Riggr collects as little as it can: what it needs to run your page, bill your subscription and give you your stats. No advertising, no tracking cookies, no data sold. Here is exactly what is collected, why, and for how long.
1. Who is responsible
The data controller is the publisher of Riggr (see the legal notice). For any question or request about your data: our contact details.
2. If you have an account
- Account: your email, your password (stored only in hashed form), or your Google or Discord identity (email and name) if you sign in with them; your handle and display name.
- Your page: what you publish on it (bio, avatar, photos, products, links, social networks, appearance, fonts). It is public by design. Location data (GPS) is removed from your photos before they are uploaded.
- Subscription: your plan, its renewal date, and your Stripe customer and subscription references. Your card details are handled by Stripe only.
- Pro settings: the Amazon Associates tags you enter.
- Twitch: if you link your Twitch account, its identifier and username.
- Anti-abuse: the IP address used to sign up (and to try imports on the demo), kept 60 days to block mass account creation.
We only email you about your account (sign-in codes, password reset, billing). No newsletter, no marketing emails.
3. If you visit a creator’s page
To give the creator their audience stats, each page view and each click on a product records: a pseudonymous visitor identifier, computed with a secret key from the IP address and the browser family, that can’t be turned back into an IP address (the IP address itself isn’t stored), the country (worked out from the IP by a database on our own server, without any third party), the website you came from, the date and, for a click, the product. Bots aren’t counted. The creator only ever sees totals, never an individual visitor.
The same country lookup, done on the fly and never stored, picks the right Amazon store for a click, shows prices in euros or dollars and suggests the French site. The country database is IP Geolocation by DB-IP (CC BY 4.0).
A click on a product goes through riggr.co, then takes you to the store (usually Amazon), which applies its own privacy policy and cookies from then on.
Like any website, our server keeps technical logs (IP address, page requested, browser) for about two weeks, for security and to fix bugs.
4. Cookies
Riggr only uses the cookies it needs to work, which is why there is no consent banner:
- your session, to keep you signed in (account holders only);
- riggr-lang, which remembers the language you chose (1 year);
- a temporary cookie while you link your Twitch account.
A few settings are also kept in your browser’s own storage, never sent to us and never used for tracking: the editor preview width, your progress in the demo tour, the limits on demo tries and on password attempts, and a retry counter when the dashboard fails to load.
Some content is loaded straight from other services, which then see your IP address: fonts (Google Fonts), website icons next to links (Google), some product images (the stores’ servers), and on the home page the brand logos (Simple Icons) and the example page’s background photo (Unsplash).
5. Why (legal bases)
- Running your account, your page and your subscription: the contract between us.
- Invoices and accounting: our legal obligations.
- Audience stats for creators, security and anti-abuse: our legitimate interest, with the minimum of data described above.
6. Who else handles data
Only these providers, each for its own part of the service:
- IONOS SE (Germany): hosting of the site and the database, on servers in Germany.
- Stripe (Ireland, United States): payments and invoices.
- Brevo (France): sending account emails.
- Google (Ireland, United States): sign-in with Google if you choose it, fonts and website icons.
- Discord (United States): sign-in with Discord if you choose it.
- Twitch (United States): if you link your account.
- Zyte (Ireland): reads the public product pages you import. Only the product’s address is sent to it.
When data leaves the European Union (United States), the transfer is covered by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. None of your data is sold or used for advertising.
7. How long
- Account, page and stats: until you delete your account. Deletion is immediate; our backups roll over within 8 days.
- Sign-ups never confirmed: deleted 1 hour after the last code was sent (24 hours at most).
- Anti-abuse IP addresses: 60 days. Server logs and the sign-in security log (email address, IP address, date): about two weeks.
- Invoices and payment records: 10 years (accounting obligation), with Stripe.
8. Your rights
You can access your data, correct it, delete it, get a copy of it, restrict or object to its use. Most of it happens in your dashboard: everything is editable there, and Settings lets you delete your account. For anything else, write to us and we answer within one month: our contact details.
If you think your rights aren’t respected, you can lodge a complaint with the CNIL (cnil.fr) or with the data protection authority of your country.
9. Security and minors
Every connection is encrypted (HTTPS), passwords are never stored in readable form, and access to the servers is restricted. Riggr isn’t meant for children under 15.
If this policy changes in a significant way, account holders will be told by email.