1. Who we are
PublicAlgo (“we”, “us”) is operated by DICE Network z.s., a registered association (spolek) under Czech law. Our registered address is Plzeňská 3352/156, Smíchov, 150 00 Praha 5, Czech Republic. The organisation ID (IČO) is 29704502. The organisation is entered in the Register of Associations kept by the Municipal Court in Prague (Městský soud v Praze), Section L, Insert 82262.
DICE Network z.s. is the controller of the personal data described in this policy.
For privacy requests, contact: [email protected]
2. What this policy covers
This policy explains how we process personal data when you use PublicAlgo during beta.
We process distinct kinds of data:
- Site-visitor data — cookieless analytics, technical logs, hosting;
- Communications — if you email us;
- Public registry / inventory data we republish about government algorithm systems.
3. Site visitors — analytics (Cloudflare Web Analytics)
What we collect
We use Cloudflare Web Analytics to count visits in aggregate. When a page loads, a small script reports the page address, the referring page, browser and device type, page-load performance, and the country derived from your IP address.
It sets no cookies, uses no local storage, and does not fingerprint your device or track you across sites or visits. We cannot identify individual visitors from these statistics, and your IP address is not stored for analytics. Because nothing is stored on your device, no cookie banner or consent is needed for it.
We do not currently offer user accounts or signup forms.
Why
To understand, in aggregate, how PublicAlgo is used and where our readers are, and to improve the product.
Legal basis
Legitimate interests (GDPR Art. 6(1)(f)) in measuring the reach of a public-interest service using a privacy-preserving, cookieless tool. You can object at any time (see §7); blocking scripts from static.cloudflareinsights.com in your browser also stops it.
Processor and international transfers
Cloudflare, Inc. (United States) processes this data on our behalf under a data processing agreement. Transfers to the US rely on the EU–US Data Privacy Framework, with Standard Contractual Clauses as a fallback. See Cloudflare’s privacy policy.
Retention
Aggregated statistics only, kept per Cloudflare’s Web Analytics retention ([CONFIRM RETENTION WINDOW]).
4. Cookies and similar technologies
We use no analytics, advertising, or social-media cookies. We only use the strictly necessary cookies below, which are exempt from consent under the ePrivacy rules — so we do not show a cookie banner.
| Name / type | Purpose | Duration | Category |
|---|---|---|---|
publicalgo-session (cookie) | Keeps your session working and secure between page loads | 2 hours | Strictly necessary |
XSRF-TOKEN (cookie) | Protects against cross-site request forgery | 2 hours | Strictly necessary |
Fonts are served from our own servers, so loading a page does not contact a third-party font service. We do not store anything else in your browser (no local storage). You can delete or block cookies in your browser settings; the site may then not keep your session between page loads.
5. Technical logs, hosting, and email
Server / application logs
Our hosting and application stack processes IP addresses, user-agent, timestamps, and request URLs for security, debugging, and reliability. Legal basis: legitimate interests (GDPR Art. 6(1)(f)) in operating a secure service. Retention: [CONFIRM — Laravel Cloud log retention for our plan].
Inbound email
If you email [email protected], we process your email address and message content to respond. Legal basis: legitimate interests (GDPR Art. 6(1)(f)) in answering you. Retention: as long as needed to handle the request, then deleted or archived within 24 months.
Processors we use
We do not sell personal data or share it for advertising. We use these service providers, each bound by a data processing agreement:
| Provider | Purpose | Data location | Transfer safeguard |
|---|---|---|---|
| Laravel Holdings Inc. (Laravel Cloud), running on Amazon Web Services | Application hosting, database, logs | EU — Frankfurt, Germany [CONFIRM REGION] | SCCs / EU–US Data Privacy Framework [CONFIRM] |
| Cloudflare, Inc. | DNS, network delivery and security, cookieless web analytics | Global network, US company | EU–US Data Privacy Framework, SCCs |
| Google (Google Workspace) | EU / US [CONFIRM] | EU–US Data Privacy Framework, SCCs |
A copy of the relevant safeguards is available on request at [email protected]
6. Public registry and inventory data
What we process
PublicAlgo aggregates information from official government algorithm registers and independent inventories. Those sources may contain personal data (e.g. names of public officials or other identifiers published by an authority). We did not collect this data from you directly.
Why
To operate a public-interest transparency catalogue of government algorithm systems in Europe.
Legal basis
Draft against legitimate interests (GDPR Art. 6(1)(f)) in publishing and organising information already public in official or independent inventories, balanced against affected individuals’ rights. If special-category or criminal-adjacent data appears: escalate to counsel before relying on this framing (Art. 9 / 10).
Art. 14 notice
Because this data is not obtained from the data subject, this public Privacy Policy is our primary notice. We also attribute sources and link back where possible, keep original source records alongside mapped fields where supported, and mark absence rather than hide empty accountability fields.
Accuracy and updates
We re-ingest sources on a periodic schedule about every four weeks. When a source updates or removes an entry, we aim to sync or remove our copy. Abandoned registers may be excluded.
AI-assisted processing and translation
To normalise vendor names and categories across registers, we send register field values to Google’s Gemini API; every AI proposal is reviewed by a person before it is published. Some register text is machine-translated and is labelled as a translation next to the original-language text. We do not use this data for automated decisions about individuals.
Your rights for registry data
Email [email protected] for access, rectification, restriction, objection, or erasure where applicable.
Every erasure or objection request receives a human assessment. We do not ignore requests merely because the data is public. Possible outcomes: erase/stop displaying our copy; correct/sync when the source changed; or refuse with reasons if we still lawfully publish. No self-serve dataset delete button.
7. Your rights (summary)
Under the GDPR you have the right to access, rectify, erase, or restrict processing of your personal data, to data portability, and to object at any time to processing based on legitimate interests (Art. 21) — including analytics (§3) and registry publication (§6). We do not carry out automated decision-making or profiling about you.
Exercise your rights at [email protected]. We reply within one month (extendable by two months for complex requests, with notice). You can also complain to the data protection authority in your EU/EEA country of residence or work, or where an alleged infringement took place; our lead authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.gov.cz.
8. Beta and changes
PublicAlgo is in beta. Features and this policy may change. Material updates bump the “Last updated” date.
9. Contact
Privacy: [email protected]
Operator: DICE Network z.s., Plzeňská 3352/156, Smíchov, 150 00 Praha 5, Czech Republic (IČO 29704502)
See also our Terms of Use.