Privacy Policy (GDPR, UK GDPR, and CCPA Compliance)
Last Revised: January 1, 2025 • Effective Date: January 1, 2025
At OptiSettings, we strictly adhere to principles of privacy by design and data minimization under Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR), the UK Data Protection Act 2018, and the California Consumer Privacy Act (CCPA/CPRA). We never sell your personal data.
1. Identity of the Data Controller
For the purposes of the General Data Protection Regulation (GDPR) and other relevant data protection legislation across the European Economic Area (EEA), the United Kingdom, and Switzerland, the Data Controller responsible for the processing of your personal data is:
2. Categories of Information Collected
We collect and process only the minimum amount of technical data necessary to operate, optimize, and secure the hardware calculation platform. This information falls into the following distinct categories:
When interacting with the optimizer workflow, you enter non-identifying technical specifications including your graphics card model (GPU), processor model (CPU), system memory quantity (RAM), targeted display resolution (e.g. 1080p, 1440p, 4K), monitor refresh rate, and storage medium. This information is processed in client-side memory to calculate frame rate models and generate in-game settings. We do not link these parameters to your real name or personal identity.
Whenever you visit our web service, our web hosting servers automatically record standard HTTP server log data sent by your web browser. This includes: Internet Protocol (IP) address (which is truncated or anonymized at the edge wherever feasible), browser user-agent header, operating system family, referring URL, time of access, request method, and HTTP status codes.
We store your user-defined cookie consent preferences inside browser session storage (`sessionStorage`) to ensure we comply with your choice regarding analytical cookies throughout your browsing session.
3. Purposes of Processing & Lawful Legal Bases (GDPR Article 6)
Under European data protection laws, any collection and processing of personal data must be justified under a specific lawful basis set forth in Article 6 of the GDPR. We process data under the following legitimate bases:
- Performance of a Contract / Delivery of Service (Art. 6(1)(b) GDPR): Processing the hardware parameters you input is strictly required to provide the calculations and settings guidance you request.
- Legitimate Interests (Art. 6(1)(f) GDPR): We process server logs and truncated IP addresses to monitor server stability, defend against Denial of Service (DDoS) attacks, detect bot scraping, diagnose network errors, and ensure system resilience. Our legitimate interest lies in maintaining a safe and high-performing platform for all users.
- Explicit User Consent (Art. 6(1)(a) GDPR): If non-essential performance telemetry or third-party analytical tools are activated, such processing occurs exclusively after you grant opt-in consent through our Cookie Consent banner. You maintain the right to withdraw this consent at any moment without detriment.
4. Retention of Data & Deletion Schedules
We adhere to strict data retention policies designed to minimize data persistence:
- User Hardware Input: Retained exclusively in your local browser session storage during active navigation. Closing your browser session or tab clears the data unless cached locally on your device.
- Server Access Logs: Retained for a maximum period of thirty (30) days solely for security monitoring, anomaly mitigation, and intrusion prevention, after which logs are permanently deleted or purged.
- Consent State Logs: Maintained in volatile session storage for the duration of your browser visit.
5. Third-Party Sub-processors & Infrastructure Providers
OptiSettings utilizes trusted third-party cloud infrastructure providers bound by strict Data Processing Agreements (DPAs) with standard contractual clauses (SCCs) to ensure data protection compliance:
- Cloud Hosting & Edge Network Providers: For delivering low-latency cached content, TLS encryption, and DDoS filtering.
- Font Delivery Networks: Google Fonts (loaded with strict privacy headers preventing cross-site profiling).
We do not sell, rent, trade, or monetize your personal information to data brokers, ad networks, or marketing syndicates.
6. Your Statutory Rights under GDPR, UK GDPR, and CCPA
Depending on your geographical location and applicable legal statutes, you possess comprehensive statutory rights regarding your personal data:
The right to request confirmation of whether we process personal data concerning you and obtain a copy of that data.
The right to demand the permanent deletion of your personal data where retention is no longer justified.
The right to request immediate correction of inaccurate or incomplete personal records.
The right to receive your personal data in a structured, commonly used, and machine-readable format.
The right to object to processing based on legitimate interests or restrict processing during dispute review.
California residents enjoy the right to know what personal categories are collected, request deletion, opt-out of sales, and be free from discrimination.
To exercise any of your statutory data rights, please submit a verified request to our privacy desk at privacy@optisettings.local. We will respond within thirty (30) days without charge.
7. International Data Transfers
If your personal data is transferred outside the European Economic Area (EEA) or the United Kingdom to servers located in the United States or other jurisdictions, such transfers are conducted under adequacy decisions or European Commission approved Standard Contractual Clauses (SCCs) to guarantee an equivalent degree of protection.
8. Security Measures
We implement rigorous technical and organizational security measures pursuant to Article 32 GDPR, including Transport Layer Security (TLS 1.3) cryptographic protocols for all data in transit, strict Content Security Policies (CSP), secure HTTP header configurations (HSTS, nosniff, frame-ancestors), and continuous vulnerability monitoring.
9. Supervisory Authority Complaints
If you are an EEA or UK resident and believe that our processing of your personal data infringes applicable data protection regulations, you have the statutory right to lodge a formal complaint with your local Data Protection Authority (DPA).