Privacy Policy

Cloudmarktplaats is built to be privacy-friendly: no trackers, no ad networks, no cookie-banner theatre. This policy explains which data we process, why, and what rights you have. Where we make a promise, it is also enforced in the code. This is an English courtesy translation; the Dutch version prevails in case of any discrepancy.

1. Data controller

The data controller is Aldewereld Consultancy, postal address Nieuwe Hemweg 26, 1013 CX Amsterdam, the Netherlands, Chamber of Commerce no. 61862533. Privacy questions: privacy@cloudmarktplaats.nl.

2. What data we process

Account: email address, username, display name and an encrypted hash of your password. Optionally, if you choose that login method: a GitHub or GitLab identity (OAuth) or an Ethereum wallet address (Sign-In With Ethereum). If you enable 2FA, we store your 2FA secret encrypted.

Listings and homelab posts: the text, category and photos you post. When you upload a photo, its metadata (EXIF, including any GPS location) is automatically stripped before the photo is stored.

Mailing list: if you sign up for the newsletter or the offer digest: your email address, the categories you ticked, and the record of your consent (see 4).

Usage and abuse prevention: technical logs. IP addresses are automatically erased within 24 hours. For relaying messages and reporting listings we keep only minimal data (see below).

3. What we deliberately don't do

• No tracking cookies, no analytics, no advertising or profiling networks.
• No selling or renting of your data to third parties.
• The contact form sends your message as a one-off email to the seller. We do not store the contents of those messages and do not keep your email address; we only record that a message was relayed for a listing, and when.
• The homelab feed is publicly anonymous: visitors never see who posted.

4. Purposes and legal basis

Purpose	Legal basis (GDPR)
Your account and providing the service	Performance of the contract
Displaying listings and homelab posts	Performance of the contract
Security, abuse and fraud prevention, rate limiting	Legitimate interest
Email verification and account security (2FA)	Performance of the contract
Complying with legal obligations	Legal obligation
Newsletter and messages about new listings	Consent (art. 6(1)(a) GDPR)

Newsletter and offer digest

You only get email if you signed up for it yourself and then clicked the confirmation link in your own mailbox. As a record of that consent we keep the timestamp, the form you signed up on, the exact sentence you said yes to, and the moment of that confirmation. No IP address is included: we do not record one on signup, and the IPs in our technical logs are erased within 24 hours anyway. Every message carries an unsubscribe link at the bottom that works immediately, without logging in and without giving a reason. If you delete your account, your subscription goes with it.

5. Retention

• IP addresses: within 24 hours.
• Account: for as long as you have an account. On deletion we erase your account data; some data may be kept briefly where needed for abuse prevention or a legal obligation.
• Listings and homelab posts: until you delete them or close your account.
• Reports: for as long as needed to handle them and prevent repeat abuse.
• Mailing list subscription: for as long as you are subscribed. If you unsubscribe, the email stops immediately and your subscription stays on record with the moment you unsubscribed, as evidence that consent was withdrawn. If you delete your account, the whole subscription goes with it. A signup you never confirm is deleted automatically after 7 days.

6. Recipients and hosting

The platform runs on our own infrastructure, hosted in the Netherlands. We use a few processors that are strictly necessary:

• Email delivery (verification and system emails, relayed contact messages) via our email provider.
• Login via GitHub or GitLab (only if you choose that method): we exchange data with that party to authenticate you.

We do not disclose data to other parties unless legally required to.

7. Cookies

We set only strictly necessary, functional cookies (your session and a CSRF security token). These require no consent and we show no cookie banner. There are no tracking or marketing cookies.

8. Your rights

You have the right to access, rectification, erasure, restriction, objection and portability of your data.

Erasure is self-service, no request and no reason required: Profile → Security → Delete account removes your account, your listings, your photos and your homelab posts. Individual listings can be removed from My listings. For any other request, or if you would rather not press the button yourself, email privacy@cloudmarktplaats.nl; we respond within the statutory one-month period.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

9. Security

Measures we apply include: automatic stripping of photo metadata, encryption of 2FA secrets, two-factor authentication, rate limiting against abuse, and self-hosted infrastructure. No system is 100% secure; report a vulnerability to privacy@cloudmarktplaats.nl.

10. Changes

We may amend this policy. The current version is always on this page.