Privacy statement

Last updated 23 August 2026

The controller of your personal data is GIBS BV, Gevers Deynootweg 66, 2586 BN Den Haag, registered with the Dutch Chamber of Commerce under 28115544. Questions or requests: privacy@peoplerating.com.

1. What we collect

Your account: email address, an optional display name, the language you use and the languages you can read.
What you submit: the two versions of your work, your brief, and the files or links you upload. Images are re-encoded on upload, which strips the EXIF data — including the location where a photo was taken.
What you write as a reviewer: your answers, and how the response came about: seconds on the page, number of keystrokes, and how much text arrived by pasting.
Your turn balance: every change, with the reason for it.
Technical data: a hashed IP address (salted, so it cannot be turned back into an address), your browser's user agent string, and error logs.
Email records: which message went to which address and whether it arrived.

We do not use analytics, advertising or tracking cookies. There is exactly one cookie: the one that keeps you signed in.

2. Why, and on what legal basis

To run your account and the exchange — performance of our agreement with you.
To keep quality up and fraud out (effort signals, duplicate-account checks, pairing limits) — our legitimate interest in a service where the feedback is real.
To send transactional email (sign-in links, results, reminders) — performance of the agreement. We do not send marketing email.
To meet legal obligations — for example, accounting records once money is involved.

3. Sensitive information

We do not want special categories of personal data — health, religion, sexual orientation, political views, ethnicity, criminal record. People sometimes mention them unasked in free text, so we screen those fields automatically and flag matches for a person to look at and remove. If you spot something we missed, email us and it goes.

4. Who else sees it

The person who asked: your response, and the display name on your account. Through a friend link you can answer as a guest, and then the submitter sees no name at all.
Reviewers: your work and your brief. Not your email address, and not your name unless you put it in the work yourself.
Our email provider (Postmark) — to deliver messages. Data may be processed in the United States under the provider's standard contractual clauses.
Our host — the servers the service runs on, inside the EU.

We do not sell personal data and we do not share it for advertising. Ever.

5. How long we keep it

Responses and their answers: three years, then deleted automatically.
Sign-in links: 20 minutes, and the record of them at most two days.
Sessions: 30 days, or until you sign out.
Which submissions the queue offered you: 60 days.
Email and error logs: 90 days.
Your turn ledger: kept as long as your account exists, because it is the record that proves your balance is correct.

6. What you can do

From your account, without asking us:

Download everything we hold about you, as a single file.
Delete your profile. Your account is closed and your details are removed. The responses you wrote stay with the people who received them, detached from you — deleting them would take away feedback that someone else is relying on, and they no longer point at you.

You also have the right to correct your data, to object to processing based on our legitimate interest, and to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

7. Security

Traffic runs over HTTPS. The session cookie is httpOnly, so scripts cannot read it. Sign-in works without passwords, so there are none to leak. IP addresses are stored only as salted hashes. Access to the production database is limited to the people who maintain the service.

8. Children

The service is for people of 18 and over. We do not knowingly hold data on anyone younger; if we find out we do, we delete it.

9. Changes

If this statement changes materially, we email you before it takes effect.