Privacy policy.

The operator and data controller of upnext.cz (operated under the Upnext brand) is:

The site presents our services and also hosts a public sandbox of small browser-side tools, engineering notes, and prototypes.

• IP address — used solely for rate-limiting (capping how many requests hit our server so nobody can overload our proxy services for ARES, VIES, ČNB, etc.). We keep the IP in memory for at most 5 minutes and store it nowhere.
• Cloudflare Turnstile cookie — when Turnstile is enabled (bot protection), Cloudflare sets a short-lived cookie. It is managed by Cloudflare, not us. Cloudflare privacy policy.
• Traffic measurement data - only if you allow it in the cookie banner. Via Google Tag Manager we deploy self-hosted Rybbit (traffic statistics running on our own infrastructure) and the Meta Pixel (conversion measurement for Facebook/Instagram). Without your consent these tools never load.
• Meta Conversions API - with the same consent, our server sends selected events (page view, form submission, tool usage) directly to Meta. Each event carries the IP address, user agent, and the _fbp/_fbc cookies. The email and phone number from the lead form are sent exclusively as a SHA-256 hash, never in readable form.

What we do not process: no user accounts, no visitor logins. Files you load into the tools (videos, images, XML feeds) are processed in your browser — the server never sees them. And without consent in the cookie banner, no measurement or marketing tracking runs at all.

More about cookies in our cookie policy.

For rate-limiting, our legal basis is legitimate interest under Art. 6(1)(f) GDPR — the interest in preventing abuse of publicly accessible tools. Without rate-limiting, a single person could send thousands of requests per second to ARES or ČNB through our proxies and harm both their service and ours.

For traffic measurement and marketing (Rybbit, Meta Pixel, Meta Conversions API), the legal basis is your consent under Art. 6(1)(a) GDPR, given in the cookie banner and revocable at any time.

IP addresses live in our server’s memory only for a sliding 5-minute window (rate-limiter), then are deleted automatically. Server logs, which may temporarily contain IPs, are kept for up to 30 days.

Measurement data (Rybbit, Meta) follows the retention rules of the respective tool. You can withdraw consent in the cookie banner and delete cookies in your browser at any time - from that moment no further measurement data about you is collected.

Some tools forward your input to public services to avoid the browser’s CORS restrictions:

• A company ID (IČO) is sent to ARES (Czech Ministry of Finance).
• A VAT ID is sent to VIES (European Commission).
• A date is sent to the ČNB API (Czech National Bank).
• A feed/page URL is sent only to our server, which fetches it and returns the results (Heureka feed validator, SEO validator). It goes no further.

If you have given consent in the cookie banner:

• Rybbit is self-hosted - traffic statistics stay on our own infrastructure and are shared with no third party.
• Meta Platforms (Pixel and Conversions API) - the only external recipient of measurement data. Data may be transferred to the USA; Meta is certified under the EU-US Data Privacy Framework.

The cookie banner and the measurement scripts themselves are loaded via Google Tag Manager (Google) - it collects no analytics data of its own, it only manages the scripts.

Apart from measurement data, we hold no identifiable data for longer than 5 minutes and have no user accounts. For measurement data you can exercise your GDPR rights (access, rectification, erasure, objection) and withdraw consent at any time in the cookie banner. With any question or objection, reach us at [email protected]. You may also lodge a complaint with the Czech Data Protection Authority (ÚOOÚ).

We may update this policy from time to time. The current version is always on this page.