Ask HN: GDPR for solo founder
I run a small SaaS from outside the EU but with few clients there. I collect names and some physical addresses. It’s nearly impossible to know what I should do for GDPR:
* is a message about using cookies enough?
* do I need a privacy policy
* ...
An open Ask HN community consultation from 2018 where @video-host convened hundreds of developers and bootstrappers to share real experiences, hard numbers, and tactics.
Core Principles for Independent Builders:
Participants share raw revenue figures, churn rates, and stack decisions that corporate PR never publishes.
Recurring answers reveal that distribution, not coding skill, is almost universally the rate-limiting step in developer businesses.
Practical recommendations on bookkeeping, payment gateways (Stripe vs Paddle), and freelance-to-product transitions.
Community Debate Themes:
Hundreds of active indie hackers contributed case studies, pricing heuristics, and pitfalls to avoid when moonlighting on side projects.
CATEGORY Ask HN Roundtables →
HISTORICAL ERA Cloud & Mobile Era (2014–2019)
COMMUNITY SCORE 5 points
TOTAL DISCUSSIONS 2 comments
I don't know either, and this is not legal advice. The regulations[0] are actually pretty clearly written, and not actually that long. Make yourself a good coffee, and read them in a few sittings, thinking about your specific context, and taking notes.
My understanding, based on my reading and your comment, is as follows:
* You are retaining personal information - this requires consent.
* If you do something with the information you have, it requires consent.
* If you don't do anything with the information, and you are not legally obliged to retain it, you should delete it.
* When an individual asks, you must be able to tell them everything you hold on them, and where you got consent.
* When an individual asks you to delete their data, you must be able to do it within a short time-span (unless legally obliged to retain it).
* Consent can be implicit - for example if someone signs up for a service.
* You absolutely need a statement saying what information you hold, and what you do with it.
* If you can't say when, where, and how someone gave consent, you should seek to obtain explicit consent with an "opt-in" email.
Some of the above will probably be wrong, but I don't think anything is very wrong.
[0] https://gdpr-info.eu/ ↗
Stop accepting EU currencies and don’t offer any locally translated content. GDPR doesn’t actually apply to all businesses worldwide. It applies to those that are directly targeted to EU residents. Some of the things that can make you subject to the GDPR include having a European domain extension (eg. .de or .co.uk), offering content that is translated to languages commonly spoken only in the EU, and accepting payments or listing prices in EU currencies.
If you are based outside the EU and do none of these things, GDPR generally does not apply to your business.