1. Signup and email confirmation
Single launch announcement
If you request it, we will process your email address solely to verify it and subsequently send one announcement that Hotnot is ready. We also record that you confirmed you are at least 18. The announcement may be a marketing communication promoting Hotnot; we send it on the basis of your prior consent under Article 6(1)(a) GDPR and Section 7 of Czech Act No. 480/2004 Coll. It will be clearly labelled, identify NAXTER DEV s.r.o. as the sender and offer direct unsubscription. This is not a subscription to an ongoing newsletter or consent to third-party offers.
Interest in testing
This purpose is optional and separate from the launch announcement. We process your email for contact about selection and possible participation in future testing, together with your confirmation that you are at least 18. Such an invitation or related offer may be a marketing communication promoting Hotnot. We send it only with your prior consent under Article 6(1)(a) GDPR and Section 7 of Czech Act No. 480/2004 Coll.; each marketing communication will be clearly recognisable, identify NAXTER DEV s.r.o. as the sender and offer direct unsubscription for this purpose. Signup does not guarantee selection or access to testing; before possible admission you will receive separate beta test terms and current data processing information.
Shared technical data and records of evidence
We keep a separate record for each selected purpose. Besides email, it contains an internal identifier, signup purpose and status, submission, confirmation, latest related email and any withdrawal times, expiry, consent and privacy notice versions, the 18+ confirmation status, a confirmation token hash and two keyed one-way HMAC fingerprints: of the normalised email and the IP address used for submission.
For new signups we also record the form language and a fingerprint of the archived consent wording and related information. These help demonstrate which wording was presented at signup; we do not infer missing language evidence for older records.
The email HMAC identifies repeat signups and documents the signup process; the IP HMAC helps limit and investigate abuse. We process the age confirmation status on the basis of legitimate interests under Article 6(1)(f) GDPR to enforce the pre-launch signup age restriction. HMAC fingerprints and necessary process records use the same legal basis for security and accountability; Article 7(1) GDPR also requires us to demonstrate marketing consent. We do not store the raw IP address in the database, but HMAC fingerprints are not anonymous: with an internal secret key they can be compared with a specific input, so we treat them as personal data.
A launch record created before the shared 18+ requirement may indicate that age was not confirmed. We will not confirm such a record using an old link, count it as an active contact. If you resubmit the form with 18+ confirmation, we send a new verification link; only using it activates the record. Until then we do not use the old record for mailings and retain it as evidence of the historical process only for the remainder of its original retention period, or delete it earlier.
Double opt-in
After form submission we create a pending record for each selected purpose and attempt to send a neutral confirmation email to the address provided. Confirmation requires two steps: open the email link, then click “Confirm email” on the page. Opening the link alone does not activate the record. If you selected both purposes, one shared link opens the confirmation page and one click confirms both separate records. The email also contains a separate cancellation link for each selected purpose that works before confirmation. If you neither complete confirmation nor cancel, no purpose is activated and the pending record is deleted within the period stated below.
2. Contact form
We process your reply email, message content and any name you voluntarily provide. The application does not store the message in its database: after verification it forwards it through the configured SMTP service to the controller’s work mailbox. The SMTP and mailbox providers may also hold copies and technical records for the necessary period.
The purpose is to receive, handle and follow up on your message. If the enquiry is a step you take before potentially entering a contract, the legal basis is Article 6(1)(b) GDPR; for other messages it is our legitimate interest in communicating and handling requests under Article 6(1)(f) GDPR.
Do not send health data, information about your sex life or sexual orientation, identity document copies, passwords or other sensitive or unnecessary personal data. If we receive such data without a reason, we will not use it further and will delete it as appropriate.
3. Website and administration security
Cloudflare Turnstile and rate limits
Cloudflare Turnstile protects the signup and contact forms. When loaded, Cloudflare technically processes in particular your IP address, browser and device information, network connection and page information, the security check result and, depending on the method, other signals needed to distinguish people from automated traffic. The application receives a verification token and the result; it does not store the token itself in the database.
For short-term rate limits we process an IP HMAC in application memory. It is removed after the relevant time window; it is not a permanent database record. We have disabled nginx access and error logging for this website to avoid storing full IP addresses, URLs, referrers or browser identification. Network infrastructure must nevertheless temporarily process your IP when establishing a connection, and hosting or network security providers may process it under their security rules.
The legal basis is our legitimate interest in website security, spam prevention and availability under Article 6(1)(f) GDPR. Automatic protection may temporarily reject a form, but this is not automated decision-making with legal or similarly significant effects under Article 22 GDPR. If you cannot send a legitimate message, you can write directly to info@hotnot.cz.
Administration
The protected administration area is not for visitors. An authorised administrator authenticates through Google OpenID Connect with only the scopes openid and email; the application does not access Gmail, contacts or Drive files. To protect access we retain the verified administrator email, stable Google account identifier, session token hash and short-lived login flow data. The security audit records the administrator email, action type, any affected signup record identifier, IP HMAC and time.
The legal basis is the controller’s legitimate interest in access management, traceability of actions and personal data protection under Article 6(1)(f) GDPR.
4. Optional analytics
Only with your prior explicit consent do we use Google Analytics 4 for aggregate public-page traffic statistics and to improve clarity. The legal basis is consent under Article 6(1)(a) GDPR; optional identifiers are stored or read on your device only with prior consent under Section 89(3) of Czech Act No. 127/2005 Coll. Rejecting is as easy as accepting. Without consent the Google tag is not downloaded and this page sends no analytics request to Google.
Once enabled, analytics may process pseudonymous cookie identifiers, the public page path without parameters or fragments, visit time, a referral source limited to an origin or safe path, basic browser and device information and approximate location derived from the IP address. The IP address is technically used for the connection; according to Google Analytics settings for EU operations it is discarded before storage. We do not send email, name, form contents, testing choices, confirmation or unsubscribe tokens, or administration data. We do not enable Google Signals, advertising storage or ad personalisation.
The browser remembers acceptance or rejection for up to 12 months. We limit event and user data retention in Google Analytics settings to 2 months; standard aggregate reports without a direct identifier may remain available longer. Before enabling production analytics the controller must verify that the actual service settings match this information; otherwise analytics must not be activated.
5. Voluntary provision, age and data sources
We obtain data directly from you, and technical data also from your device, network connection and participating security or analytics services. Providing data is voluntary and is not a statutory or contractual obligation. Without your email and consent for a particular purpose we cannot send the requested announcement or contact you about testing; without required form details we cannot answer your message. Consent to one purpose is not a condition of the other purpose or use of the public page.
Both pre-launch signup options are only for people aged 18 or over. The form requires confirmation of this fact. A legal guardian’s consent does not replace the age requirement. We do not automatically check identity documents or identity. If we discover that someone under 18 has signed up, we delete their signup record.
6. Retention periods
Automatic database cleanup runs at application startup and then every 6 hours. After the stated period we no longer use the record, and the next cleanup physically deletes it: within a further 6 hours during continuous operation, or immediately at startup after downtime.
- An unconfirmed signup, including email, HMAC fingerprints and the hash of the already invalid confirmation token, expires after 14 days from submission. The confirmation link is valid for 48 hours.
- We retain a confirmed launch record, including email, purpose, timestamps, versions, 18+ status and email HMAC, until the announcement is sent, for no more than 730 days from confirmation. After sending we delete it without undue delay.
- We retain a confirmed testing-interest record with the same categories and 18+ confirmation until recruitment closes, for no more than 365 days from confirmation.
- The signup IP HMAC expires 30 days after submission and is deleted by the next scheduled cleanup; the email HMAC remains for the lifetime of the signup record.
- After consent is withdrawn we immediately empty the email field and replace its normalised form with a technical label. For at most 90 days we retain a limited evidence and security record: internal identifier, purpose, status, timestamps, versions, 18+ status and email HMAC; the IP HMAC only until the stated 30 days have elapsed. Then we delete the entire signup record.
- We retain contact messages and follow-up communication in the work mailbox for handling and protecting rights, normally no longer than 12 months after resolution; longer only for a legal obligation or a specific dispute.
- The administrator login flow expires after approximately 10 minutes and a session normally within 8 hours at most. We retain the link between administrator email and Google identifier for the duration of access authorisation and delete it after access is revoked. Administration security audits are retained for at most 3 years.
- Analytics choices and cookies have a maximum lifetime of 12 months; details of Google Analytics data are in section 4.
Only anonymous daily totals of completed confirmations by purpose may be kept without a time limit. They contain no email, HMAC, IP address or signup record identifier and are not used to identify an individual.
Deleting data from the live database does not itself delete earlier backup copies. When backups are enabled, compressed SQL backups are encrypted with a public key, stored with restricted access and delivered to a private business mailbox solely for recovery after a failure. The private recovery key is kept separately, outside the server and mailbox. Copies containing personal data must be retained for no more than 30 days after creation; this is not a general statutory period. Local copies are rotated automatically while the backup service is running; mailbox copies, attachments, downloaded copies and trash are removed manually within the same period. Backups must not be used for mailings or other routine processing. Before a restored database returns to service, all subsequent withdrawals, erasures and expired retention periods must be reapplied.
Previously downloaded working contact exports must be deleted once their original purpose is complete. The administration interface no longer provides CSV exports. Any use of older copies must account for subsequent withdrawals and erasures; copies must not circumvent withdrawal of consent.
7. Recipients and transfers outside the EEA
To the extent necessary, recipients may include our authorised administrators and providers of application and database hosting, network infrastructure, SMTP delivery and the work mailbox. Providers dependent on production configuration may be engaged only after their actual identity, role, processing locations, retention, security and Article 28 GDPR agreement have been verified. We will provide their current identities on request at info@hotnot.cz.
Forms are protected by Cloudflare, Inc. and its participating suppliers. Turnstile may process data outside the EEA; see Cloudflare’s Turnstile information.
Google processes administrator data only when entering the protected area. When analytics is enabled, the service provider is Google Ireland Limited, which may involve other Google group companies and its processors.
Transfers outside the EEA must have a specific legal mechanism under Chapter V GDPR: a European Commission adequacy decision, or appropriate safeguards such as standard contractual clauses and supplementary measures according to risk. Reliance on the EU–US Data Privacy Framework requires verification of the particular recipient’s valid certification and its scope. On request, the controller will provide information about the mechanism actually used for each recipient and how to obtain a copy of the relevant safeguards.
8. Withdrawing consent and your rights
You can withdraw each email purpose separately. Separate links are included in the confirmation email and every later message for that purpose. A link cancels only its own purpose: unsubscribing from launch announcements does not automatically cancel separately confirmed testing interest, and vice versa. To cancel both purposes at once, write through the contact form or to info@hotnot.cz.
You can change analytics consent just as easily using the . Withdrawing consent does not affect the lawfulness of earlier processing.
You may request access to your personal data, rectification or erasure, restriction of processing and data portability where the statutory conditions are met. You may object to processing based on legitimate interests. You may object to direct marketing at any time free of charge; we must then stop processing your data for that purpose. For a single announcement, withdrawing consent has the same result. We respond without undue delay, normally within one month; we may reasonably verify your identity before handling the request.
You can lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7. We would appreciate the chance to resolve the issue first, but this is not a condition for lodging a complaint.
9. Cookies and local storage
Your browser stores your light or dark theme choice in local storage under a technical key; it remains until overwritten or cleared and is not sent to the controller. Your analytics decision is stored locally for up to 12 months so we can respect it. Turnstile may use technical means necessary for security verification.
Your language choice is stored for one year in the necessary hotnot_language cookie.
Administration uses a necessary secure session cookie and a short-lived cookie protecting the OpenID Connect login flow. They are set as HttpOnly, Secure and are not accessible to JavaScript.
After analytics is enabled, Google Analytics may set the cookies _ga and _ga_<ID> with a maximum lifetime of 12 months. Analytics does not load when rejected. On withdrawal we disable it, attempt to remove its cookies and no longer load the Google tag after page refresh.
10. Changes to this information
We always publish the current version at this address. Text changes do not extend previously granted consent to a new purpose; if a change requires new consent or materially affects an existing signup, we will request consent or inform you appropriately. The terms for the current pre-launch website are on the Terms of use.