This statement is about the people who read vcrs.steddle.com. Nobody signs in to the site, and it asks for nothing about you.
The controller is Steddle Group B.V. in oprichting (in formation), Keizersgracht 520H, 1017 EK Amsterdam, reachable at hello@steddle.com. Requests about your data: privacy@steddle.com.
When you visit the site
| Cookie | What for | How long |
|---|---|---|
__cf_bm | Cloudflare, which stands in front of the site, tells bots from visitors with it | 30 minutes |
This cookie is needed to run the site, and the law asks no consent for that (article 11.7a(3) of the Dutch Telecommunicatiewet). VCRS sets no advertising or tracking cookies.
VCRS counts visits with Visitors. On the pages where VCRS loads it, a script from cdn.visitors.now sends Visitors, from your browser, the page's address and the referring page, how long the page stays open, how fast it loaded with your connection's type and your device's memory, and the address of a link you follow off the site; as every browser does, it sends your IP address and your browser with each. The script itself comes from Cloudflare's network, which sees your IP address and browser when it hands it over, as it does for the whole site. Visitors keeps no cookie: its script sets a test cookie to learn the site's domain and deletes it at once. Before counting, the script reads one switch in your browser's storage, which turns the counting off, and writes nothing else there. Visitors does not follow you across sites. It reads your city and country off your IP address and then discards the address, unless that address sends so many requests in a short time that Visitors blocks it: then it keeps the address until the block expires. It recognises you within one day by a hash of IP address, browser and a key that changes daily, so tomorrow you are another visitor. It stores a record of each visit at Hetzner in Germany and keeps it for as long as Steddle's account with it exists, the performance measurements for a year; a record links to your other visits of the same day only. It sends no event when your browser has Global Privacy Control or Do Not Track on. Visitors states this in its data policy, and its script shows it. The law asks no consent for a measurement like this, which has no or only a slight effect on your privacy (article 11.7a(3)(b) of the Dutch Telecommunicatiewet).
Every request reaches the site through Cloudflare and Laravel Cloud, which log it with your IP address and your browser. The table under Who processes for VCRS says for how long. Beyond those logs and the record Visitors keeps of each visit, VCRS keeps nothing about a visit.
The self-assessment form
The self-assessment form keeps your answers in your browser's local storage, under vcrs.self-assessment. and the version of the text the form shows, so they are still there when you come back. They are never sent to the site. Clearing the answers on the form, or the site's data in your browser, deletes them.
When you write to Steddle
The site offers one address, hello@steddle.com. A mail there reaches Steddle, and Steddle's own privacy statement says what it keeps of it. An issue or a pull request on GitHub is public, and GitHub's own privacy statement covers it.
On what basis
Cloudflare's cookie, the access logs and the counting of visits Steddle processes on its legitimate interest in keeping the site running and secure, and in knowing how it is read (article 6(1)(f) GDPR).
Who processes for VCRS
| Party | What it does | Where, and on what ground |
|---|---|---|
| Laravel Cloud | Hosts VCRS and keeps the platform's access log for seven days, the period of the plan Steddle runs on | Frankfurt (eu-central-1); Laravel, a company in the United States, is certified under the EU-US Data Privacy Framework (article 45 GDPR), its trust centre states, which also holds its data processing agreement |
| Cloudflare | Stands in front of the site, sets __cf_bm and keeps an access log of its own, for as long as the criteria in its privacy policy say | Data centres in the EU and the United States; the EU-US Data Privacy Framework (article 45 GDPR) and the standard contractual clauses (article 46 GDPR), as its GDPR page states |
| Visitors | Counts visits, as above | Visitors Now LLC, a US company, processes the analytics data in the EU, at Hetzner, according to its data processing agreement, and names no basis for a transfer |
The standard contractual clauses Cloudflare relies on are those of Commission Implementing Decision (EU) 2021/914, which its data processing addendum incorporates.
Your rights
Because Steddle processes your data on its legitimate interest, you can object to that processing at any time, on grounds relating to your particular situation (article 21 GDPR), at privacy@steddle.com.
Access, correction, erasure or restriction you ask for at the same address. If you disagree with how VCRS handles your data, you can lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority.
Changes
If Steddle changes this statement, the new version stands here with the date it applies from. This version is in force from 21 October 2026. Until Steddle Group B.V. is incorporated, it applies to Steddle Group B.V. in oprichting and whoever acts on its behalf.