Privacy Policy

Last updated: 5 October 2026

1. Who we are

peedee.es (also referred to as "Peedee") is operated by Bernhard van Staveren, EI, a French sole proprietorship trading as Bearded Dutchman Services (SIREN 922 817 093, registered at 49c rue Saint-Georges, 71100 Chalon-sur-Saone, France) - "we," "us," or "our" in this Policy. We are the data controller for the personal data described in this Policy.

This Privacy Policy explains how we collect, use, disclose, store, and otherwise process personal data when you use our website, dashboard, and PDS hosting services (together, the "Services"). For questions or privacy requests, contact legal@peedee.es.

2. Scope - this Policy applies the same way to every customer

We're established in France, in the European Union. Under the GDPR (Article 3(1)), that means this Policy and the full set of protections it describes apply to all of our processing of your personal data, regardless of where you're located - not just to customers who happen to live in the EU. If you're a customer outside the EU, you get the same rights and the same treatment described here as anyone else; there isn't a separate, lesser regime for non-EU customers.

That said, depending on where you live, you may also have rights under your own country's privacy law in addition to what's described here - this Policy doesn't limit those.

3. Information we collect

When you sign in through the AT Protocol, we receive what's needed to identify and authenticate you: your decentralized identifier ("DID"), handle, and PDS information. We also collect contact information you give us directly, such as your email address, and - where you choose to provide them - your first and last name and a billing address.

When you use our hosting, we process information tied to your hosting account: your plan, PDS configuration, and billing status. We also collect technical and operational information needed to run and secure the service: IP addresses, timestamps, authentication events, service logs, abuse-prevention signals, and diagnostic information.

If you submit a notice about illegal content (see our Terms of Service), we process the contents of that notice, including your name and email address where you provide them.

If you email us (for example at info@peedee.es or legal@peedee.es), we process your message, the name and email address it was sent from, and the delivery and spam-check information your mail carries, to answer you and keep track of the conversation. We don't open attachments unless we need to in order to answer you.

When you cancel a subscription, we ask why. Choosing a reason and adding a comment are both optional, and cancelling works the same whether you answer or not. We keep what you give us with that subscription's record and use it only to understand why customers leave and to improve the Services, based on our legitimate interest (Article 6(1)(f)) in doing so.

Providing your email address and AT Protocol identity is necessary to create an account and use the Services - without them, we can't authenticate you or provide hosting. Your first and last name are optional; not providing them doesn't prevent you from using the Services.

4. How we use information, and our legal basis for doing so

We use information as reasonably necessary to authenticate you and maintain your account; provision and operate your PDS; process payments and maintain billing records; provide customer support; send transactional and service-related communications; enforce plan and resource limits; prevent fraud, spam, abuse, and security incidents; handle notices about illegal content and comply with the Digital Services Act; troubleshoot technical problems; comply with legal obligations; and protect peedee.es, our users, our infrastructure, our providers, and third parties. We don't sell personal data, and we don't use it for advertising.

Under the GDPR, most of this processing relies on performance of our contract with you (Article 6(1)(b)) - it's what's needed to actually provide the Services you've signed up for. Where that doesn't quite cover it - security logging and abuse prevention, for instance - we rely on our legitimate interest (Article 6(1)(f)) in keeping the service secure and usable for everyone. Where we're required to keep records for a set period (accounting obligations, or records of illegal-content notices, for example), that's based on legal obligation (Article 6(1)(c)).

We don't use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

5. AT Protocol and public repository data

AT Protocol repository records are public by design. Anything placed in your repository - including your DID, handle, and any content you publish - may be publicly accessible, and may be collected, indexed, cached, archived, copied, or redistributed by third parties, regardless of what we do on our end. You shouldn't treat information in these records as private.

If you attach a domain registered with Marque to a PDS we host, we read and update the DNS record Marque associates with that domain, as described in our Terms of Service - and only after you've explicitly confirmed that action. This is currently the only case where we write records to your PDS on your behalf.

We don't provide domain registration ourselves.

6. Your PDS, and data belonging to people you host

When you host a PDS with us, we operate that PDS - we're not merely pointing you at infrastructure run by someone else. We process the account and repository data your PDS holds in order to run, secure, and maintain it.

If the only account on your PDS is your own, that's the personal data this Policy already describes, and nothing further applies. If you use your PDS to host accounts belonging to other people - family, community members, or anyone else - you become the data controller for their personal data, and we act as your data processor for it. That relationship, and our obligations to you regarding their data, are set out in our Data Processing Agreement, which applies automatically alongside our Terms regardless of whether you end up hosting anyone besides yourself. If you do host other people, you're responsible for giving them their own privacy notice and having a legal basis for processing their data - this Policy and our role as processor doesn't do that on your behalf.

Scanning of uploaded media. Separately from our role as your processor, we check every image and video uploaded to a PDS we host against lists of known child sexual abuse material. For this processing we are the controller: we do it for our own purposes - keeping such material off our infrastructure and meeting our obligations as a hosting provider under the Digital Services Act - based on our legitimate interest (Article 6(1)(f) GDPR) and the overriding public interest in protecting children. It applies to every PDS we host and can't be switched off. In practice:

7. Payments

Payments are processed through Stripe. Stripe receives payment and transaction information directly from you. We retain transaction references, amounts, currencies, payment status, and billing history needed to operate your account. We don't receive or store your full card number or card verification code.

8. Service providers and subprocessors

We use a small number of third parties to operate the Services:

We don't use any analytics or tracking tools. Where a provider processes personal data on our behalf, we limit that processing to what's reasonably necessary for the service it provides, under a written agreement. We may change providers as our infrastructure evolves; the current list is always the one published here.

9. International data transfers

Our compute infrastructure is located in the Netherlands, within the European Economic Area, as is the Hetzner-hosted mail relay. Our mailboxes are hosted by Fastmail with EU data residency, so email you send us is stored within the European Union. Media storage with Cloudflare is configured to keep data at rest within the European Union; Cloudflare, as a US company, is nonetheless subject to US law, and transfers to it are covered by the European Commission's Standard Contractual Clauses and Cloudflare's certification under the EU-US Data Privacy Framework.

Media checked through Arachnid Shield is sent to Canada, which the European Commission recognises as providing an adequate level of protection for personal data.

Stripe, as an independent controller for payment processing, may process data outside the EEA under its own compliance mechanisms (such as Standard Contractual Clauses); we don't control that processing directly, but Stripe's own privacy practices apply to it.

10. Cookies and browser storage

We use a session cookie to keep you signed in to your dashboard. Your browser may also store interface preferences and in-progress order state using localStorage or sessionStorage. These are strictly necessary for the service to work and don't require consent under Article 82 of the French Data Protection Act. We don't use advertising cookies, tracking pixels, or any analytics tooling.

11. Data retention and deletion

We keep information for as long as reasonably necessary to provide the Services and for legitimate accounting, tax, fraud-prevention, and dispute-resolution purposes. In particular:

We don't take scheduled backups of hosting data - the underlying storage is redundant for availability, not retained as a backup, and we make no other copies - so once data is deleted, it's not recoverable through us. Deletion also doesn't remove copies of AT Protocol records that third parties have already collected, indexed, cached, archived, or redistributed independently of us.

You may request deletion of personal data we aren't legally or operationally required to retain by contacting legal@peedee.es.

12. Security

We use technical and organizational measures designed to protect non-public service data, including access controls, encrypted network connections, and logging. These measures don't make intentionally public AT Protocol repository records private. No method of storage or transmission is completely secure, and we can't guarantee absolute security. You're responsible for protecting your own AT Protocol credentials, dashboard login, recovery codes, and any API keys or other credentials associated with your account.

If a personal data breach occurs that is likely to result in a high risk to you, we will notify you without undue delay, in addition to notifying the CNIL as required by Article 33 of the GDPR.

13. Your privacy rights

Under the GDPR, you have the right to request access to, correction of, or erasure of your personal data; to request restriction of or object to certain processing; and to request portability of data you've provided to us. You can exercise these rights by contacting legal@peedee.es. We may need to verify your identity before completing a request, and some information may be exempt from a request where we're required or permitted to retain it by law. We respond within one month, extendable by two further months for complex requests, as the GDPR allows.

You also have the right to lodge a complaint with the French data protection authority, the CNIL (Commission Nationale de l'Informatique et des Libertes), at www.cnil.fr, or with the supervisory authority in your own EU member state if you live outside France.

AT Protocol records are different from data held solely in our own systems: because they're public by design and may be independently replicated or indexed by third parties, we can't guarantee that exercising a deletion or correction right removes copies held outside our control.

14. Children

Our Services aren't intended for anyone under 18, and we don't knowingly offer accounts to children. If you believe a child has provided personal data to us, contact legal@peedee.es.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, infrastructure, providers, or legal obligations. The current version is always posted at peedee.es/privacy, with its "last updated" date kept current. Where a change materially affects how we collect, use, or disclose personal data, we'll provide additional notice when required by law or otherwise appropriate.

16. Contact

Questions or privacy requests can be sent to legal@peedee.es. Our postal address is given in Section 1 and on the Legal Mentions page.