Privacy Policy
This policy explains how BoringDollars Technology handles personal data on boringdollars.xyz. This is a static marketing website: there are no user accounts, no analytics, no advertising and no tracking cookies. This page sets out precisely what data does move, why, on what legal basis, who touches it and for how long.
1. At a glance
The detail follows, but the short version is unusually short, because the site is unusually simple.
| Question | Answer |
|---|---|
| Do you set cookies? | None of our own. Cloudflare may set one strictly necessary security cookie. |
| Do you run analytics? | No. No Google Analytics, no pixels, no session recording, no heatmaps. |
| Do you sell or share personal data? | No. Never, to anyone, for any consideration. |
| Do you need an account? | No. There is nothing on this site to log into. |
| What do you actually receive? | Whatever you put in the contact form or an email you send us, plus standard server request logs. |
| Do you train AI models on my data? | No. |
| Who can I contact? | cloud@boringdollars.xyz — a person reads it. |
2. Who we are
BoringDollars Technology (“BoringDollars”, “we”, “us”, “our”) operates this website and is the data controller for the personal data described in this policy — meaning we decide why and how it is processed.
| Entity | BoringDollars Technology |
| Website | boringdollars.xyz |
| Privacy contact | cloud@boringdollars.xyz |
| Registered office | Available on request from the address above. |
We have not appointed a statutory Data Protection Officer, as we are not required to. Privacy questions go to the address above and are handled by someone who can act on them.
3. Scope of this policy
This policy covers boringdollars.xyz only — the marketing website you are reading. It does not cover:
- Prago (prago.io) and Marking (marking.fyi), which are upcoming offerings. When made available, their own privacy documentation will govern their data processing. Reading about them here does not enrol you in either.
- Third-party websites we link to.
- Any commercial relationship you may separately enter into with us, which will have its own agreement.
4. What we collect
4.1 Information you give us
If you use the contact form, we receive the fields you complete: your name, your email address, your company (optional) and your message. If you email us directly, we receive whatever your message and your mail client contain — typically the same categories, plus routing metadata added by mail servers.
We also receive a technical record of the submission — the IP address and country the request came from, and a timestamp — which we keep with the enquiry to help us identify abuse of the form.
4.2 Information collected automatically
This site is served through Cloudflare. As with any web server, each request produces log data: IP address, date and time, the URL requested, HTTP status, user agent string, and referring page. This is generated by the act of serving the page and is used to deliver content, defend against attack and abuse, and diagnose faults.
4.3 What we deliberately do not collect
- No advertising or conversion pixels, and no cross-site tracking of any kind.
- No analytics product, first-party or third-party.
- No session recording, heatmaps, scroll tracking or A/B testing tools.
- No fingerprinting, no data brokers, no enrichment of your email against third-party databases.
- No special category data (health, biometrics, political opinions and so on). Please do not send it to us.
5. How and why we use it
| Purpose | Data used | Legal basis |
|---|---|---|
| Replying to your enquiry and any conversation that follows | Name, email, company, message | Legitimate interests; steps prior to entering a contract at your request |
| Keeping business records of who we spoke to and about what | Correspondence | Legitimate interests |
| Serving the website and keeping it available | Request logs | Legitimate interests |
| Detecting and preventing spam, abuse and attacks | Request logs, submission IP | Legitimate interests; legal obligation where applicable |
| Complying with law and responding to lawful requests | Whatever is strictly relevant | Legal obligation |
We do not use your data for automated marketing. We will not add you to a mailing list because you contacted us; if we ever run one, you will have to ask to join it.
6. Legal bases in more detail
Where the UK GDPR or EU GDPR applies to you, our legal bases are:
- Legitimate interests (Art. 6(1)(f)) — running a secure, available website, and responding to business enquiries. Our interest is in operating a business and answering people who contact us; we have considered your interests and rights and consider the impact minimal, since the data is what you chose to send and is not used for anything else. You may object at any time.
- Steps prior to a contract (Art. 6(1)(b)) — where your enquiry is about becoming a customer.
- Legal obligation (Art. 6(1)(c)) — where we must retain or disclose something by law.
We do not rely on consent for anything on this website, because we do nothing that requires it. There is consequently no consent banner and nothing to withdraw.
7. Service providers who process data for us
This list is complete as at the effective date of this policy. We do not use any other processor for this website.
| Provider | What it does | Data involved | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting (Cloudflare Pages), CDN, DNS, TLS, security and bot mitigation | Request logs, IP address | Global edge network |
| Google LLC (Google Fonts) | Serves two webfonts used by the site | IP address and user agent, disclosed by your browser when it fetches the font | Global |
| Amazon Web Services, Inc. | Sends the contact form as email and receives mail to our address | Name, email, company, message, submission metadata | United States (us-east-1) |
On Google Fonts: loading a font from Google’s servers necessarily discloses your IP address and user agent to Google. It sets no cookie. If you would rather it did not happen, a content blocker or a browser that blocks third-party requests will prevent it, and this site remains completely readable in a fallback typeface.
We may also disclose personal data to professional advisers (lawyers, accountants) where necessary, to a successor entity in the event of a merger or acquisition, and to authorities where we are legally required to do so. We will not hand over your correspondence merely because someone asks.
8. International transfers
Our providers operate globally, so data may be processed outside the country you are in — including in the United States. Where personal data is transferred out of the UK or EEA, the transfer is covered by the European Commission’s Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement where relevant), which are incorporated into the data processing terms of the providers listed above. You may request further information about these safeguards using the contact details below.
9. Cookies and similar technologies
We set no cookies of our own. This site uses no analytics cookies, no advertising cookies and no preference cookies, which is why you were not shown a consent banner: there is nothing to consent to.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
__cf_bm | Cloudflare | Strictly necessary. Distinguishes automated traffic from human visitors to protect the site. Not used to track individuals across websites. | About 30 minutes |
Cloudflare may set further strictly necessary security cookies if the site comes under attack. We use no local storage, no session storage and no device fingerprinting.
10. How long we keep things
| What | How long |
|---|---|
| Enquiries that do not lead anywhere | Up to 24 months, then deleted |
| Correspondence with customers and prospects in an active relationship | For the duration of the relationship, then as long as needed for business records and any legal or tax obligation |
| Server and security logs | Cloudflare’s standard retention, which is short — days rather than months |
If you ask us to delete your correspondence sooner, we will, unless we are legally required to keep it or need it to establish, exercise or defend a legal claim.
11. Security
We keep the attack surface small on purpose. The site is static: there is no database of visitors, no login, no admin panel and no user-generated content. Specific measures include:
- HTTPS enforced everywhere, with HTTP Strict Transport Security.
- Security response headers, including
X-Content-Type-Options,X-Frame-Optionsand a strict referrer policy. - Contact form input is validated and length-limited, with control characters stripped to prevent header injection, and a honeypot field to absorb automated spam.
- Credentials for sending mail are held as encrypted environment secrets, never in source code or in the browser.
- Access to the systems that hold enquiries is limited to people who need it.
No system is perfectly secure. If you believe you have found a vulnerability in this website, please tell us at cloud@boringdollars.xyz — we will respond, and we will not threaten you for reporting it in good faith.
12. Your rights
12.1 If you are in the UK or the EEA
You have the right to be informed; to access a copy of your personal data; to have inaccurate data corrected; to have data erased; to restrict processing; to data portability; and to object to processing based on legitimate interests. You also have the right to lodge a complaint with your supervisory authority — in the UK, the Information Commissioner’s Office; in the EEA, your national data protection authority. We would rather you came to us first, but it is your right either way.
12.2 If you are in India
Under the Digital Personal Data Protection Act 2023 you may access and correct your personal data, request erasure, nominate another person to exercise your rights in the event of death or incapacity, and raise a grievance with us. Grievances go to cloud@boringdollars.xyz and are handled promptly.
12.3 If you are in California
Under the CCPA as amended by the CPRA you may request disclosure of the categories and specific pieces of personal information we have collected, request deletion or correction, and know whether we sell or share personal information. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. We will not discriminate against you for exercising any right.
12.4 How to exercise your rights
Email cloud@boringdollars.xyz and say what you want. We will respond within one month (and tell you if we need longer, which is rare given how little data there is). There is no charge, and we will not make it difficult. We may ask you to confirm your identity, but only where necessary and proportionate.
13. Children
This website is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, tell us and we will delete it.
14. Automated decision-making and AI
We make no automated decisions producing legal or similarly significant effects about visitors to this website, and we do not profile you.
We do not use personal data collected through this website to train machine learning models — neither our own nor anyone else’s. We build autonomous software for a living, which is precisely why we are explicit about this.
Separately, and in the other direction: we deliberately permit AI crawlers and agents to read this website’s public content. That is about our published pages, not about your personal data.
15. Our products are governed separately
Prago and Marking are upcoming offerings. When either is made available, its own privacy documentation will cover the data that service processes; this policy will continue to govern boringdollars.xyz only.
16. Third-party links
This site links to third-party websites, including our own product sites. We do not control them and are not responsible for their content or their privacy practices. Read their policies.
17. Changes to this policy
If how this site handles data changes, we will update this page and revise the version number and effective date at the top. Material changes will be summarised here for a reasonable period. The version you are reading is always the current one.
18. Contact and complaints
Anything at all about privacy — questions, requests, or complaints: cloud@boringdollars.xyz.
If you are not satisfied with how we handled your request, you may complain to your data protection regulator. We would appreciate the chance to put it right first.