Privacy Policy
1. Controller
The controller responsible for data processing on this website is:
[Your Name or Company][Your Address][Your Contact Email]
2. WorkOS (Authentication & SSO)
We use WorkOS (WorkOS, Inc., Palo Alto, CA, USA) to enable authentication and Single Sign-On (SSO). Processed data may include:
- login credentials or tokens from identity providers
- sign-in metadata (time, provider, device)
- identifiers such as email, name, or organizational IDs
Legal basis: Art. 6 (1) lit. b GDPR (contract) or Art. 6 (1) lit. f GDPR (legitimate interest in secure login).
Data may be transferred to the USA under the EU–US Data Privacy Framework or SCCs.
Details: https://workos.com/privacy
3. Convex (Backend & Database)
We use Convex (Convex, Inc., Palo Alto, CA, USA) as backend and database service. That includes processing of:
- user IDs and account information
- application‑specific data (entries, records, user actions)
- request metadata (timestamps, API usage)
Legal basis: Art. 6 (1) lit. b GDPR (contract) or Art. 6 (1) lit. f GDPR (service operation/security).
Data may be transferred to the USA under the EU–US Data Privacy Framework or SCCs.
4. Cloudflare (Domain, CDN, Security)
We use Cloudflare (Cloudflare, Inc., San Francisco, CA, USA) to provide DNS, CDN, and security (e.g. DDoS protection, WAF). Cloudflare processes:
- IP address and connection metadata
- requests for resources (pages, assets)
- security logs (traffic patterns, firewall logs)
Legal basis: Art. 6 (1) lit. f GDPR (interest in secure, fast, reliable website).
Global processing incl. USA under Privacy Framework or SCCs.
5. Cloudflare R2 (Storage)
We use Cloudflare R2 to store the files you upload, together with their thumbnails, smaller display versions and video previews. They are stored in R2's EU jurisdiction, so they stay within the European Union.
- files/content uploaded by users
- metadata (timestamps, object identifiers)
- request logs when files are accessed
Legal basis: Art. 6 (1) lit. b GDPR (contract) or Art. 6 (1) lit. f GDPR (secure storage/delivery).
Request data (e.g. when files are accessed) may be processed globally under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.
6. Hetzner (Thumbnails & Previews)
To show thumbnails and previews of images, videos and PDFs, we process your uploads on a server we rent from Hetzner (Hetzner Online GmbH, Gunzenhausen, Germany) in its data center in Nuremberg, Germany. The server reads a file from our storage (see Cloudflare R2), creates its thumbnail, a smaller preview of large images, and reads its dimensions and, for videos, its duration. The results are stored with your file; the file itself is only held on the server temporarily while it is processed.
- images, videos and PDFs you upload
- technical identifiers (object keys of the file and its thumbnails, job identifiers) and timestamps
- server logs of these jobs, without file contents or names
Legal basis: Art. 6 (1) lit. b GDPR (contract). Processing takes place in Germany.
7. OpenAI (Content Summarization/Analysis)
We offer optional features that use OpenAI services (OpenAI L.L.C., San Francisco, CA, USA). If you actively choose to use these features, the content you provide (e.g. text or files) is transmitted to OpenAI servers for processing. No data is sent to OpenAI unless you explicitly use these features.
Data processed may include:
- text or documents you provide when requesting a summary
- metadata (request time, file identifiers)
Legal basis:
- For core use cases: Art. 6 (1) lit. b GDPR (performance of a requested service).
- As the feature is optional, we additionally rely on your explicit action/consent under Art. 6 (1) lit. a GDPR when you trigger the function.
Processing takes place in the USA. Safeguards: EU–US Data Privacy Framework (if certified) or EU Standard Contractual Clauses.
8. Your Rights
Under the GDPR, you have the right to request access to the personal data we process, as well as the rights to rectification, erasure, restriction, portability, and objection. You also have the right to lodge a complaint with a supervisory authority.