Legitimate Interests Assessment
UK GDPR Article 6(1)(f) compliance — explaining why SnapVector processes pseudonymized technical identifiers to maintain a secure hosting environment.
Data minimization: Our server only processes usernames, hashed passwords, and hashed IP addresses. No real-world identities are stored unless provided voluntarily for support.
Step 1 — The Purpose Test
SnapVector has a legitimate interest in processing technical data for:
- Rate limiting: Preventing server exhaustion by monitoring request frequency per IP.
- Security logging: Identifying and blocking malicious actors from accessing the platform.
- Session management: Linking active sessions to the correct user to prevent session hijacking.
- Account integrity: Recording login session data to help users identify unauthorized access.
Step 2 — The Necessity Test
Yes, processing is essential. To operate a public media hosting service, we must be able to defend against DDoS attacks and credential stuffing.
- Advanced hashing: We do not store plain-text IP addresses. We use SHA-256 with a server-side salt, providing a high level of pseudonymization that is computationally difficult to reverse without the salt.
- Automatic lifecycle: Images are purged on the 1st of every third month, ensuring we do not store user-contributed data indefinitely.
Step 3 — The Balancing Test
The impact on user privacy is negligible compared to the security benefits provided:
- Immediate deletion: Upon account deletion, the user record, password hash, and all associated IP metadata are irreversibly removed.
- Reasonable expectation: Users expect their hosted files to be protected from unauthorized access and abuse.
- No tracking: This data is not used for marketing, profiling, or third-party sharing of any kind.
Based on the three-part test above, we conclude that processing hashed IP data is strictly necessary for the security of SnapVector. By prioritizing pseudonymization and automatic data lifecycles, the processing remains proportionate and does not infringe upon the fundamental privacy rights of our users.