This policy explains what personal data we process on LidoRank, why, for how long and what rights you have. We process data in line with Regulation (EU) 2016/679 (GDPR).
1. Data controllers
The LidoRank project is run by Giorgio Menicagli Pirina and Francesco Mancuso, natural persons, who are joint controllers under Art. 26 GDPR.
The joint controllers have an internal arrangement allocating their respective responsibilities (in particular regarding your rights and the information owed to you): you can request the essence of it by writing to the address below. Regardless of that arrangement, you may exercise your rights against either controller.
For any data-related request and for a point of contact: info@lidorank.com.
2. What data we collect
Account data (if you register): email address and sign-in credentials handled by our authentication provider.
Reviews: your scores across the ten criteria, any comment, the factual information you report and the visit period you declare.
Reports of a club's violations, and reports of reviews as unlawful content (DSA Art. 16): reason, description and any contact email you choose to provide, plus the good-faith declaration.
Technical data: to limit abuse we store a salted hash of your IP address, not the IP itself, plus essential technical logs.
3. Why we process it and on what legal basis
To provide the service and publish reviews: performance of the service you request and our legitimate interest in offering transparent information.
To prevent fraud and manipulation (rate limits, anti-surge): our legitimate interest in data quality and integrity.
To manage accounts and communications: performance of the relationship and, where applicable, your consent.
4. IP hashing and anti-fraud measures
We do not store your IP address in clear. We compute a salted hash used only to enforce anti-abuse limits (e.g. to recognise repeated behaviour from the same device).
This hash is pseudonymised data, not anonymous: it greatly reduces risk but remains personal data subject to the GDPR, because it can be used to link repeated actions. We treat it accordingly.
5. Who we share data with
We use providers that process data on our behalf (processors): hosting and database (Supabase), application hosting (Vercel) and anti-bot protection (Cloudflare Turnstile).
Some of these providers may process data outside the EU/EEA (e.g. in the United States). Where that happens, transfers rely on the Standard Contractual Clauses (SCCs) adopted by the European Commission and/or the provider's certification under the EU-US Data Privacy Framework; you can ask us for details at info@lidorank.com.
Reports of violations stay private and may be forwarded to the competent authorities only where appropriate, in line with this policy. We do not sell your data to third parties.
6. How long we keep it
Account data: while the account is active; after an erasure request it is removed within 30 days, unless the law requires otherwise.
Reviews: they stay public until you ask for removal or close your account; rejected or quarantined reviews are kept for traceability for no more than 24 months.
Reports (of violations and of content): kept for as long as needed to handle them and in any case no more than 24 months.
IP hash: kept for at most 12 months for anti-abuse purposes only, then deleted or further anonymised.
7. Your rights
You can request access, rectification, erasure, restriction, objection and portability of your data by writing to info@lidorank.com.
You also have the right to lodge a complaint with the competent data-protection authority.
8. Cookies
We use only cookies and technologies strictly necessary for the site to work and for security. We do not use profiling cookies for advertising. If this changes, we will update this policy and, where required, ask for consent.
9. Changes
We may update this policy. The version in force is the one published on this page, with the update date shown at the top.