Grafikbuddy
DEEN
Log instart for free

Privacy policy

1. Controller

The controller is Grafikbuddy – full details can be found in the legal notice.
Email: info@grafikbuddy.de

2. Which data we process and why

  • Visiting the website: When you open the site, our hosting provider processes technically necessary data (IP address, time, page visited, browser) in server logs in order to deliver the site securely (Art. 6(1)(f) GDPR).
  • Account & app: For your account we store your email address, name and the content you create (brands, designs, files) to perform the contract (Art. 6(1)(b) GDPR). If you register with a password, it is stored only in encrypted (hashed) form – no one can read it.
  • Sign-in with Google, Apple or Microsoft: If you choose one of these providers, the site redirects you there. After you confirm, we only receive your name, email address and, if applicable, your profile picture – we never see your password. The provider learns that you are signing in to us. Using this option is voluntary; alternatively you can sign in via an email link (Art. 6(1)(b) GDPR).
  • Brand check: When you check a website, we fetch its public homepage. We only store the result, not the page.
  • Payments: Paid subscriptions are processed via Stripe. You enter payment details directly with Stripe; we only receive status and invoice information (Art. 6(1)(b) GDPR).
  • Emails: We send sign-up, confirmation and service emails as well as the newsletter through our own mailbox at our email provider.
  • AI features: When you use AI features, the content required for them is transmitted to Anthropic and is not used there for training.
  • Print orders: If you order through the app from a partner print shop, we transmit your print file and contact and delivery details to that shop (Art. 6(1)(b) GDPR).
  • Shared links: Content you share through link-in-bio, business card, brand guide or feedback links is visible to everyone with the link. Digital business cards can be found by search engines; you can take them offline at any time.

3. Newsletter

We send the newsletter only with your consent (Art. 6(1)(a) GDPR) using a double opt-in procedure. We store the time of sign-up and confirmation as proof. You can unsubscribe at any time via the link in every email.

4. Cookies & fonts

We only set technically necessary cookies (e.g. for login). There is no cross-site tracking and no advertising cookies. We store your choice in the cookie notice only in your browser (local storage); you can change it at any time via "Cookie settings" in the website footer.

Visitor statistics: To understand which pages are read, we count page views with our own cookie-free statistics on our server. We record the page visited, the referring page (e.g. a search engine), the device type (based on window width), the country and the time. To count visits, we form a check value from the IP address, a browser identifier and a daily changing key; it cannot be reversed. We do not store the IP address itself. We only see aggregated numbers; visitors are not recognisable across several days. The legal basis is our legitimate interest in a user-friendly website (Art. 6(1)(f) GDPR); we delete the numbers after 13 months at the latest.

Fonts (Google Fonts) are delivered from our own server – your browser does not connect to Google.

Reporting ideas & bugs: If you report something in the app via "Idea or bug?", we store your text, your name, your email address, your workspace and – unless you deselect it – the page you were on and your browser. We use this only to fix bugs, improve the app and reply to you (Art. 6(1)(b) and (f) GDPR).

Videos in the blog: Some blog posts contain videos from YouTube (Google Ireland Ltd.) or Vimeo (Vimeo.com Inc., USA). They are only loaded when you click "Play video" or allow external videos in the cookie settings – until then no data is transmitted. With the click, your browser connects to the provider, which among other things receives your IP address. We embed YouTube in extended privacy mode (youtube-nocookie.com). The legal basis is your consent given by the click or in the cookie settings (Art. 6(1)(a) GDPR); you can withdraw it there at any time.

5. Service providers (processors)

  • Hosting: Vercel Inc., USA (server region Frankfurt; EU standard contractual clauses / EU-US Data Privacy Framework)
  • Database, login & file storage: Supabase Inc., USA (EU standard contractual clauses / EU-US Data Privacy Framework)
  • Payments: Stripe Payments Europe Ltd., Ireland
  • AI: Anthropic PBC, USA (EU standard contractual clauses / EU-US Data Privacy Framework)
  • Domain & email mailbox: ALL-INKL.COM – Neue Medien Münnich, Friedersdorf, Germany
  • Sign-in providers (only if you choose them): Google Ireland Ltd.; Apple Distribution International Ltd.; Microsoft Ireland Operations Ltd.

We have data processing agreements with all service providers. For transfers to the USA we rely on the EU-US Data Privacy Framework or standard contractual clauses.

6. Storage period

We store data for as long as your account exists. Invoice data is kept for up to 10 years because of statutory obligations.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent at any time. You can also lodge a complaint with a data protection supervisory authority.

To exercise your rights, simply write to info@grafikbuddy.de.