Privacy notice

Risk Radar (riskradar.dev) is run by Rost CAMP (KvK 95487530), Amsterdam, the Netherlands. We are the controller of the personal data described here. Questions or requests: info@rostcamp.com.

No cloud credentials, account IDs, ARNs, infrastructure code or uploads — ever. Round 2 is a list of checkboxes you tick yourself. We set no cookies.

• Your quiz answers: Round 1 picks, the services you tick, the four posture questions, and the scores we compute.
• Your country (derived from your IP address by our host; we keep the country code, not the address), and whether you used a phone or a computer.
• How you arrived: campaign tags in the link (utm_*) and the referring website, if any.

Your result is stored under a random ID. If you share its link, anyone with the link sees your scores and the services you ticked — nothing else.

After your result we ask for your role, approximate monthly cloud spend, whether auditors ask you for resilience evidence, and an optional free-text answer. All are optional. Free text is read only by us and is never shown to other users.

We store your email address only if you enter it and tick the consent box. The two options are:

• Private-beta scan: Email me once about the private-beta scan, with a link to book a 15-minute call. No newsletter.
• Retirement-wave alerts: Email me when the next AWS retirement wave is announced. One email per wave; unsubscribe any time.

With it we store when you consented and which version of this wording you saw, plus a one-way hash of your IP address that we use only to stop abuse (for example, scripted sign-ups). You can withdraw consent at any time by emailing us or replying to any email we send; we then delete your address.

We use PostHog (EU cloud, Frankfurt) to count anonymous events such as “finished Round 1”. It runs without cookies or local storage, keeps nothing between visits, records no sessions, and is configured to discard IP addresses. Your email and free-text answers are never sent to PostHog.

• Running the quiz, showing and sharing results, aggregate analytics and abuse prevention: our legitimate interest in operating and improving the service (GDPR art. 6(1)(f)).
• Email: your consent (art. 6(1)(a)).

• Vercel — hosting; our functions run in Frankfurt (fra1).
• Neon — the database, hosted in Frankfurt (AWS eu-central-1).
• PostHog — analytics, EU cloud.

These providers act on our instructions under data processing agreements. Where a provider is based outside the EU, transfers rely on the EU–US Data Privacy Framework or standard contractual clauses. We do not sell your data.

• Quiz sessions and optional answers: 24 months, then deleted or fully anonymised.
• Email addresses: until you withdraw consent, and no longer than 24 months after you signed up.

You can ask for access to, correction or deletion of your data, object to processing, or withdraw consent, by emailing info@rostcamp.com. Because we don't link quiz sessions to identities, tell us your result link if you want a session removed. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.