Privacy policy

1. Controller

[Company name, address, e-mail] (see legal notice).

2. Which data we process

Account data (name, e-mail address, password as a hash), company data that you enter, the contents of your product passports, log data (who changed what and when), technical access data (IP address for a short time to prevent abuse).

When public product passports are accessed we do not store any personal data of visitors except, for a short time, the IP address to limit requests (rate limit). No tracking or advertising cookies are set.

3. Purposes and legal bases

Provision of the service (Art. 6(1)(b) GDPR), security and prevention of abuse (Art. 6(1)(f) GDPR), compliance with statutory retention obligations (Art. 6(1)(c) GDPR).

4. Cookies

We only use technically necessary cookies: an encrypted session cookie for signing in and a cookie that stores your chosen language.

5. Recipients and processors

Hosting and database: [provider, location EU] File storage: [provider, location EU] E-mail delivery: [provider] Payment processing: Stripe Payments Europe Ltd., Ireland – only for paid plans AI extraction of documents (optional, only if you use the function): Anthropic PBC – documents are transmitted for analysis and not stored by us. [Add legal basis for third-country transfer]

6. Retention period

Account data until the account is deleted. Published product passports until you delete the company. Invoice data according to statutory retention periods.

7. Your rights

Access, rectification, erasure, restriction, data portability and objection. You can carry out export and deletion yourself in the app. You have the right to lodge a complaint with a data protection supervisory authority.