Privacy policy
What we collect, why we collect it and what you can do about it. We keep it short because we collect little.
Operator: Boudjelal Maria, trading as Adoptice, an auto-entrepreneur (sole trader) based in Algeria. Postal address: Lot 127, Oued Tarfa, Draria, Algiers, Algeria. Email: contact@adoptice.com. Version 1.0. Last updated 10 October 2026.
1. Who is responsible
The controller of your personal data is Boudjelal Maria, trading as Adoptice, an auto-entrepreneur (sole trader) based in Algeria. Contact: contact@adoptice.com. Postal address: Lot 127, Oued Tarfa, Draria, Algiers, Algeria. We have not appointed a data protection officer, and we have not appointed a representative in the EU or the UK. Please send any privacy question to the email above.
2. What we collect, why, and for how long
We collect data from you when you follow a piece, sign in, buy, write to us or use the site. Lemon Squeezy sends us the order data listed below. We do not buy data about you from anyone.
| Data | Why | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Account: email, first name (optional), your Google name and email if you sign in with Google, and your active sign-in sessions with the browser type (no IP address) | Create and run your account, sign you in, show your first name where you allow it | Contract | Until you delete your account |
| Adoption details: the name printed on the certificate, the symbolic name, your choice to show or hide your first name, pledges you choose, and a leaderboard handle if you opt in | Make your certificate and page, show the public parts you allow | Contract | Until you delete your account. Certificates then stay verifiable with "a former member" in place of your name |
| Follows, points and referral codes | Run the free Follow tier, points and rewards | Contract | Until you delete your account |
| Orders: items, prices, tax, billing country, card brand (never the card number), the Lemon Squeezy order ID, the receipt link, your email and the Terms version you accepted | Deliver what you bought, handle refunds and disputes, keep accounting records | Contract; legal obligation | 7 years from the order. If you delete your account, your email is replaced by a one-way hash |
| Service emails we send you (recipient, type of email, delivery status) | Send sign-in links, receipts, alerts you chose, and prove delivery | Contract; legitimate interests | 24 months, then the recipient is replaced by a hash |
| Monthly digest | Send the digest you asked for | Consent | Until you unsubscribe |
| Messages you send us: name, email, topic, message, and a keyed hash of your IP address | Answer you and stop spam | Legitimate interests; contract if it is about an order | 24 months |
| Consent records: the exact text you saw, its version, the time, the page and a keyed hash of your IP address | Prove what you agreed to | Legal obligation; legitimate interests | 3 years after you withdraw consent |
| Site usage: pages and actions, the site that sent you, campaign tags, country, device type and a daily visitor code. When you are signed in, your account ID is added, unless your browser sends a Global Privacy Control or Do Not Track signal | Understand which pages help, fix problems, count visitors | Legitimate interests | 13 months. After that we keep only daily totals with no personal data |
| Security data: short-lived counters per connection, sign-in links, and Cloudflare's bot check on forms | Protect accounts and the site from abuse | Legitimate interests | Counters 2 days. Sign-in links work for 15 minutes and are deleted 1 day after they expire |
| Error reports: technical details of an error and, if you were signed in, your account ID | Find and fix bugs | Legitimate interests | Up to 90 days |
| Optional experiment cookie | Compare two versions of a page | Consent | Up to 90 days |
"Legitimate interests" means we have a fair reason to use the data that you would expect, such as keeping the site secure, answering messages and improving our pages. We always weigh this against your rights, and you can object (section 7).
About the daily visitor code: it is made from your IP address and browser type, mixed with a random secret that changes every day and is deleted after 48 hours. We do not store your IP address. After 48 hours, nobody can link your visits from one day to another. Cloudflare Web Analytics, which we also use, sets no cookies.
What you must give us
You need to give an email address to follow, sign in or buy. You need to give a name for a certificate. Everything else is optional. Without an email we cannot create your account or send what you bought.
We do not sell your personal data and we do not share it for advertising. We make no automated decisions about you that have legal or similarly important effects. We do not ask for sensitive data, such as health or religion.
3. What others can see
Your certificate shows the name you chose for it. Public pages show the first name of adopters who have not hidden it. The verification page shows only the first name. The leaderboard shows only a handle you choose, and only if you opt in. If you opt in, your handle also has a public profile page with your rank, points, how you earned them, your achievements, the number of pieces you adopt and follow, and the adoptions you made public. It shows the month and year you joined, never your name or email. Leaving the leaderboard removes the page at once. You can hide your first name at any time.
4. Who receives your data
We use a few service providers. Processors may use your data only on our instructions, under a data processing agreement. Independent controllers decide for themselves how they use the data, under their own privacy policies.
| Provider | Role | Where | Safeguard for transfers |
|---|---|---|---|
| Neon (Databricks) | Database hosting. Processor | United States (US East) | EU Standard Contractual Clauses in its data processing agreement |
| Fly.io | Hosting of the website and background jobs. Processor | United States (Ashburn, Virginia) | EU-US Data Privacy Framework and its data processing agreement |
| Cloudflare | Network, DNS, bot check (Turnstile), file storage (R2), email forwarding and cookieless Web Analytics. Processor | Global network; files stored in North America | EU-US Data Privacy Framework, with Standard Contractual Clauses as a fallback |
| Brevo | Sending emails. Processor | European Union (France, Germany, Belgium) | Not needed: data stays in the EU |
| Sentry | Error monitoring. Processor | United States | EU-US Data Privacy Framework, with Standard Contractual Clauses as a fallback |
| Sign in with Google, only if you choose it. Independent controller of your Google account | Global | Google's own safeguards; see Google's privacy policy | |
| Lemon Squeezy | Merchant of Record: takes payment, charges tax, issues receipts. Independent controller of the payment data it collects | United States | Standard Contractual Clauses, as stated in its privacy policy |
We may also share data if the law requires it, or to protect our rights in a dispute. If Adoptice is ever sold, the buyer would receive the data needed to keep running it, and we would tell you first.
5. Where your data goes
Our main database is in the United States. The operator works from Algeria and accesses the data from there. If you live in the European Economic Area, the United Kingdom or Switzerland, your data therefore leaves your region. Where there is no adequacy decision, we rely on the safeguards in the table above. Algeria does not have an EU adequacy decision, so access from Algeria is protected by the security measures in section 10. You can ask us for a copy of the safeguards at contact@adoptice.com.
6. Deleting your account
You can ask to delete your account from the Privacy page of your account, or by email. We confirm by email before we delete anything. We then remove or anonymise your personal data, except order records, which we must keep for 7 years in a form that no longer shows your email, and consent records, which we keep as proof for 3 years. Certificates stay verifiable, but your name is replaced by "a former member".
7. Your rights
Depending on where you live, for example under the GDPR, the UK GDPR, Algerian Law 18-07 or the California Consumer Privacy Act, you can ask us to:
- give you access to your data, and a copy in a portable format;
- correct data that is wrong;
- delete your data;
- limit how we use it for a while;
- stop using it where we rely on legitimate interests. You can always object to direct marketing, and we will stop;
- withdraw your consent at any time. This does not affect what we did before.
You can download a copy of your data and ask for deletion from the Privacy page of your account. For anything else, write to contact@adoptice.com. It is free. We may ask you to confirm your identity, usually by replying from your account email. We answer within one month. If a request is complex, we may need up to two more months, and we will tell you why.
Complaints
If you are unhappy with how we use your data, please tell us first. You also have the right to complain to a data protection authority:
- in the EU and EEA, the authority of the country where you live or work, or where the problem happened. The list is on the European Data Protection Board website;
- in the UK, the Information Commissioner's Office, ico.org.uk;
- in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC);
- in Algeria, the national authority for the protection of personal data (ANPDP).
California and other US states
We collect identifiers (such as email and name), commercial information (your orders) and internet activity (site usage), for the purposes in section 2. We do not sell or share personal information as those words are defined in the CCPA, and we do not use sensitive personal information. You will not be treated worse for using your rights. We treat a Global Privacy Control signal as a request to opt out: your account ID is then left out of usage data.
Email rules
We send marketing email, such as the monthly digest, only with your consent. Every such email has a working unsubscribe link and our contact details. Messages about your account and orders are not marketing.
8. Algeria
We handle personal data in line with Algerian Law 18-07 on the protection of natural persons in the processing of personal data, as amended, to the extent it applies to us.
9. Children
Adoptice is for people aged 16 and over. We do not knowingly collect data from younger people. If you think a child has given us data, write to us and we will delete it.
10. Security
We use encrypted connections, and our providers encrypt stored data. Sign-in links and sessions are stored only as hashes. IP addresses are stored only as keyed hashes. Our provider accounts use two-step verification, and only the operator has access. No system is perfectly safe. If a breach is likely to put you at risk, we will tell you and the authorities as the law requires.
11. Cookies
We use only the cookies the site needs, plus one optional cookie for experiments. Details are in the Cookie policy.
12. Changes
We publish changes here with a new version number and date. If a change matters for you, we tell account holders by email before it applies.
Questions about this page? Write to contact@adoptice.com. Related pages: Terms, Privacy policy, Refund policy, Cookie policy, Disclaimer and Accessibility statement.
