Privacy policy

Who is responsible

This site is run as an independent project by an operator established in the European Union, so the EU General Data Protection Regulation (GDPR) applies to everything described here, wherever you are.

What we process, and why

Server logs

Our hosting provider's servers, and the Cloudflare network in front of them, record each request: IP address, browser type, the page requested, the referring page, and the time. We use these to keep the site running, to detect abuse and attacks, and to fix errors. Legal basis: our legitimate interest in the security and operation of the site (GDPR article 6(1)(f), recital 49). Retention: up to 30 days, after which logs are deleted.

Searches

ZIP codes, town names, and county names are matched against data on our own server. If you type a street address, the address is sent to the U.S. Census Bureau's public Geocoder, a U.S. government service, to find its county and coordinates. We send nothing that identifies you with it, and the address is masked in our server logs. Legal basis: legitimate interest in performing the search you asked for.

Google Analytics

We use Google Analytics 4 to count visits and see which pages are used. If you are in the European Economic Area, the United Kingdom or Switzerland, the tag runs with analytics storage denied: it sets no cookies and sends only cookieless pings that Google turns into aggregate estimates. Elsewhere it sets the _ga cookies (kept for up to two years) so that returning browsers can be told apart. Google Analytics 4 does not log or store IP addresses. Google LLC (United States) processes this data as our processor under Google's data processing terms; transfers to the United States rely on Google's certification under the EU-U.S. Data Privacy Framework. Legal basis: legitimate interest in understanding how the site is used, and where consent would be needed to store anything in your browser we do not store it. You can opt out with Google's browser add-on or by blocking googletagmanager.com.

Correspondence

If you email us, we keep the correspondence for up to 24 months so that we can answer you and keep a record of corrections. Legal basis: legitimate interest in answering you.

Cookies

The site sets one cookie of its own: a session cookie that protects forms against cross-site request forgery. It is strictly necessary for the site to work, contains nothing we use to recognise you across visits, and is deleted when you close your browser. Cloudflare may set a short-lived security cookie to tell people from automated traffic; it exists only to protect the site. Because nothing else is stored on your device, no consent banner is needed under the EU and Finnish rules on cookies. We use no advertising or tracking cookies and no third-party advertising.

Who processes data for us

• Hetzner Online GmbH (Germany; data centres in Germany and Finland): hosting. Inside the EU.
• Cloudflare, Inc. (United States): content delivery and protection against attacks. Cloudflare processes request data, including IP addresses, on its network worldwide. Transfers to the United States rely on Cloudflare's certification under the EU-U.S. Data Privacy Framework, with the European Commission's Standard Contractual Clauses as a fallback. A copy of the safeguards is available on request.
• Google LLC (United States): Google Analytics 4, as described above. Transfers to the United States rely on Google's certification under the EU-U.S. Data Privacy Framework.
• U.S. Census Bureau: receives street addresses typed into the search, as described above. It is a U.S. government service, not a processor acting for us.

We do not sell personal data, share it for advertising, or give it to anyone else unless the law requires it.

Your rights

Under the GDPR you can ask us for access to the personal data we hold about you, for correction or deletion, for restriction of processing, to object to processing based on legitimate interest, and for a copy of data you gave us in a portable format. Where processing is based on consent, you can withdraw it at any time. Write to hello@tapcensus.com and we will answer within one month. You can also complain to a data protection authority, in particular the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu), tietosuoja.fi.

For most visitors we hold nothing that identifies you: logs are deleted within 30 days and we cannot connect them to a request from you.

If you live in a U.S. state with a consumer privacy law: we do not sell or share personal information, do not use it for targeted advertising, and do not profile anyone. The rights above are open to you whether or not that law applies to us.

Children

The site is not directed at children, and we do not knowingly collect personal data from anyone under 13, or under 16 where that is the local age of consent. If you believe a child has given us personal data, contact us and we will delete it.

Data about water systems

The water system records on this site are public records published by EPA and the Census Bureau about organisations, not about individuals. We do not publish the names or contact details of individuals that appear in EPA's records.

Security

The site is served over HTTPS only. Access to our servers requires key-based authentication. Personal data, where we hold any, is stored separately from the public content database.

Changes

We update this policy when the site changes, for example when a new feature processes new data. The date at the top shows the latest version.

Contact

Questions about privacy: hello@tapcensus.com.