Legal
Privacy Policy
Effective date: May 3, 2026
Governing law: Spain / European Union
Controller: RaidReady · hello@raidready.app
RaidReady is in pre-registration. The full member platform opens June 1, 2026 — this policy describes only the data we process today (email signup + the free Channel X-Ray diagnostic) and will be updated at full launch to cover member-area data flows.
Section 1
What data we collect
Email address. When you join the waitlist, we store the email address you provide along with a marketing-consent flag, the form location on the page, and a timestamp. The email is the only identifier we hold for you at this stage.
Twitch handle and public channel data. When you use the free Channel X-Ray diagnostic, you give us a Twitch handle. We read publicly available channel metadata from Twitch (display name, bio, tags, clip count, schedule existence, avatar, broadcaster type) and compute a score. We do not access private Twitch data and do not require you to log in to Twitch. No Twitch OAuth flow runs during pre-registration.
Anonymous session cookie. We set a first-party signed cookie (rr_session) when you first visit the site. It carries a random session ID, the page you landed on, the referrer, and any UTM parameters from the URL. We use it to attribute waitlist signups to the campaign that brought you in.
Analytics events. If you accept analytics cookies in the consent banner, PostHog records page views and product events (e.g. form submissions). Events are linked to a randomly-generated UUID, not your email. PostHog runs on the EU instance.
Server logs. Our servers record standard HTTP access logs (IP address, request path, timestamp, response code). Used for security and operational diagnostics, retained for 30 days.
Section 2
Why we collect it and our lawful basis
Consent (Art. 6(1)(a) GDPR). Adding you to the marketing list and sending product updates relies on the consent you give when you submit a waitlist form. You can withdraw it at any time using the unsubscribe link in any email or by writing to hello@raidready.app. Analytics cookies are also consent-based and only set after you accept them in the cookie banner.
Legitimate interests (Art. 6(1)(f) GDPR). The transactional welcome email containing the lead-magnet PDF is sent on the basis of legitimate interest — you explicitly asked for the prompts. The attribution cookie and server logs are also processed on this basis to protect the platform and measure marketing effectiveness. We have assessed that our interest does not outweigh your rights.
The Channel X-Ray diagnostic processes only data Twitch has made public on its own platform; the lawful basis is your explicit request to score the channel.
Section 3
Third-party processors
We share data with the following processors only to the extent necessary. All are bound by data processing agreements.
| Processor | Data shared | Location | Transfer |
|---|---|---|---|
| Supabase | Lead and session records | EU (Ireland) | EU — no transfer |
| Brevo | Email address, consent flag, attributes | EU (France) | EU — no transfer |
| Twitch (read-only public API) | Channel handle (your input) | United States | Standard Contractual Clauses |
| PostHog | Random UUID, page events | EU (eu.i.posthog.com) | EU — no transfer |
| Cloudflare | IP address, request headers | Global (EU edge) | Standard Contractual Clauses |
We do not sell your data. We do not share it with advertisers, data brokers, or any party not listed above.
Section 4
Cookies
Essential. The rr_session cookie carries an anonymous session identifier and your first-touch attribution. Strictly necessary for waitlist attribution and rate limiting. Cannot be declined. The Silktide consent banner also stores your cookie preferences in localStorage — also essential.
Analytics. PostHog uses cookies and localStorage to track page views and product events. Set only after you accept analytics in the consent banner. You can withdraw consent at any time via the Cookie settings link in the footer.
Section 5
How long we keep your data
| Data type | Retention |
|---|---|
| Email and waitlist record | Until you unsubscribe or request deletion |
| Marketing-consent flag and timestamp | While the consent is valid (kept as proof of consent) |
| Anonymous session cookie | 90 days from first visit (rolling) |
| Channel X-Ray result | Not persisted server-side beyond the response |
| Analytics events (PostHog) | 12 months |
| Server logs | 30 days |
Section 6
Your rights under GDPR
As a data subject under EU/Spanish law, you have the rights below. To exercise any of them, write to hello@raidready.app. We will respond within 30 days.
- Right of access. Request a copy of the personal data we hold about you.
- Right to rectification. Ask us to correct inaccurate or incomplete data.
- Right to erasure. Ask us to delete your data.
- Right to data portability. Request your data in a structured, machine-readable format.
- Right to restriction. Ask us to restrict processing while a dispute is resolved.
- Right to object. Object to processing based on legitimate interests or for direct marketing.
If you are not satisfied with our response, you may lodge a complaint with the Spanish data protection authority, the AEPD: www.aepd.es.
Section 7
Children
RaidReady is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 13. If you believe we have collected such data, contact us at hello@raidready.app and we will delete it promptly.
Section 8
Contact and changes to this policy
For any privacy-related question, request, or complaint, write to hello@raidready.app.
This policy was last updated on May 3, 2026. We will notify waitlist subscribers of material changes by email at least 14 days before they take effect.