Privacy policy
We take the protection of your personal data seriously. This policy explains what data we process when you visit this website, for what purpose, on what legal basis and what rights you have.
Controller
The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is the provider named in the imprint. For any data protection questions or to exercise your rights, you can contact us at any time using the contact details provided there.
To the imprintPrinciples of processing
We process personal data only in accordance with the GDPR and the German Federal Data Protection Act (BDSG). “Personal data” means any information relating to an identified or identifiable person. We only collect data required to operate the website and respond to your requests, and we do not disclose it without a legal basis.
Website access & server logs
When you access this website, data transmitted by your browser is processed automatically: IP address, date and time of access, page or file requested, HTTP status code, volume of data transferred, referrer URL as well as browser and operating system information. This data is technically required to deliver the site, ensure its stability and security and prevent misuse. The legal basis is our legitimate interest in stable and secure operation (Art. 6(1)(f) GDPR). This data is not merged with other data sources or shared for advertising purposes.
Hosting (Vercel)
This website is hosted by Vercel Inc. Vercel processes the data arising when the site is accessed (in particular server logs) on our behalf; hosting takes place in a data centre in Germany (EU). A data processing agreement (Art. 28 GDPR) is in place. Should processing nonetheless take place outside the EU in an individual case, we base the transfer on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework as appropriate safeguards (Art. 44 et seq. GDPR). The legal basis is Art. 6(1)(f) GDPR.
Reach measurement (Vercel Analytics & Speed Insights)
We use Vercel Analytics and Vercel Speed Insights to statistically analyse the usage and loading performance of the website and to improve it technically. According to the provider, these services operate cookielessly and in aggregate; no cross-site user profiles are created and no data enabling the recognition of individual persons is stored. The legal basis is our legitimate interest in a needs-based design and optimisation of the website (Art. 6(1)(f) GDPR). Where consent is required in an individual case, we obtain it before processing.
Contact form & email
If you contact us via the contact form or by email, we process the data you provide (e.g. name, email address and message) solely to handle and respond to your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to entering into or performing a contract, otherwise our legitimate interest in responding (Art. 6(1)(f) GDPR). The contact form is handled via an external form service provider that processes the data on our behalf; it is transmitted for that purpose only.
User account & app (Supabase)
For registration and sign-in in the product area we use Supabase (Supabase Inc.) as an authentication and database service. This involves processing the data required to create an account (e.g. email address and sign-in credentials) as well as the content you create in the product; data is stored in a region within the European Union. The legal basis is performance of a contract (Art. 6(1)(b) GDPR). A data processing agreement is in place.
AI features (Google Gemini)
For certain optional convenience features in the product area (e.g. suggestions) we use the Google Gemini API (Google LLC). Only the inputs necessary for the respective feature are transmitted; these are not used to train the provider's models. Processing may also take place outside the EU (including in the USA); we base the transfer on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework as appropriate safeguards (Art. 44 et seq. GDPR). The legal basis is our legitimate interest in efficient product use or performance of a contract (Art. 6(1)(f) or (b) GDPR).
Cookies & language setting
We only use technically necessary cookies, for which no consent is required. For your language selection we store a preference in the “NEXT_LOCALE” cookie so the site is shown in your chosen language. No tracking or profiling takes place as a result. The legal basis is Art. 6(1)(f) GDPR.
Storage period
We only process personal data for as long as necessary for the respective purpose or as required by statutory retention periods. Server logs are automatically deleted or anonymised after a short time; contact requests are kept until your matter has been fully resolved and no statutory retention obligations apply. Account data is stored for the duration of the usage relationship and deleted after it ends, unless a retention obligation applies.
Recipients & disclosure to third parties
Your data is only disclosed where required to perform a contract, where you have expressly consented, or where we are legally obliged or entitled to do so. The service providers named above (hosting, reach measurement, form provider, Supabase, Google) act as processors and are contractually bound to comply with the GDPR. Your data is not sold.
Your rights
As a data subject, you have the following rights. To exercise them, an informal message to the contact details in the imprint is sufficient:
- Access to the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate or incomplete data (Art. 16 GDPR)
- Erasure of your data, unless a retention obligation applies (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability in a common format (Art. 20 GDPR)
- Objection to processing based on legitimate interest (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
Right to lodge a complaint
Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data – for example with the authority of your habitual residence, place of work or the place of the alleged infringement.
Currency of this policy
We update this privacy policy whenever changes to our processing activities require it – for example when introducing new features or services. The version published on this page applies.