Audience measurement and logs — balancing test

This document is the legitimate interests assessment (LIA) for processing we base on legitimate interests (Article 6(1)(f) GDPR) rather than on your consent. We publish it because, in that case, you deserve to see the reasoning and not just its conclusion. It covers two things:

• Part A: measuring audience on vodster.app with Cloudflare Web Analytics.
• Part B: our server's technical logs (api_logs) and analytics events recorded on the server (analytics_events).

It does not cover tools that store something on your device or read data from it (Google Analytics 4, PostHog, cookies). We use those only with your consent, and refusing is as easy as accepting. The privacy policy describes them.

Part A. Audience measurement of the website (Cloudflare Web Analytics)

A1. Is the interest legitimate?

We run a where-to-watch catalogue covering several thousand films and series. We need to know which pages people actually open and where they arrive from so we can build on what helps and retire what does not. Without it we develop the site blind and waste work on pages nobody reads.

An operator measuring audience on its own site is a recognised legitimate interest — Recital 47 GDPR states plainly that a controller's interest can ground processing where it matches the reasonable expectations of the data subject.

A2. Is the processing necessary?

We considered three alternatives and rejected each for a concrete reason:

• Consent-gated analytics (we already run it — GA4 and PostHog). It only measures people who click the banner. Search traffic usually leaves before it even decides about the banner, so this method systematically distorts the picture: it mostly shows already-engaged users and barely sees new ones. That is not a smaller sample of the same population — it is a different population.
• Server logs. They cannot tell a page view from a poster or stylesheet fetch, and they contain full IP addresses — processing more personal data, not less.
• Not measuring at all. That means running the site without knowing what works in it. We judged this disproportionate against the negligible intrusion described below.

Cloudflare Web Analytics is the least intrusive tool that answers the question: it stores nothing on your device and creates no identifier.

A3. The balancing test

What we collect

• the page URL and the address you came from (referrer)
• country — derived from your IP address, which is never stored
• page load timings (Core Web Vitals)
• device type, browser, screen resolution

What we never collect or do

• No cookies and no localStorage — nothing is left on your device
• No identifier — your separate visits are never joined together
• No fingerprinting and no cross-site tracking
• No profiling, behavioural advertising or automated decision-making
• No sale or sharing of this data with anyone

Outcome

We see aggregate statistics, not people. We could not work out who you are from this data, nor tie it to your VODster account, even if we wanted to. The intrusion into your privacy is close to zero, and the risk of secondary use does not exist because there is nothing to re-use.

On the other side stands a real need to run the service on facts. We conclude that the legitimate interest prevails, and that the processing sits within the reasonable expectations of a visitor — a site operator counting visits is common and expected practice.

A4. Retention and transfers

The data is held by Cloudflare, Inc. (USA) as a processor, in aggregate form, for about 6 months. That is materially shorter than the 13 months European data protection authorities cite as the ceiling for audience measurement. The transfer outside the EEA relies on standard contractual clauses and the EU–US Data Privacy Framework — details in our privacy policy.

A5. Your rights

You have the right to object to this processing on grounds relating to your particular situation (Article 21(1) GDPR). Write to support@vodster.app and briefly describe your situation; we will consider the objection and reply with reasons. Objection to direct marketing needs no reasons.

You can also block the measurement yourself, immediately: any script-blocking extension stops it without our involvement, and we use no techniques to work around such blockers.

Part B. Server logs and events recorded on the server

B1. Is the interest legitimate?

We must keep the service secure and reliable: detect attacks and abuse, enforce daily limits, find the causes of errors and measure response times. We also want to know which features users (including guests) use so we can build on those that help. Recitals 47 and 49 GDPR expressly recognise network and information security as a legitimate interest.

B2. What we record

Record	Content	Kept for
Request log (api_logs)	time, request method and path, response code, duration, account identifier (when you are signed in), IP address, browser or app (user agent), error message	30 days
Analytics events (analytics_events)	event name (for example use of a feature), session identifier, app version, platform, IP address, short technical parameters such as the length of a query instead of its text; account identifier only when you are signed in	90 days

The request log does not contain the text of your messages to the assistant, passwords or tokens. Both records disappear together with the account.

B3. Is the processing necessary?

• Consent. Security cannot depend on consent: someone abusing the service would simply refuse it. So we base security logs on legitimate interests.
• Logs without the IP address. They cannot tell abuse from ordinary traffic or link a series of requests to one source.
• Aggregate data only. It is not enough to find the cause of an error for one user.

B4. The balancing test

The intrusion is moderate: technical data that arises with every connection anyway, kept for a short time (30 and 90 days), without the text of queries, not used for advertising and not sold. A user of an online service reasonably expects the operator to record such data for security and diagnostics. We conclude that the legitimate interest prevails.

B5. Your rights

You have the right to object on grounds relating to your particular situation (Article 21(1) GDPR). Write to support@vodster.app. We will consider the objection and reply with reasons. For security logs we may decline it if we show compelling legitimate grounds (for example protection against abuse), and we will then explain why.

Review

We review this assessment whenever the tool or the scope of collected data changes, and in any case at least once a year. Should the balance ever tip the other way, we will move the measurement behind consent and say so here.