1. Controller
The controller responsible for data processing on this website is:
Julian Zerback
Lessingplatz 12
55118 Mainz
Email: [email protected]
The imprint at /imprint also applies.
2. Data Protection Officer
There is currently no statutory obligation to appoint a data protection officer.
3. Purposes, Data Categories, and Legal Bases
3.1 Provision of the Website
When accessing the website, technically necessary connection data (e.g. IP address, date/time, requested URL, user agent) is processed to deliver the platform and ensure system security.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
3.2 Account and Login (Google OAuth)
When you log in via Google, we process in particular your name, email address, Google ID, and profile picture to create and manage your user account.
Legal basis: Art. 6(1)(b) GDPR (contract / pre-contractual relationship).
3.3 Session Management and Login Status
For authentication, we use a technically necessary session cookie so that you remain logged in within the protected area after sign-in.
Legal bases: Art. 6(1)(b) GDPR and Section 25(2) No. 2 TDDDG (strictly necessary storage/access).
3.4 Upload, Analysis, and File Processing
When you upload files, we process file and metadata to perform the analysis, provide results, and, where applicable, provide corrected files.
Legal basis: Art. 6(1)(b) GDPR.
3.5 Billing and Payment Processing
For paid plans, we process billing-related data (e.g. customer identifiers, subscription status, transaction and invoice information) via the payment provider used.
Legal bases: Art. 6(1)(b) and Art. 6(1)(c) GDPR.
3.6 Communication and Support
When you contact us by email, we process the data you provide to handle your request.
Legal bases: Art. 6(1)(b) and Art. 6(1)(f) GDPR.
3.7 Web Analytics (Microsoft Clarity and Google Analytics)
If you grant consent via the cookie banner, we use web analytics tools (currently Microsoft Clarity and Google Analytics) to better understand website usage and improve our product and content.
Legal bases: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent). You can withdraw consent at any time with effect for the future.
4. Recipients and Processors
To provide our services, we use external service providers, especially in the following areas:
- Authentication (Google OAuth)
- Payment and subscription management (Stripe)
- Web analytics (Microsoft Clarity, Google Analytics)
- Hosting/operations and technical provision (netcup)
- Database backups and object storage (Cloudflare R2)
Where required, data processing agreements pursuant to Art. 28 GDPR are concluded with processors.
5. Third-Country Transfers
Personal data may also be processed in countries outside the EU/EEA (especially by US providers). In such cases, we ensure an adequate level of data protection through appropriate safeguards (e.g. EU standard contractual clauses), unless an adequacy decision applies.
6. Retention Period
- We store account data until account deletion or until the processing purpose no longer applies.
- Upload and result data is generally stored only for as long as necessary to provide the service (in this application typically short-term, currently designed for around 48 hours).
- We store billing and tax-relevant data in line with statutory retention obligations.
7. Your Rights
Under the GDPR, you have the following rights in particular:
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
8. Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work, or the place of the alleged infringement.
9. Obligation to Provide Data
Providing certain data is necessary for using the platform and/or concluding the contract. Without this data, certain features (in particular login, upload, and billing) cannot be provided.
10. Automated Decision-Making
Automated decision-making within the meaning of Art. 22 GDPR does not take place.
11. Changes to this Privacy Policy
We update this Privacy Policy where necessary due to legal, technical, or organizational changes. The version published on this page is the authoritative one.