Privacy policy

**Banger Privacy Policy** - Last updated: 27 July 2026. This update additionally documents our OWN audience measurement, aggregated and identifier-free (counters of shares, usage events and reads per article), described in detail in the dedicated section below; as well as: (a) push notifications (explicit opt-in via the dedicated button; we store the technical subscription identifier provided by your browser - endpoint and encryption keys - and your language, deleted upon unsubscription or when delivery becomes impossible; legal basis: consent, Art. 6.1.a GDPR); (b) event submissions (title, venue, date, official link, note and OPTIONAL contact email, kept for the duration of moderation and possible publication); (c) game leaderboards (freely chosen nickname and score, pseudonymous data); (d) Google sign-in (we receive your email address, name and, where applicable, avatar); (e) Umami audience measurement, used WITHOUT cookies on the basis of legitimate interest (aggregated statistics), as distinct from Google Analytics which requires consent. This policy explains what personal data is collected on Banger (https://banger.lu), why, on what legal basis, with whom it is shared, how long it is kept, and how you can exercise your rights. We follow a simple principle: transparency and GDPR compliance are our best protection. We never seek to "take away" your rights; on the contrary, we commit to making them easy to exercise.

**Who is responsible for your data (data controller)** - Banger is published by Mickaël Barbier, a natural person acting in a personal capacity (there is no company and no registration with the Trade and Companies Register). The data controller within the meaning of the General Data Protection Regulation (GDPR, EU Regulation 2016/679) is therefore Mickaël Barbier. For any question regarding data protection or to exercise your rights, you may contact him at contact@banger.lu. The applicable law is Luxembourg law, and the competent supervisory authority is the National Commission for Data Protection (CNPD), Luxembourg.

**Our operating principle: embed-only and compliance by design** - Banger is a "social-first" media outlet: it comments on and contextualises Luxembourg's trends, viral content and public figures. Social media content is NEVER re-hosted: it is displayed exclusively through the official integration (embed) provided by the platforms themselves (X, Instagram, TikTok, Facebook, etc.). No sensitive topic and no unverified private individual is ever published or relayed automatically. When we use artificial intelligence to draft certain articles, those articles always remain grounded in factual data (data-grounded) and concern non-sensitive topics.

**What data we collect** - Depending on how you use the site, we may process: (1) your email address and a hashed password (never stored in plain text) if you create an account; (2) session cookies to keep you logged in; (3) for creators, the metadata and access tokens of the social media accounts you connect, kept securely on the server side; (4) your name or username and the content of the comments you post; (5) your email address if you subscribe to the newsletter; (6) a consent log (date, scope and proof of your choices regarding trackers and the newsletter); (7) your IP address, processed for security, anti-spam and rate-limiting purposes; (8) audience measurement data, only with your consent - on the one hand our own AGGREGATE counters of shares, usage and article reads, which contain neither identifier nor IP address (see the dedicated section below), and on the other hand, where applicable, a third-party measurement tool; (9) data related to advertising display (via Google AdSense, only with your consent); (10) for creators who choose to complete their profile (entirely optional), the only information they enter themselves - first name, last name, username, city and a short bio (which may appear on your public profile only if you enable it), as well as, strictly privately and visible to you alone, your age. We ask for NEITHER your postal address NOR your phone number. This profile information can be edited or deleted at any time from your creator space.

**Purposes: why we process this data** - We use your data to: create and manage your user account and the creator space; enable the secure connection of your social accounts and, where applicable, the tag-based auto-publishing described below; display and moderate comments; manage the newsletter; handle content submissions ("Propose a buzz"); ensure the security of the site, prevent spam and abuse; measure audience to improve the site; display advertising; and keep proof of your consents. We do not carry out any solely automated decision producing legal effects concerning you, and we never resell your data.

**The creator space, OAuth connection and tag-based auto-publishing** - If you are a creator, you can create an account (via Supabase Auth, with email and password) and connect your social media accounts via the official OAuth protocol (X and TikTok are live; Instagram and Facebook are being considered). This connection allows us to store, on the server side, the technical tokens needed to relay your content. The tag-based auto-publishing mechanism works as follows: when you, a connected creator, tag @Banger or use the hashtag #Banger, your content MAY be relayed on Banger as an official embed, after passing through an automatic safety filter. You remain in control: you can disconnect your accounts at any time, which deletes the associated tokens and ends any future relaying.

**The "Propose a buzz" form** - Anyone can submit a link to a piece of content via the "Propose a buzz" form. On this occasion we only collect the proposed link (and, where applicable, the information you choose to add). No submission is published automatically: every submission is reviewed and moderated manually before any possible featuring, in line with our principle of protecting unverified private individuals and sensitive topics.

**Legal basis for each processing activity (Article 6 GDPR)** - We rely on: (1) your CONSENT (Art. 6(1)(a)) for non-essential trackers - Umami audience measurement and AdSense advertising - as well as for newsletter subscription, collected via double opt-in; (2) PERFORMANCE OF THE CONTRACT (Art. 6(1)(b)) for the creation and management of your account, the creator space and the connection of your social accounts, which constitute the service you ask us to provide; (3) our LEGITIMATE INTEREST (Art. 6(1)(f)) for site security, spam and abuse prevention, rate limiting and comment moderation, an interest we have balanced against your rights and freedoms. You may at any time withdraw a consent (without retroactive effect) or object to processing based on legitimate interest.

**Processors and recipients of your data** - To run the site, we use technical providers (processors within the meaning of Art. 28 GDPR), who act on our instructions: Vercel (site hosting, in the United States, covered by the European Commission's Standard Contractual Clauses); Supabase (database and authentication, hosted in the European Union, in Frankfurt); Resend (email sending, planned); Vercel Web Analytics (aggregated statistics WITHOUT cookies or individual identifiers, legal basis: legitimate interest - Art. 6(1)(f); technical data processed by Vercel Inc., USA, under Standard Contractual Clauses; object at: contact@banger.lu); Umami (audience measurement, subject to your consent); and Google (AdSense advertising network, subject to your consent). The social media platforms (X, Instagram, TikTok, Facebook) operate via their official embeds, and their own privacy policies apply to the content you view on them. We neither sell nor rent your data to third parties.

**Data transfers outside the European Union** - Some of our providers, notably Vercel and Google, may process data in the United States. Where a transfer outside the European Economic Area takes place, it is governed by appropriate safeguards within the meaning of Chapter V of the GDPR, in particular the Standard Contractual Clauses adopted by the European Commission, supplemented where necessary by additional technical and organisational measures. Supabase hosts the database within the European Union (Frankfurt). You may request further information about these safeguards at contact@banger.lu.

**Retention periods** - We keep your data only as long as necessary for the purposes described: account and creator-space data is kept while your account is active, then deleted within a reasonable period (at most 30 days) after its closure; the tokens of connected social accounts are deleted as soon as the relevant account is disconnected; the newsletter email address is kept until you unsubscribe; comments remain published until you request their deletion or moderation removes them; consent logs are kept for as long as needed to demonstrate legal compliance (generally up to 3 years after your last choice); IP addresses processed for anti-spam and security are kept for a short period (generally a few days to a few weeks); Umami audience data is kept on a limited basis. Beyond these periods, data is deleted or anonymised.

**Cookies and trackers: your prior consent** - Cookies and trackers strictly necessary for the site to function (for example the session cookie that keeps you logged in) are placed without consent, as they are essential to the service. By contrast, all non-essential trackers - audience measurement (Umami) and advertising (Google AdSense) - are only activated AFTER your free, informed and specific consent, collected via our in-house Consent Management Platform (CMP) which appears as soon as you arrive. You can accept, refuse or customise your choices, and change or withdraw them at any time, as easily as you gave them. Until you have consented, no advertising or audience-measurement tracker is placed.

Audience measurement: if you consent via the cookie banner, this site uses Google Analytics 4 (Google Ireland Ltd / Google LLC, USA - transfers covered by the Data Privacy Framework and standard contractual clauses) to compile visit statistics. Cookies set: _ga and _ga_* (maximum lifetime of about 13 months). You can withdraw your consent at any time via “Manage my cookies”.

**Our own audience measurement (aggregated, no cookie, no identifier)** - After you consent to the "audience measurement" purpose - and only then - Banger keeps three AGGREGATE COUNTERS in its own database, without using any third party: (1) article shares (article identifier, channel used - copy link, WhatsApp, X, etc. -, page language, date); (2) anonymous usage events (opening an embedded video player, clicking in a carousel, clicking out to an external site, moving to the next clip), with the target content, the platform and the language; (3) the number of reads per article (a simple total per article). What is NEVER recorded: your IP address, a cookie, a session or visitor identifier, your browser (user-agent), the page you came from. Two events therefore cannot be linked to the same person: these are statistics, not a browsing log, and no personal data within the meaning of Article 4(1) GDPR is kept in them. Your IP address is used solely, in memory and for a few moments, to limit the number of submissions per minute (anti-bot protection): it is never written to the database nor logged. A technical lock is placed in your browser's session storage (key "bz-view:" followed by the article identifier) so that the same read is not counted twice; it contains no visitor identifier and disappears when you close the tab. An important note about videos: the players are embeds from third-party platforms (YouTube, TikTok, Instagram, X, Facebook) and your browser forbids us from reading their state; we therefore NEVER measure a view, its duration or its completion, only the fact that the player was opened. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via "Manage my cookies" - withdrawal immediately stops any new measurement, and your choice is requested again at most every 12 months. Retention: as these counters relate to no identifiable person, they are kept for purely statistical purposes; for the same reason there is no technical means of locating "your" rows in them, so individual rights of access and erasure cannot apply (Art. 11 GDPR).

**Your rights under the GDPR** - You have the following rights at any time: the right of ACCESS to your data; the right to RECTIFICATION of inaccurate data; the right to ERASURE ("right to be forgotten"); the right to RESTRICTION of processing; the right to PORTABILITY (to receive your data in a structured, reusable format); the right to OBJECT to processing based on legitimate interest; and the right to WITHDRAW your consent at any time, without affecting the lawfulness of processing already carried out. To exercise any of these rights, write to us at contact@banger.lu; we respond within one month. If you believe your rights are not being respected, you may lodge a complaint with the National Commission for Data Protection (CNPD), 15 boulevard du Jazz, L-4370 Belvaux, Luxembourg (www.cnpd.lu).

**Security of your data** - We implement reasonable technical and organisational measures to protect your data: passwords are hashed and never stored in plain text, the tokens of social accounts are kept securely on the server side, exchanges are encrypted (HTTPS), and access to data is restricted to what is strictly necessary. As no system is infallible, we undertake, in the event of a data breach likely to result in a risk to your rights, to notify the CNPD and, where applicable, the data subjects, in accordance with Articles 33 and 34 of the GDPR.

**Minors (16 and over)** - Banger is intended for an audience aged 16 and over. In Luxembourg, the age from which a minor can validly consent to the processing of their data in the context of online services is set at 16. We do not knowingly collect data concerning persons under 16. If you are a parent or guardian and believe that a minor under 16 has provided us with data, please contact us at contact@banger.lu so that we can delete it.

**Changes to this policy and contact** - We may update this policy to reflect new processing activities (for example the activation of Resend or the connection of Instagram, TikTok and Facebook) or legal developments. Any significant change will be flagged on the site and the "last updated" date will be revised. For any question about your personal data or to exercise your rights, there is a single address: contact@banger.lu. Data controller: Mickaël Barbier, in a personal capacity, Luxembourg.