please do not include personal information about yourself or others in what you post.
6. Abuse Prevention and Network Data
To detect fake reviews, coordinated manipulation, and abuse spread across many accounts, we process a one-way, salted hash of your IP address and of its network block (a /24 subnet). We never store your raw IP address, and these hashes cannot be turned back into your IP by us. They are used only to spot patterns of coordinated abuse, for example many accounts posting from the same network within a short window. Network hashes are kept for at most 90 days and then automatically deleted, and they are removed when you delete your account.
To detect offensive content (hate, harassment, threats), the public text of reviews and posts is checked by an automated moderation service. This applies only to content that is already public and relies on our legitimate interest in keeping the platform safe.
7. Automated Moderation
Some moderation is automated: rate limits, signals of coordinated abuse, and offensive-content detection may automatically fold content behind a warning or apply a rate limit. These measures affect the visibility of public content and the pace of posting; they are not decisions that produce legal effects on you or similarly significantly affect you in the sense of Article 22 GDPR. If you believe a measure was applied in error, you may contact us at contact@actualrep.com for human review.
8. Who Processes Your Data (Sub-Processors)
We do not sell your personal data and do not share it except with the service providers that operate the Service on our behalf, each bound to process it only on our instructions:
- Vercel Inc. (USA): website hosting and delivery, request logs;
- Supabase: database and authentication hosting;
- SMTP2GO: delivery of account and notification emails;
- OpenAI: automated moderation of public content;
- Stripe: processing of payments for premium actions;
- Sentry: technical error monitoring and diagnostics;
- Cloudflare: routing of inbound email sent to our contact addresses.
We may also disclose data where required by law, to respond to a valid legal request, or to protect our rights, safety, and the integrity of the Service.
9. International Transfers
Some of our providers are located outside the European Economic Area, in particular in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards recognised under the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy mechanism (for example certification under the EU-US Data Privacy Framework), so that your data continues to benefit from an adequate level of protection.
10. Data Retention
We keep your account data (email, pseudo, preferences) for as long as your account is active. Public content you have posted generally stays on the Service even if it is reported, since reported content is folded behind a warning rather than deleted, which preserves a fair record for both sides. Network abuse hashes are kept for at most 90 days. Records relating to paid premium actions are kept for the period required by accounting and tax law (up to 10 years). Technical logs are kept only as long as reasonably needed for security and operation.
11. Your Rights
Under the GDPR you have the right to access, rectify, erase, or restrict the processing of your personal data, to object to processing based on our legitimate interest, to data portability, and to withdraw any consent you have given, at any time, without affecting processing carried out before withdrawal. To exercise these rights, contact contact@actualrep.com. Because your public posts serve other users and the historical record, deleting your account may anonymise rather than remove content you have already posted, and some data may be retained where the law requires it.
If you believe your data-protection rights have been infringed, you have the right to lodge a complaint with a supervisory authority, in France the CNIL (Commission Nationale de l'Informatique et des Libertes, www.cnil.fr), or the authority of your country of residence.
12. Security
We take reasonable technical and organisational measures to protect your data, including encrypted connections, restricted access, salting of network identifiers, and reputable infrastructure providers. No online service can be guaranteed to be perfectly secure, but we work to keep your data safe and to limit what we collect in the first place.
13. Cookies
We use only essential cookies required to keep you signed in and to secure your session. We do not use advertising or third-party tracking cookies, and we do not build advertising profiles. Because these cookies are strictly necessary to provide the Service, they do not require prior consent.
14. Children
The Service is not intended for children. You must be at least 18, or the age of majority in your country, to create an account. If you believe a minor has provided us with personal data, contact contact@actualrep.com and we will delete it.
15. Changes to This Policy and Contact
We may update this policy as the Service evolves or as the law requires. Material changes will be reflected on this page with an updated date. For any privacy question or request, contact: contact@actualrep.com. See also our Terms of Use.