Privacy Policy

Privacy at a Glance

General Notes

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Detailed information on data protection can be found in our privacy policy listed below.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find the operator's contact details in the section "Information on the Data Controller" in this privacy policy.

How do we collect your data?

Your data is collected partly because you provide it to us. This may, for example, include data that you enter into a contact form.

Other data is collected automatically or with your consent when you visit the website by our IT systems. This is mainly technical data (e.g. internet browser, operating system or time of page request). The collection of this data takes place automatically as soon as you enter this website.

What do we use your data for?

Some of the data is collected in order to ensure error-free provision of the website and to protect it against abuse.

What rights do you have regarding your data?

You have the right to obtain information free of charge at any time about the origin, recipient and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right to request the restriction of the processing of your personal data under certain circumstances. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

Data Controller

The data controller responsible for the processing of personal data on this website is:

The data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

Hosting

We operate our website on our own servers, hosted by the following infrastructure provider:

Hetzner Online GmbH

Infrastructure provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen

We have full control over the servers and the data stored on them. The infrastructure provider only supplies the hardware and the network connection.

When you visit our website, information is automatically saved on our servers in server log files, which your browser transmits to us.

Details on the infrastructure provider's privacy policy: https://www.hetzner.com/legal/privacy-policy/

A data processing agreement pursuant to Art. 28 GDPR exists with the infrastructure provider.

The use of the server infrastructure is based on Art. 6 (1) (f) GDPR. We have a legitimate interest in a reliable and secure provision of our website.

Server Log Files

Our web server automatically saves information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and version
• Operating system used
• Referrer URL
• address requested, status code and volume of data transferred; access tokens and email addresses in the address are replaced by a placeholder before storage
• Time of the server request
• IP address, truncated before storage (without the last octet for IPv4, without the trailing part for IPv6); stored for a maximum of 90 days for abuse prevention on the basis of Art. 6 (1) (f) GDPR

This data is not merged with other data sources.

Server log files are stored for a maximum of 90 days and then automatically deleted, unless a specific security incident requires longer retention. This period serves security, abuse prevention and error analysis: attack patterns, cases of abuse and errors are often only noticed weeks after the request in question.

The collection of this data is based on Art. 6 (1) (f) GDPR. We have a legitimate interest in the technically error-free presentation and optimisation of our website – for this purpose, the server log files must be collected.

SSL/TLS Encryption

This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the site operator. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Cookies

Our website exclusively uses technically necessary cookies. These cookies are required for the operation of the website and enable basic functions.

Session Cookie

The session cookie is used exclusively to maintain your session and does not contain any personal data. It is valid for a maximum of 9 hours and becomes invalid afterwards.

The storage of this cookie is based on Art. 6 (1) (f) GDPR and Article 99 (5) of the Cypriot Regulation of Electronic Communications and Postal Services Law (Law 112(I)/2004), because the cookie is strictly necessary for the service you requested. We have a legitimate interest in the technically error-free provision of our website.

You can set your browser to inform you about the setting of cookies or to generally reject cookies. If cookies are disabled, the functionality of this website may be limited.

Login cookies

When you log in, we additionally set two cookies containing a login token and its signature so that your login persists beyond the session. They are valid for 30 days and are deleted when you log out. They too are strictly necessary for the service you requested; the same legal basis applies as for the session cookie.

Local storage in your browser

In addition to cookies, the website keeps a few entries in the local storage of your browser (localStorage): the email address you last logged in with using a passkey, so that the login form can prefill it, and your choice of colour scheme. These entries are not transmitted to us and remain stored until you delete the website data in your browser.

After every login, the browser additionally stores a login token with its signature and expiry date in local storage so that the login can be renewed. The token is valid for 30 days. This storage is strictly necessary for the service you requested and does not require consent.

This storage is based on Art. 6 (1) (f) GDPR and Article 99 (5) of the Cypriot Regulation of Electronic Communications and Postal Services Law (Law 112(I)/2004), because the entries are strictly necessary for the login you use and the display you have chosen. We have a legitimate interest in making it easier for you to log in and in showing the website the way you have set it up.

Web Analytics with Matomo

This website uses Matomo, an open source software for the statistical evaluation of visitor access.

The evaluation also covers your visits to the logged-in area.

We run Matomo on our own server infrastructure. The collected data stays with us and is not passed on to the software vendor or to any other third party.

Data Collected

The following data is recorded when a page is called up:

• truncated IP address
• page requested and page title
• previously visited page (referrer)
• browser type, operating system and screen resolution
• time and duration of the page view

No Cookies, No Recognition

Our Matomo installation is configured on the server side so that no cookies are set and no information is stored on or read from your device. No persistent visitor ID is assigned, so you are not recognised across several visits. Consent under Section 25 (1) TDDDG is therefore not required.

Your IP address is truncated by two bytes before it is stored (IP anonymisation). We are therefore unable to link the evaluations to you personally.

Matomo deletes the raw data of individual visits after 180 days; after that, only aggregated evaluations without reference to individual visits remain.

Purpose of Processing

The evaluation serves to measure reach and to design and continuously improve our website in line with demand. No profiling takes place, the data is not merged with other sources and it is not used for advertising purposes.

Legal Basis

Processing takes place on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in the anonymous evaluation of user behaviour in order to improve our services.

Right to Object

You may object to this processing at any time with effect for the future (Art. 21 (1) GDPR). An informal message to the email address given in the section on the responsible entity is sufficient.

Processing in the Zero-Knowledge Secret Exchange

When you share or request a secret via this service, our server only processes encrypted data. The key required for decryption is transmitted exclusively in the URL fragment (the part after the #) and never sent to our server. For this reason, we are technically unable to read the contents of your secret (zero-knowledge architecture).

No tracking

No advertising cookies, no tracking pixels. Reach measurement runs without cookies and with a truncated IP address, as described in the web analytics section. Server logs are used only for security and operation.

Categories of Data Processed

We process the following data:

• The encrypted content (ciphertext) of your secret. Without the key contained in the URL fragment, we cannot decrypt the content.
• A randomly generated token (22 characters) that identifies the secret.
• For secret requests: the public key of the recipient (X25519). The corresponding private key remains in the recipient's browser.
• Timestamps: creation, expiry and, where applicable, fulfilment and retrieval.
• A hashed form (HMAC-SHA256) of your IP address kept in cache to limit abuse (retention 60 seconds, automatic deletion afterwards).

Retention Period

Encrypted content is irreversibly and atomically deleted from our database when it is retrieved for the first time (hard delete). If a secret is not retrieved, we delete it at the latest after the validity period you have chosen (a maximum of 7 days, or 30 days on the Pro and Business plans). Status metadata (no ciphertext, only the timestamps of creation, expiry and, where applicable, retrieval) is retained for up to 24 hours after expiry so that the status of a secret remains verifiable; after that, this metadata is also deleted.

Legal Basis

The legal basis for the processing is Art. 6 (1) (f) GDPR. Our legitimate interest lies in providing the secret exchange in a privacy-preserving zero-knowledge form.

Allocation of roles

When the service is used without a user account, we are the controller for the processing described.

If you use the service with a user account for a company or organisation and have concluded the data processing agreement, we process the transaction data (ciphertext, metadata, notes, activity log and the assignment to the account) as a processor on behalf of the account holder. We remain the controller for account data, server access logs and billing. Go to the data processing agreement

If you conclude the data processing agreement in your user account, we store the account, the company or organisation name provided, the version concluded and the time as proof of the conclusion of the contract. The legal basis is Art. 6 (1) (b) GDPR. This information is deleted together with the user account.

Your Rights in this Context

We deliberately do not attribute transactions created without a user account to any person, and the stored ciphertext has no personal reference we can recognise. Rights to information, rectification and erasure therefore cannot be exercised in practice for such transactions, because we cannot attribute them to an individual user. You can irreversibly delete a secret at any time by retrieving it yourself via the recipient link (hard delete on first read).

User account, registration and contracts

When you create a user account, we process your email address, your login details, the time of registration, the account status, the plan booked and your account settings. If you set up an organisation and invite members, we immediately create a user account for every invited email address and store the membership and the role in the organisation.

When you conclude the Terms and Conditions or the data processing agreement, we store the contracting party, the version concluded, the language version, the time and the declarations made with their wording, and we send the full contract text to the email address of the account. For accounts that existed before conclusion in the account was introduced, we recorded the version of the Terms and Conditions in force at the time and stored the origin of that entry.

For the transactions of your account we keep an activity log with the type of event, time, account identifier and transaction identifier, without content and without access tokens; we delete the entries after 90 days. You can export your notes, request templates and organisation data from your account as a JSON file at any time.

To protect individual account functions against abuse, such as requesting additional seats and deleting the account, we process a hash of your IP address derived with a secret key (HMAC-SHA-256), which is kept in the cache for at most 60 minutes.

If you delete your user account, we immediately delete the assignment of your transactions to the account, your notes, request templates, API keys, contract conclusions, your organisation with its memberships, the activity log, the role assignment and the account settings; the account itself is anonymised. User accounts created with an invitation for members of your organisation remain in place as those persons' own accounts, even if they were never activated. Content not yet retrieved remains as ciphertext we cannot read until it expires, and entries in the mail log remain until the end of their period of 90 days. Your customer record with the payment service provider and the invoices are retained for the duration of the statutory retention obligations.

The processing is based on Art. 6 (1) (b) GDPR where it is necessary for the user contract, and on Art. 6 (1) (f) GDPR for the proof of concluded contracts and for abuse prevention.

Email Delivery

For the sending of emails (e.g. confirmations, notifications) we use our own mail servers.

We log every email sent with the recipient address, subject, time, delivery status and text content so that we can trace delivery problems and prove that the email was sent. We delete these entries after 90 days.

The processing is based on Art. 6 (1) (f) GDPR. We have a legitimate interest in reliable email delivery.

Customer and Invoicing Data

In order to initiate, perform and invoice contracts, we process the master data of our customers and of the contact persons named by them.

Categories of Data Processed

• company name as well as first and last name of the contact persons
• address and billing address
• email address and telephone number
• VAT identification number and tax number
• quotation, contract and service data
• invoicing, payment and bank data

Purposes of Processing

We process this data in order to prepare quotations, to conclude and perform contracts, to invoice services and to handle payments. It also serves to fulfil our obligations under commercial and tax law, in particular proper bookkeeping and accounting.

Legal Bases

Processing for the initiation and performance of a contract takes place on the basis of Art. 6 (1) (b) GDPR.

Invoices and accounting records are retained on the basis of Art. 6 (1) (c) GDPR in conjunction with the retention obligations under commercial and tax law to which we are subject.

Retention Period

We retain invoices, accounting records and the associated master data for the duration of the statutory retention periods under commercial and tax law. We cannot delete them before those periods expire.

The retention period applicable to us is up to 10 years, counted from the end of the financial year in which the respective record was created.

Data not subject to a retention obligation is deleted as soon as the purpose of its processing no longer applies and no outstanding claims remain.

Recipients

Data is only passed on to third parties where this is necessary for the performance of the contract or where we are legally obliged to do so.

Payment processing

We bill paid plans through the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

In this context, your name, email address, billing address, VAT identification number where applicable, payment data such as card details or bank details, and information on plan, term and payment status are processed. You enter card and bank details on the payment page of the payment service provider; they do not reach our servers.

Stripe Payments Europe, Ltd. processes this data for payment processing, fraud prevention and the fulfilment of its own legal obligations as a controller in its own right. We receive the information required to perform the contract, such as the payment status and the invoices.

The legal basis is Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (c) GDPR for the statutory retention obligations.

The payment service provider may also process data in the USA. The transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework, under which its US parent company is certified, and in the alternative on the standard contractual clauses of the European Commission.

Privacy information of the payment service provider: https://stripe.com/privacy

Processing for Business-to-Business Direct Outreach by Email

We contact companies and organisations by email as part of business-to-business direct marketing and process business contact details obtained from publicly accessible sources for that purpose. In addition, we maintain a suppression list in which we record objections to such outreach so that we can honour them permanently and across all channels.

Categories of Data Processed

We process the following data for this purpose:

• The email address of the business contact.
• The domain of the email address, so that an objection can apply to the entire organisation upon request.
• The source of the entry, that is whether the objection reached us via the unsubscribe link, as a reply by email, or by manual entry.
• Timestamps of when the entry was recorded and last modified.

Purpose

The sole purpose of processing data in the suppression list is to honour your objection under Art. 21 (3) GDPR, that is to ensure that you receive no further direct marketing from us. The data held in the suppression list is not used for any other purpose, in particular not for advertising, profiling or analytics.

Legal Basis

The legal basis for maintaining the suppression list is Art. 6 (1) (c) GDPR in conjunction with Art. 21 (3) GDPR, that is our legal obligation to honour the objection. The legal basis for the direct outreach itself is Art. 6 (1) (f) GDPR; our legitimate interest lies in direct marketing addressed to business contacts.

Retention Period

Entries in the suppression list are stored indefinitely and exclusively for the purpose of permanently not contacting the address or domain concerned again. Deleting an entry would remove the effect of the objection and make renewed contact possible; indefinite storage is therefore the less intrusive option for you compared with erasure.

Objection and Data Subject Rights

You may object to the processing of your address for direct marketing purposes at any time, informally by email to the address stated in the imprint or via the unsubscribe link contained in every message we send. After your objection, we process your address only within the suppression list. At your express request we will also delete the suppression list entry; in that case we can no longer technically rule out renewed contact.

Your Rights

Right of Access

You have the right to obtain information free of charge at any time about the personal data stored about you, its origin and recipients, and the purpose of the data processing (Art. 15 GDPR).

Right to Rectification

You have the right to request the correction of inaccurate personal data (Art. 16 GDPR).

Right to Restriction of Processing

You have the right under certain circumstances to request the restriction of the processing of your personal data (Art. 18 GDPR).

Right to Erasure

You have the right to request the deletion of your personal data, unless statutory retention obligations conflict with this (Art. 17 GDPR).

Right to Data Portability

You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format (Art. 20 GDPR).

Right to Object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 (1) (e) or (f) GDPR. You may also object at any time, without giving reasons, to the processing of your data for direct marketing purposes (Art. 21 GDPR).

Right to Lodge a Complaint with the Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data (Art. 77 GDPR).

In our case (registered office in the Republic of Cyprus), the competent supervisory authority is:
Office of the Commissioner for Personal Data Protection
Iasonos 1, 1082 Nicosia, Cyprus
www.dataprotection.gov.cy

Automated Decision-Making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place on this website.