Privacy policy

Last updated: 2026-10-13

Service operated by: DigitalFreedom — a brand of DigitalFreedom Global LLC

Data controller (legal entity): DigitalFreedom Global LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States

• Data protection: data-protection@digitalfreedom.co.za
• Data protection request form: https://data-protection.digitalfreedom.co.za
• General: hello@digitalfreedom.co.za

1. Introduction

This Privacy Policy explains how DigitalFreedom Global LLC ("we", "us") collects, uses, stores and protects personal data when you visit the website at pourenzo.app ("the website").

Scope. Pourenzo is an app in development. It is not yet available in any app store, so this Policy covers the website only. The app's own processing will be described before the app is released.

1.1 Global scope

The website can be reached from every country. This Policy applies globally, regardless of where you access it.

1.2 GDPR as the global baseline

We apply the EU General Data Protection Regulation (GDPR) as a global floor: every visitor, in every country, gets at least the GDPR-level protection set out here. Where your local law is more protective, the more protective standard applies. Laws we align with include the GDPR and BDSG, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the CCPA/CPRA and the other US state privacy statutes, PIPEDA, the Australian Privacy Act 1988, the Brazilian LGPD, the Japanese APPI, the Korean PIPA, the Indian DPDP Act and POPIA.

2. Data controller

The controller under Art. 4(7) GDPR is:

DigitalFreedom Global LLC (trading as DigitalFreedom)
30 N Gould St, Ste N
Sheridan, WY 82801
United States

For data protection inquiries use the request form at https://data-protection.digitalfreedom.co.za or write to data-protection@digitalfreedom.co.za. You may use either route — and any other channel you like; we act on your request however it arrives.

No Data Protection Officer is appointed: the Provider does not meet the threshold of Art. 37 GDPR / § 38 BDSG.

3. Data we process

3.1 The website

Hosting. The website is a set of static files hosted on GitHub Pages (GitHub, Inc., United States). GitHub documents that when a GitHub Pages site is visited, the visitor's IP address is logged and stored for security purposes. We have no access to these logs and keep no server logs ourselves.

Google Analytics. Before you accept, Google Analytics is not loaded at all: your browser makes no request to Google, and nothing is stored on your device. Only after you click Accept in the cookie banner is the tag loaded and are page views measured. The advertising categories of Consent Mode stay denied in every case. Details, including the cookie names and durations, are in the cookie policy.

What the website does not do. It has no account, no form, no newsletter and no comment function. It loads no third-party font, no CDN resource, no embedded video and no social plugin.

3.2 Support and legal correspondence

If you write to us — by email, through the support form at https://support.apps.digitalfreedom.co.za or through the data protection request form — we process the content of your message, your email address and whatever you choose to include, in order to answer you. Legal basis: Art. 6(1)(b) and (f) GDPR, and Art. 6(1)(c) for requests we are legally required to handle.

4. Legal basis for processing

5. How we use your data

We use your data to deliver the website, to keep it secure, to measure its reach once you have consented, to answer your messages and to comply with legal obligations. We do not profile you, we do not build advertising audiences, and we do not use your data to train AI models.

6. Who receives your data

6.1 Processors

The list of processors may change; the current list is maintained in our sub-processor register and is available on request at data-protection@digitalfreedom.co.za.

6.2 Legal requirements

We disclose data where we are required to by law, legal process or a lawful government request — and no further.

6.3 Business transfers

In a merger, acquisition or sale of assets your data may be transferred. You would be informed in advance, as stated in § 15.

6.4 No sale of personal data

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

7. International data transfers

• GitHub, Inc. (United States) — GitHub states certification under the EU-US Data Privacy Framework, the UK Extension and the Swiss-US Data Privacy Framework, and additionally relies on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914). GitHub's privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement.
• Google Ireland Ltd. / Google LLC (United States) — EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum and Google's participation in the EU-US Data Privacy Framework.
• Migadu (Switzerland) — covered by the adequacy decision for Switzerland under Art. 45 GDPR.
• Civo lon1 (London, United Kingdom) — covered by the European Commission's adequacy decision for the UK under Art. 45 GDPR; fra1 is located in the EU.

The controller itself is established outside the EEA. Processing carried out by us therefore takes place outside the EEA, and we apply the GDPR standard to it as the global baseline described in § 1.2. For transfers not covered by an adequacy decision we rely on Standard Contractual Clauses, apply Chapter V safeguards and assess the recipient country's law before engaging a processor.

8. Retention

Deletion is a real deletion, not a flag. What we retain because the law requires it is restricted to that purpose.

8a. Access to information on your device

Independently of data protection law, § 25(1) TDDDG and Art. 5(3) of Directive 2002/58/EC require your consent for storing information on your device or reading information already stored there — whether or not it is personal data.

No advertising identifier is read.

9. Data security

• HTTPS is enforced for every page of the website (TLS in transit)
• The website is static: there is no database, no login and no form on it
• Access to the GitHub organisation that hosts the website requires two-factor authentication
• Documented incident response under our internal breach response plan (Art. 33/34 GDPR)

No system is completely secure and we do not claim absolute security.

10. Your rights

10.1 The GDPR catalogue, as the global floor

Wherever you live, you can exercise at least: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), withdrawal of consent at any time and as easily as it was given (Art. 7(3)) — on this website via Cookie settings in the footer — and a complaint to a supervisory authority.

10.2 What your jurisdiction adds

Several jurisdictions grant rights beyond this floor, or attach different deadlines, appeal routes and named officers. § 17 is the single place where those are stated. Nothing in § 17 reduces the floor above.

10.3 How to exercise any of them

Write to data-protection@digitalfreedom.co.za or use the form at https://data-protection.digitalfreedom.co.za. We respond within one month (Art. 12(3) GDPR), or within the shorter period your jurisdiction prescribes.

11. Children's privacy

The website is directed at a general audience, not at children. The age at which a child can consent to data processing is set nationally between 13 and 16 (Art. 8(1) GDPR), so this Policy states no single number. We do not knowingly collect data from a child below the applicable age; if we learn that we have, we delete it promptly.

12. Cookies and tracking

Described separately in the cookie policy.

13. Automated decisions and marketing

We make no automated decisions producing legal effects concerning you or similarly significantly affecting you (Art. 22 GDPR). We send no marketing email; there is no newsletter and no mailing list.

14. Third-party links

The website links to third-party sites — the providers' own privacy policies, digitalfreedom.co.za, marcelrgberger.com. We are not responsible for their privacy practices.

15. Changes to this policy

We may update this Policy. Material changes are announced on the website and, where a change requires your consent under applicable law, we obtain that consent before the change applies to you — continued use alone is never treated as consent. The "Last updated" date at the top reflects the latest revision.

16. Contact

DigitalFreedom Global LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States

• Data protection: data-protection@digitalfreedom.co.za · https://data-protection.digitalfreedom.co.za
• General: hello@digitalfreedom.co.za
• Support: https://support.apps.digitalfreedom.co.za

If you are in the EU/EEA you may also contact the supervisory authority of your country.

17. Regional provisions

What each jurisdiction adds to the baseline. § 10.1 states the floor that applies everywhere; nothing below reduces it. All requests: data-protection@digitalfreedom.co.za or https://data-protection.digitalfreedom.co.za.

17.1 European Union and EEA

• Processing complies with the GDPR, which applies in Norway, Iceland and Liechtenstein through the EEA Agreement.
• No lead supervisory authority applies. The Controller is not established in the Union, so the one-stop-shop under Art. 56 GDPR does not apply.
• You may lodge a complaint with the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR) — in the EEA states, Datatilsynet (Norway), Persónuvernd (Iceland) or the Datenschutzstelle (Liechtenstein).
• On the age of digital consent, which Member States set between 13 and 16, see § 11.

17.2 United Kingdom

The UK GDPR and the Data Protection Act 2018 apply. The supervisory authority is the Information Commissioner's Office (ICO), https://ico.org.uk.

17.3 Switzerland

• The revised Federal Act on Data Protection (revFADP) applies to processing that has an effect in Switzerland, regardless of where the Controller sits. The GDPR baseline of this Policy covers its substance.
• Right to information (Art. 25 revFADP): substantially the access right of Art. 15 GDPR; we answer within 30 days.
• Breach notification (Art. 24 revFADP): owed to the FDPIC as soon as possible; our plan runs on the shorter of the applicable periods, so the 72-hour GDPR clock governs in practice.
• Competent authority: the Federal Data Protection and Information Commissioner (FDPIC).

17.4 United States

The state-law common core. The comprehensive state statutes (Virginia, Colorado, Connecticut, Texas, Oregon and the wider family) grant substantially the rights in § 10.1 and add two things:

• Appeal. If we deny your request you may appeal to us; our appeal response tells you how to complain to your State Attorney General. Exception: Utah, whose statute provides no appeal process.
• Deadlines. We respond within 45 days, extendable once by a further 45 with notice. Exception: Iowa, where the statute allows 90 days plus a 45-day extension — in practice we apply the shorter period.

Biometrics (Illinois BIPA). No biometric identifier is collected.

Consumer health data (Washington, Nevada). The website processes no health data, so the My Health My Data Act and the Nevada equivalent are not engaged.

"Do Not Sell or Share" link. Not required: nothing is sold, and nothing is shared for cross-context behavioural advertising. If that ever changes, the link becomes mandatory and will appear.

California — notice at collection (CCPA/CPRA)

Provided to California residents at or before the point of collection, as required by Cal. Civ. Code §§ 1798.100(a) and 1798.130(a)(5)(A). The full policy this notice belongs to is at https://pourenzo.app/privacy/.

We have not sold or shared the personal information of California residents and do not intend to. Retention is as stated in § 8. Your rights — know, delete, correct, portability, non-discrimination — are exercised at data-protection@digitalfreedom.co.za; we verify requests proportionate to risk and respond within 45 days, extendable once by 45 with notice. An authorised agent is accepted with proof of authorisation.

Shine the Light (§ 1798.83): we disclose no personal information to third parties for their direct-marketing purposes; the annual answer is "none disclosed". Global Privacy Control is honoured as a valid opt-out signal; on this website it also keeps Google Analytics unloaded unless you actively accept. Complaints: California Privacy Protection Agency, 2101 Arena Boulevard, Sacramento, CA 95834, https://cppa.ca.gov/webapplications/complaint, or the California Attorney General.

17.5 Canada

• Consent (PIPEDA Principle 3): express consent where information is sensitive or the purpose is not obvious; implied consent where it is obvious and not sensitive. Withdrawal at any time, subject to legal or contractual restrictions and reasonable notice.
• Your rights: access and a copy, accuracy challenge and correction, withdrawal of consent, and complaint to the Office of the Privacy Commissioner of Canada, https://www.priv.gc.ca. We respond within 30 days (PIPEDA § 8(4)).
• Quebec (Law 25): the person responsible for the protection of personal information is Marcel R. G. Berger, data-protection@digitalfreedom.co.za, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. A privacy impact assessment precedes any transfer of Quebec residents' information outside Quebec. You may request your data in a structured, commonly used technological format, and you are informed of any decision based exclusively on automated processing — we make none.
• CASL: we send no commercial electronic messages at all.
• Provincial laws (BC PIPA, Alberta PIPA) apply where more protective; complaints also to the OIPC BC and OIPC Alberta.

17.6 Australia and New Zealand

• Australia: the Privacy Act 1988 and the Australian Privacy Principles apply to an overseas entity carrying on business in Australia. APP 12 sets a 30-day response period for access. APP 8 makes us accountable for an overseas recipient's handling of your data — which is part of why every recipient is named in § 6. Complaints: Office of the Australian Information Commissioner (OAIC).
• New Zealand: the Privacy Act 2020 applies to an overseas agency carrying on business in New Zealand. IPP 12 restricts disclosure outside New Zealand; access requests are answered within 20 working days. Complaints: Office of the Privacy Commissioner (NZ).

17.7 Brazil (LGPD)

• Encarregado (Art. 41 LGPD): Marcel R. G. Berger, data-protection@digitalfreedom.co.za, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. This Policy is the publication of those contact details that ANPD Resolution CD/ANPD No. 18/2024 requires.
• Legal bases (Art. 7): legal obligation (II) for statutory requests; legitimate interest (IX) for hosting and security; consent (I) for website analytics.
• Your Art. 18 rights: confirmation, access, correction, anonymisation, blocking or deletion of unnecessary data, portability, deletion of consent-based data, information about sharing and about the consequences of refusing consent, and revocation of consent. We respond within 15 days (Art. 19 § 3).
• Transfers (Art. 33): adequacy for the UK and Switzerland, contractual safeguards for the US legs.
• Children (Art. 14): processing a child's data under 12 requires specific and prominent parental consent; we operate no such mechanism and therefore do not knowingly process such data.
• Incidents (Art. 48): the ANPD and affected data subjects are notified; our target is 72 hours. Complaints: https://www.gov.br/anpd.

17.8 India (DPDP Act, 2023)

• DigitalFreedom Global LLC is the Data Fiduciary and is not designated a Significant Data Fiduciary.
• Consent (§ 6): free, specific, informed, unconditional and unambiguous, by clear affirmative action, and withdrawable as easily as given.
• Your rights (§§ 11–14): access to what is processed and with whom it is shared; correction, completion and erasure; grievance redressal; and nomination of another person to exercise your rights in case of death or incapacity.
• Grievance Officer (§ 8(10), IT Rules 2021): Marcel R. G. Berger, data-protection@digitalfreedom.co.za. Acknowledgement within 24 hours; resolution within 15 days, extended to 30 for complex grievances with an explanation. Escalation: the Data Protection Board of India, once constituted.
• Children (§ 9): data of a person under 18 is processed only with verifiable parental consent; no tracking, behavioural monitoring or advertising is directed at children — none is directed at anyone.
• Transfers (§ 16): permitted except to destinations notified as restricted; none of the destinations used is currently restricted.

17.9 Japan (APPI)

• The APPI applies to a foreign operator that acquires personal information in connection with supplying services to persons in Japan.
• Purpose specification: the purpose of use is specified as narrowly as possible and published here. A change of purpose is limited to what remains relevantly connected to the original purpose; anything larger requires fresh consent.
• Provision to a third party in a foreign country: no visitor data is provided to a third party for its own purposes. The processors in § 6.1 act on our instructions; the countries concerned are the United States, Switzerland, Germany and the United Kingdom, and the safeguards are stated in § 7.
• Publicly available matters (Art. 32): the operator's name and address, the purposes of use, the procedure for disclosure requests and the complaint contact are in this Policy and the imprint. Representative: Marcel R. G. Berger.
• Breach reporting: for reportable categories, a preliminary report to the Personal Information Protection Commission within roughly 3–5 days and a final report within 30 days (60 where wrongful access caused the breach).
• No advertising email is sent, so the 特定電子メール法 regime is not engaged.

17.10 Korea (PIPA)

• PIPA applies to a foreign operator processing personal information while offering services to data subjects in Korea.
• Itemised, separated consent: where consent is the basis, it is obtained separately per item, and refusing an optional item never blocks the service.
• Cross-border transfer: the recipients, destination countries, items transferred and purposes are set out in §§ 6 and 7 of this Policy.
• Under 14: processing a child's data requires the legal representative's consent. The website is not directed at children; § 11 applies.
• Response period: access, correction, deletion and suspension requests are acted on within 10 days, or you are told the reason and the schedule. That is shorter than the GDPR month, and the shorter period governs.
• Breach: affected data subjects are notified without delay; above the statutory scale the Personal Information Protection Commission is notified within 72 hours.

17.11 Türkiye (KVKK)

• The KVKK (Law No. 6698) resembles the GDPR in concept but leans harder on explicit consent as the general basis; each activity is assessed against Turkish law separately.
• Transfers abroad rest on the safeguards in § 7 and, where required, on your explicit consent given after disclosure of the transfer.
• Response period: 30 days. You may complain to the Kişisel Verileri Koruma Kurumu after applying to us first — within 30 days of our response or 60 days of your application.

17.12 South Africa (POPIA)

POPIA § 3(1) applies to a responsible party domiciled in the Republic, or to processing by means located there. Neither is the case: the Controller is domiciled in Wyoming, and the website is hosted on GitHub Pages. A .co.za domain name is a name, not a processing means, so the Act does not apply on the present facts. POPIA-style enquiries are nonetheless answered through the same channels and on the same clock as everywhere else — a service commitment, not an admission that the Act applies. Two points where POPIA would differ from the GDPR floor, stated rather than papered over: it treats everyone under 18 as a child, and § 22(1) requires breach notification without the GDPR's high-risk threshold; our breach plan operates on the GDPR standard. The Information Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, https://inforegulator.org.za.

17.13 All other countries

Everywhere no section above applies: the GDPR baseline of this Policy is your floor (§ 1.2), any more protective mandatory local law prevails over it, and every request goes to data-protection@digitalfreedom.co.za or https://data-protection.digitalfreedom.co.za.

© 2025–2026 DigitalFreedom Global LLC. All rights reserved.