Privacy Policy

1. Who we are

Sweepbase ("we", "us", or "our") operates the website sweepbase.net, an independent comparison platform for cryptocurrency debit and credit cards. Sweepbase is operated from the Republic of Moldova.

The natural person behind that operation, and therefore the data controller for the purposes of GDPR Article 4(7) and equivalent laws, is Mihail B., an individual based in the Republic of Moldova. No incorporated company sits between the site and the operator at this time. If that changes, this page will be updated with the new controller's details.

We do not issue cards, process payments, hold digital assets, or provide financial advice. We are not a financial institution, broker, or investment adviser.

2. Information we collect

2.1 Information you provide voluntarily

• Email address: if you subscribe to our weekly newsletter, we collect and store your email address for the purpose of sending you periodic email updates. Subscribing requires an explicit consent action: either ticking a consent checkbox on our inline form, or, on the compact signup bar, subscribing after the on-screen consent notice; the timestamp of that consent is recorded server-side and is the lawful basis under GDPR Article 6(1)(a). We then email you a link that works for 48 hours. Your address goes on the list only after you open it and press the confirm button; if you don't, we send nothing more. Every email we send includes an unsubscribe link, and you can also withdraw consent at any time by emailing contact@sweepbase.net. This data is processed by our email service provider, Resend (resend.com).
• Contact correspondence: if you email us at contact@sweepbase.net, we receive your email address and message content. This is used solely to respond to your inquiry.
• Card submissions and error reports: the text you type into the Submit a card form or a card page's Report error form is emailed to us through Resend. Neither form asks for your name or email address. Your IP address is used to rate-limit the forms and is kept in our server logs (Section 7), not in the email.

2.2 Information collected automatically

When you visit the Site, some data is collected automatically through server logs, analytics services and, if you accept them, tracking scripts and cookies. Some of it, such as your IP address, is personal data:

• Log files: Our web server and hosting provider (Vercel) automatically record standard log data including your IP address, browser type and version, operating system, referring URL, pages visited, date/time stamps, and request method. IP addresses are used for security, rate limiting, and abuse prevention. Log files are retained for up to 30 days.
• Usage data: Pages visited, time on site, interactions (clicks on card listings, filter selections, compare actions, search queries), device type, screen resolution, and approximate geographic region (country/city level, derived from IP address).
• Cookies and similar technologies: See Section 4 below for full details.

2.3 Information we do not collect

Sweepbase does not require account creation or registration. We do not collect or store payment card numbers, cryptocurrency wallet addresses, bank account information, Social Security numbers, government ID data, or other sensitive financial information.

3. How we use your information

We use collected data for the following purposes:

• Site operation and improvement: Understanding how visitors navigate the Site to improve content, user experience, and card comparison features.
• Newsletter delivery: Sending periodic email updates to subscribers who have opted in. You may unsubscribe at any time via the link in each email.
• Performance monitoring: Diagnosing technical issues, monitoring uptime, and measuring page load performance.
• Security and abuse prevention: Rate limiting API endpoints, detecting bot traffic, preventing scraping, and blocking malicious activity.
• Analytics and reporting: Measuring traffic patterns, popular card comparisons, and category page performance.
• Legal compliance: Responding to lawful requests from authorities when required by applicable law.

We do not sell, rent, lease, or trade your personal data to third parties for marketing purposes.

4. Cookies, tracking and affiliate networks

Cookies are small text files stored in your browser. This section lists what the Site and the services it loads keep in your browser or receive from it, and which of them wait for your consent.

4.1 What the Site itself stores

The Site sets no cookies of its own. It keeps a few settings in your browser's local storage: your theme, the cards in your compare tray, whether you closed or used the newsletter bar, and your cookie choice (Section 4.3). A service worker caches static files and images so pages load faster and still open offline. These stay in your browser.

4.2 Measurement that runs for every visitor

• Vercel Analytics: Cookieless, first-party web analytics that measure aggregate page views and Core Web Vitals. It sets no cookies, stores no IP addresses, and identifies visits only through an anonymous hash that resets every day, so no cross-site or cross-day profiles can be built. It runs as aggregate statistics and is not gated by the consent banner.
• Card views and card clicks: when you open a card page, or click a button that takes you to a card issuer, your browser tells our server which card it was and whether it was a view, a partner link or the issuer's own site. We add it to a count per card and per day. To count each visitor once per card per day, the server keeps a keyed hash of your IP address, browser user agent and the date for 26 hours. The key is a server-side secret, so the hash cannot be turned back into your IP address without it, and the IP address itself is not stored. No cookie is set. The lawful basis is our legitimate interest in knowing which cards readers look at and follow (GDPR Article 6(1)(f)). This count runs whether or not you accept the banner.

When you make a choice in the consent banner, we count the decision itself (accept or reject) as an anonymous monthly tally. No IP address, browser details, or timestamp are stored with it.

4.3 Loaded only if you accept

The four services below load only after you click “Accept” in the consent banner. From then on they load on every page you open until you change your choice. The lawful basis for them is your consent (GDPR Article 6(1)(a)).

• Google Analytics 4 (GA4): usage statistics. GA4 sets first-party cookies (_ga and _ga_ followed by an ID) to distinguish visitors and sessions. Google's data practices are governed by the Google Privacy Policy. You can also block GA4 everywhere with the Google Analytics Opt-out Browser Add-on.
• Microsoft Clarity: heatmaps and session replay (how visitors scroll and interact with pages) to improve usability. Clarity sets cookies (_clck and _clsk) and records masked interaction data; text inputs are masked by default. Microsoft's handling is governed by the Microsoft Privacy Statement.
• Ahrefs Web Analytics: a cookieless analytics tag that measures traffic. Your browser sends Ahrefs the page address, the referring page and device details. It sets no cookies and builds no cross-site profiles.
• Impact.com affiliate tracking: Impact.com's script loads on every page and counts how often the partner links on it are seen (impression tracking), for the affiliate reports Impact.com keeps for us. It does not change any link on the page. The script may set first-party cookies whose names start with IR_; they are deleted if you later reject. Impact.com receives your IP address, browser details and the page address; its Privacy Policy applies.

If you click “Reject”, none of the four load. Your choice is stored in your browser's local storage together with the date you made it, and it is kept for six months; after that, the banner asks again. You can change it at any time with Cookie settings at the bottom of every page. If you withdraw consent, the Site deletes the Google Analytics and Clarity cookies set on sweepbase.net and reloads the page, so none of the four keeps running.

4.4 Affiliate links

When you click an affiliate link on Sweepbase (e.g., a "Get card" button), third-party affiliate networks and card issuers may place cookies, web beacons (pixel tags), and URL tracking parameters on your browser to:

• Track the referral from Sweepbase to the issuer's website
• Attribute your sign-up or card application to Sweepbase for commission purposes
• Measure the effectiveness of the affiliate partnership

The following affiliate networks and tracking services may set cookies when you interact with affiliate links on our Site:

• Impact.com (Impact Radius): Impact.com is a third-party affiliate tracking platform used by many of our partner card issuers. When you click an affiliate link managed through Impact.com, their tracking technology places cookies and may use web beacons to record the referral event. These cookies typically persist for 30 to 90 days (the exact duration is set by each advertiser). Impact.com may collect your IP address, browser type, device information, referring URL, and click timestamp for attribution purposes. Impact.com's data processing is governed by their Privacy Policy.
• Direct issuer tracking: Some card issuers operate their own referral tracking systems that may set first-party cookies on their domain when you arrive via a Sweepbase link.

Important: Sweepbase does not control the cookies set by Impact.com, card issuers, or other third-party networks. Once you leave Sweepbase by clicking an affiliate link, you are subject to the destination site's and the affiliate network's privacy policies and cookie practices.

4.5 Error tracking

• Sentry: We use Sentry for error monitoring and crash reporting. Sentry receives technical data about errors (stack traces, browser details, the page address) and, like any server a browser or our own server connects to, the IP address of the connection. Query strings, cookies and authorisation headers are removed from error reports before they are sent. Sentry's practices are governed by the Sentry Privacy Policy.

4.6 Changing your choice and managing cookies

Use Cookie settings at the bottom of any page to change or withdraw your consent (Section 4.3). You can also control and delete cookies through your browser settings. Most browsers allow you to:

• View what cookies are stored and delete them individually or in bulk
• Block third-party cookies while allowing first-party cookies
• Block all cookies (note: this may break site functionality)
• Set your browser to notify you when a cookie is being placed

Disabling analytics and affiliate cookies will not affect your ability to browse Sweepbase, but affiliate links may not function correctly if tracking cookies are blocked.

5. Third-party services

We use the following categories of third-party services:

• Hosting & CDN: Vercel (vercel.com) hosts the Site and serves static assets globally. Vercel processes server logs and may store IP addresses temporarily.
• Email service: Resend (resend.com) processes newsletter subscriptions and sends transactional emails on our behalf.
• Analytics: Vercel Analytics for every visitor; Google Analytics 4 (Google), Microsoft Clarity (Microsoft) and Ahrefs Web Analytics (Ahrefs) only if you accept them. See Section 4.
• Error monitoring: Sentry for application error tracking.
• Rate limiting and counters: Upstash Redis holds our rate-limit counters, keyed by IP address for the length of each limit (at most 24 hours), and the card view and click counts described in Section 4.2.
• Affiliate networks: Impact.com and direct issuer programs for commission tracking. See Sections 4.3 and 4.4 above and our Disclaimer & Affiliate Disclosure.
• Directory badges: the footer of every page shows badge images from three sites that list Sweepbase: KittyLaunch (kittylaunch.com), Startup Fame (startupfa.me) and Twelve Tools (twelve.tools). Your browser loads them from those sites directly, for every visitor and before any choice in the consent banner, so each of them receives your IP address and browser details. The listings require the badge; we rely on legitimate interest for it.

Each third-party provider is governed by its own privacy policy and terms of service. We select providers that offer data processing agreements (DPAs) compatible with applicable data protection laws.

6. Your data rights

6.1 European Economic Area, UK & Switzerland (GDPR / UK GDPR)

If you are located in the EEA, UK, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and equivalent local laws:

• Right of access: Request a copy of your personal data we hold
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): Request deletion of your personal data
• Right to restriction: Request that we limit processing of your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or direct marketing
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time
• Right to lodge a complaint: File a complaint with your local data protection supervisory authority

Our lawful bases for processing are: (a) consent (Article 6(1)(a)) for Google Analytics 4, Microsoft Clarity, Ahrefs Web Analytics and Impact.com's script, and for newsletter subscriptions; (b) legitimate interest (Article 6(1)(f)) for server logs, security and rate limiting, Vercel Analytics, the card view and click counts, error monitoring and the directory badges; (c) legal obligation for responding to lawful requests.

6.2 California residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with the following rights:

• Right to know: Request disclosure of what personal information we collect, use, and share
• Right to delete: Request deletion of your personal information
• Right to opt out of sale: We do not sell personal information as defined by the CCPA/CPRA
• Right to opt out of sharing: We do not share personal information for cross-context behavioural advertising
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights
• Right to correct: Request correction of inaccurate personal information
• Right to limit use of sensitive personal information: We do not collect sensitive personal information

In the preceding 12 months, we have collected the following categories of personal information: (1) Internet or other electronic network activity (page views, clicks, IP address for log files and rate limiting); (2) email addresses (from voluntary newsletter signups only).

6.2.1 How California residents can submit requests

Send an email to contact@sweepbase.net with the request type in the subject line: Right to Know, Right to Delete, Right to Correct, or Right to Opt-Out. Because we do not require accounts, the only personal data we can typically link to a specific person is a newsletter subscription. Include the email address you used to sign up so we can locate your record.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so an opt-out request mainly serves to confirm that status in writing. If our practices ever change, this section will be updated and existing newsletter subscribers will be notified.

An authorised agent may submit a request on your behalf. We will ask for written proof of authorisation and may verify your identity directly before acting on the request, as permitted under CCPA §1798.130 and the implementing regulations.

We respond to verifiable consumer requests within 45 days of receipt. If more time is needed, we will notify you in writing and may extend the response period by an additional 45 days, in line with CCPA §1798.130(a)(2).

Exercising your CCPA rights will not result in denial of service, different prices, or reduced quality of service. This is the right to non-discrimination under CCPA §1798.125.

6.3 Exercising your rights

To exercise any of the rights described above, please contact us at contact@sweepbase.net with a description of your request. We will respond within 30 days (or the period required by applicable law).

Because we collect minimal personal data and do not require accounts, in many cases we may not be able to link collected data to a specific individual. For newsletter subscribers, please include the email address used to subscribe so we can identify your record.

7. Data retention

• Server logs: Retained for up to 30 days, then automatically deleted.
• Analytics data: Aggregated analytics data is retained for up to 26 months.
• Card view and click counts: The keyed visitor hash expires after 26 hours. The counts per card and per day that remain contain no personal data.
• Rate-limit counters: Kept in Upstash Redis for the length of each limit, at most 24 hours. The limit of one welcome email per address per day is keyed by a hash of the address, never the address itself.
• Your cookie choice: Kept in your browser for six months, then the banner asks again.
• Newsletter subscriber data: Retained until you unsubscribe or request deletion. Upon unsubscription, your email is marked as inactive and fully deleted within 30 days.
• Email correspondence: Retained for as long as necessary to resolve your inquiry, then deleted after a reasonable period (typically 12 months).
• Affiliate tracking data: Controlled by the respective affiliate network (e.g., Impact.com) and subject to their retention policies.

8. Data security

We implement appropriate technical and organisational measures to protect your data, including:

• HTTPS/TLS encryption for all data in transit
• Content Security Policy (CSP) headers with strict domain whitelisting
• Rate limiting on API endpoints to prevent abuse
• Strict access controls on server infrastructure
• Regular security reviews and dependency auditing

No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

9. International data transfers

Sweepbase is operated from the Republic of Moldova. Some of our third-party service providers (Vercel, Google, Microsoft, Ahrefs, Resend, Sentry, Upstash, Impact.com, and the three directory sites named in Section 5) may process data in countries outside the European Economic Area, including the United States.

Where data is transferred outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs), adequacy decisions by the European Commission, or equivalent mechanisms to ensure your data is protected to EU standards.

10. Children's privacy

Sweepbase is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe a child has provided us with personal data, please contact us at contact@sweepbase.net and we will delete it promptly.

11. External links

The Site contains links to external websites operated by card issuers, affiliate networks, and other third parties. Once you leave Sweepbase by clicking an external link, this Privacy Policy no longer applies. You will be subject to the privacy policy and cookie practices of the destination website.

We strongly recommend reviewing the privacy policy of any external site before providing personal information, completing applications, or conducting transactions. Sweepbase is not responsible for the privacy practices, data security, or content of third-party websites.

12. Do Not Track (DNT)

Some browsers transmit a "Do Not Track" (DNT) signal. There is currently no industry-wide standard for DNT compliance. Sweepbase does not currently respond to DNT signals, but we do not engage in cross-site behavioural tracking.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or third-party services. When we make material changes, we will update the "Effective date" at the top of this page. We encourage you to review this policy periodically. Continued use of the Site after changes constitutes acceptance of the revised policy.

14. Governing law

This Privacy Policy is governed by the laws of the Republic of Moldova. For dispute resolution procedures, see our Terms of Use, Section 14.

15. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy, our data practices, or your privacy rights, please contact us at:

• Email: contact@sweepbase.net
• Website: https://sweepbase.net

We aim to respond to all privacy-related inquiries within 30 days.