CentheadPrivacy Policy
Last updated 2026-10-23.
The controller of your personal data is Centhead. Privacy contact: privacy@example.com.
What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email, display name, password hash (scrypt), country | Your account, sign-in, taxes and legal requirements | Contract (Art. 6(1)(b)); legal obligation |
| Age confirmation and terms acceptance, with timestamps | Proof of eligibility and consent | Legal obligation; legitimate interest |
| Ad views, offers, earnings, withdrawals, referral relationships | Paying you, accounting, tax, fraud prevention | Contract; legal obligation |
| Two-step verification secret (encrypted) and recovery code hashes | Protecting your account | Legitimate interest; contract |
| Session records: browser description, a keyed hash of your IP address, activity times | Security, session management, fraud and multi-account prevention. We do not store raw IP addresses. | Legitimate interest (Art. 6(1)(f)) |
| Payout account reference and verification status | Withdrawals and anti-money-laundering. Identity documents, bank and tax details are held by Stripe, not by us. | Legal obligation; contract |
| A pseudonymous id supplied by an app that embeds Centhead | Crediting earnings to the right person | Contract |
| Anonymous member id sent to offer and survey networks | So the network can report completions to us. We send no email or name. | Contract |
What we do not do
We do not sell personal data, build advertising profiles of you or use tracking cookies. Ad and offer networks that serve content inside Centhead process data under their own policies, which we link from the relevant screens.
Processors and recipients
Stripe (payouts, identity verification), our hosting provider, our email provider, Cloudflare (bot protection on presence checks) and the advertising and offer networks you choose to interact with. Where data leaves the European Economic Area we rely on adequacy decisions or Standard Contractual Clauses.
Retention
Account data is kept while your account is active. Ledger records are kept, de-identified after account deletion, for as long as accounting law requires. Security logs and flags are kept for up to 24 months.
Your rights
You can access and download your data (Settings, “Download my data”), correct it, delete your account (Settings, “Delete my account”; we keep only de-identified records we are legally required to keep), restrict or object to processing, and complain to your data protection authority. Write to privacy@example.com for anything else; we answer within one month.
Security
Passwords are hashed with scrypt, sensitive secrets are encrypted at rest, connections use TLS, access is logged, and the money ledger is append-only. See the Security page.
Children
Centhead is for adults. We do not knowingly collect data from anyone under 18 and delete accounts we learn belong to a minor.