1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data is:

Opergow GmbH

Leitenweg 22, 85139 Wettstetten, Deutschland

Email: contact@opergow.com

The controller in the data protection sense is the Opergow GmbH named above. As the person responsible for data protection matters, you can reach Mihail Doychev at contact@opergow.com. The full provider details, including the commercial register entry, can be found in the Legal Notice.

2. Categories of Personal Data

In accordance with the principle of data minimization, we process only the data necessary for operating the Platform. In particular, we do not collect telephone number, gender or date of birth. We process:

• Account/identity data: email address (in plain text and additionally as a hash for index search), internal user ID, display name (nickname), country (ISO-3166) and assigned home region.
• Password: stored exclusively as a cryptographic hash using a modern, deliberately compute-intensive method (individual salt + key stretching), never in plain text.
• Security/authentication data: with two-factor authentication enabled, the encrypted TOTP seed and hashed backup codes; hashes of "trusted browser" tokens; failed-attempt counters and lockout times; hashes of API keys.
• Profile data: optional fields you enter yourself, as well as an optional profile picture (stored encrypted).
• Country/region: for assigning the appropriate regional instance, for tax logic and for data residency.
• Organization/team data: organization name, plan/tier, members and their roles, and country of seat. Invitation email addresses are stored exclusively as a cryptographic hash, not in plain text.
• Billing data (only for a paid plan): legal name, billing address, VAT ID where applicable, customer type, payment service provider reference IDs, and invoices (buyer snapshot, line items, amounts in EUR). Evidence of order and use: time and version of the consent given at booking, IP address and browser identifier of the ordering device and — in the event of a chargeback — the login records (Section 3) and usage counters of your organisation existing at that time (number of flows executed, calls and operations per period); we use them solely to defend against unjustified chargebacks (Sections 10 and 12). We do not store full card or bank details directly; these are held exclusively by the payment service provider.
• Log and security data: for sign-in attempts, the IP address (stored in binary form), the derived country, browser and device information (user agent), success or failure, and the time; short-lived counting entries that protect against automated abuse; and the server and network logs generated while the platform is running (see Section 3).
• Product/content data: flow definitions you create (DNA), hierarchies, task content, your inputs/prompts, uploaded files, execution results (run outputs) and the API credentials of external services you store (always stored encrypted).

Necessity of the information (Art. 13(2)(e) GDPR): Providing an email address and password (or an SSO account) as well as a country is necessary for concluding the contract and creating the account — without this information no account can be created. All other information is voluntary.

Automated decision-making and profiling (Art. 13(2)(f) GDPR): Automated decision-making, including profiling within the meaning of Art. 22(1) and (4) GDPR, does not take place. The only things that run automatically are protective and contractual mechanisms: counters and lockouts after failed sign-ins, the throttling of mass requests (see Section 3), and the checking of the limits of the plan you have booked. We do not analyze your behavior in order to evaluate or predict personal aspects, and we do not build user profiles.

3. Security Logging, Abuse Protection and Server Logs

To protect your account from unauthorized access, we log login attempts. The following is recorded:

• IP address at the time of the login attempt (in binary form)
• country derived from the IP address
• browser and device information (user agent)
• timestamp and outcome (success/failure)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in account security and abuse prevention).

Retention period: 90 days. The five most recent entries for an account are excepted from this — they remain stored beyond the 90 days so that a sign-in from a previously unknown country is still recognisable as unusual even if you use the account only rarely. Entries with no account reference (a sign-in attempt using an unknown address) are deleted in full after 90 days. In addition, for each account we keep a compact list of the countries from which a sign-in has already succeeded (country, first and last sign-in, count); it exists until the account is deleted. When you delete your account, all of this data is removed.

Protection against automated abuse: In addition, we count requests to the sign-in, registration and recovery endpoints per source address in order to detect and slow down mass or automated requests (such as guessing passwords or email addresses and abusing the mail dispatch). For this purpose we briefly store a counting entry containing your IP address, the endpoint called and the time. The entries apply only to a short time window (usually 15 minutes to 1 hour) and are deleted automatically afterwards. They are neither merged with your account nor evaluated for any purpose other than this defense. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and availability of the platform).

Server and operational logs: Operating the platform generates technical log data — both in our applications and in the upstream network and load-balancing components of our cloud provider. This typically records the IP address, the time and duration of the request, the resource called and the response status, browser/device information (user agent) and technical error details; individual entries may relate to your account (e.g. an internal user or organization identifier). These logs serve solely for secure and stable operation, troubleshooting and defense against attacks; they are not evaluated for advertising or profiling purposes. They are retained in our cloud provider's logging service (Google Cloud Logging, EU region, processing under Art. 28 GDPR) for 30 days and are then deleted automatically. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operational security and error analysis).

Notice of your right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to any processing that we base on Art. 6(1)(f) GDPR. This covers the processing described in this section (security logging, abuse protection, server logs) as well as every other processing operation in this policy that relies on point (f); the full overview of purposes and legal bases is in Section 13. To exercise this right, contact contact@opergow.com.

4. Geo-IP / Region Assignment

On first access, the frontend queries a country-based assignment from the server once. This is based on a local MaxMind database (no call to an external service) and returns only a country code. The IP address is not permanently stored for this purpose.

Use: selecting the correct regional instance (currently the EU only), pre-filling the country field during registration, the notice about which region is currently available, and — for as long as you have not chosen a language yourself and your browser reports none of the supported languages — the preselection of the display language. You can override both country and language at any time; your own choice always takes precedence.

5. Sign-in via External Providers (SSO)

Optionally, you can sign in via external identity providers. Buttons only appear if the respective provider is configured. Sign-in via Google and GitHub is currently available; the other providers (Apple, Microsoft) will follow shortly:

• Google Sign-In (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)
• Sign in with Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
• Microsoft Login (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland)
• GitHub Login (GitHub B.V. / GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA)

With an SSO sign-in we receive from the provider only the email address needed to create the account, plus an opaque user ID generated by that provider. We receive no password and no contact list. The sign-in process is protected against manipulation by a CSRF nonce. There is exactly one account per email address: if an account was created with an email address and password, SSO sign-in is not possible for that same address — and, the other way round, neither is a sign-in through a different SSO provider. Such an attempt is rejected, and no second profile is created for that address. Switching the sign-in method later is currently not supported.

SSO profiles can be deleted within the Platform like regular profiles. At the external provider itself, you may additionally need to remove the app from your connected apps. Legal basis for SSO: your request for contract initiation/authentication, Art. 6(1)(b) GDPR.

6. Execution of Flows and External API/AI Services

At the core of the Platform is the visual orchestration of workflows ("flows") that can trigger calls to external application programming interfaces (APIs) — such as AI providers, API or compute services. The following distinction is central to understanding data protection.

Third-party services integrated by the user: External API/AI providers are called exclusively when you store them yourself as a permitted interface and enter your own credentials for them. In this case, your inputs/prompts and content flow to exactly the providers you have chosen. These providers are third-party services chosen by you and under your responsibility — this is not a platform-side transfer to a fixed AI provider. There is no platform-owned default AI provider. Please check the data protection terms of the providers you integrate yourself and, where necessary, conclude your own agreements with them.

Backend execution (worker_api): If you choose backend execution, our server calls the target API you have enabled. Your API credentials are decrypted in memory for the duration of that single call only. We take technical precautions so that they do not appear in logs, execution records or stored results; they are stripped from the record of the call before it is stored. The target URL comes exclusively from your own enablement (whitelist) and never freely from the flow content (protection against unauthorized redirection).

Device execution (host_client): Alternatively, flows can be executed on your own device via our host client. In this case, provider credentials for host tasks remain exclusively local on your machine (in the local client configuration or in your operating system's key store) and are at no time transmitted to the Platform — we have no access to them and can neither view nor recover them. The protection of this local data and of the host environment (device security, access controls, data backup) is your responsibility.

Device notifications: So that tasks on your device start without delay, the host client keeps an encrypted connection to our notification service in the EU region (eu.opergow.com). Over this connection the device only receives a notice that a task or a pre-check is waiting; this involves processing the identifier of the device, the identifier of your organization and the time. Task contents, results and credentials are not transmitted over this connection. The service does not store these notices and does not log individual connections; technical logs of the upstream network infrastructure are covered by the information on server and operational logs. The legal basis is Art. 6(1)(b) GDPR. If the connection is unavailable or switched off in the client configuration, the device checks for tasks at regular intervals as before.

Results, webhooks, file manager: Execution results (run outputs) and any responses returned asynchronously by third parties (via signed webhook callbacks) are stored assigned to your organization. You manage uploaded files and results in the file manager. Content is not deleted automatically but remains until you remove it.

Hub / public templates: If you publish a template, we store it in the hub together with your nickname, the name of your organization and a pseudonymous identifier of your account. Nickname and organization name are displayed next to the template, visible to all users of the platform. The hub is operated globally; a published template therefore leaves the hosting region of your organization. References to stored credentials and results of earlier executions are removed before publication. If you install a public template, the platform creates a copy in your organization and records the process in the hub (identifier of your organization, pseudonymous identifier of your account, time). The legal basis in each case is Art. 6(1)(b) GDPR (provision of the function you triggered). How long these data remain stored — including after an account deletion — is set out in Section 12.

7. Encryption and Data Security

Content data is encrypted at rest using AES (industry standard). A key per organization (per-org DEK) under a superordinate service key is used; the key is cryptographically bound to the organization ID. This applies in particular to files, invoice PDFs, profile pictures, stored API credentials and job data.

Every data query is limited to the respective organization; cross-organization decryption fails cryptographically. Access/authentication tokens are held exclusively as a hash in the database; issued tokens are RSA-signed. Data is kept in separate databases per tier level.

API credentials stored in the Platform (“Bring Your Own Key”) are at no point stored in plain text. They are held encrypted in line with the state of the art (AES-256-GCM) under a key that is separate for each organization and cryptographically bound to the organization ID, and they are decrypted in memory only for the duration of a call that you initiate. We take technical precautions so that they do not appear in logs, execution records or stored results; they are stripped from the record of the call before it is stored. The keys are managed separately from the encrypted data; without them the stored credentials cannot be decrypted even if someone gains unauthorized access to the database. Even so, no provider can guarantee absolute security of information technology systems.

8. Local Storage in the Browser

We use browser-local storage (localStorage / sessionStorage) for technically necessary functions. This data does not leave your device except when it is sent back to our servers as an authentication header.

The following are stored in localStorage (persists after closing the tab):

• display settings: the theme you picked (light/dark + theme ID), whether the sidebar is collapsed or expanded, whether technical detail values are shown, and the identifiers of the tasks for which you switched on the debug view in the Studio
• language setting
• acknowledgement markers for notice banners (cookies, region)
• most recently active organization (for re-entry into the tab)
• suppressed confirmation dialogs ("do not ask again" choice)

The following are stored in sessionStorage (deleted when the tab is closed):

• access token, token expiry time, granted scopes (for the current session)
• separate Hub token slot
• step-up token (short-lived, for security-relevant profile changes)
• per-organization authorization tokens (plan limits)
• the detected country code, the regional backend host and your organization's cached billing country
• working and transaction context: the sign-in method used (password or SSO provider), an invitation token handed over through an invitation link, the team/project/workspace you last had open in each organization, and, during a payment, the order context (organization, plan, seats, payment provider)
• a marker that the sign-in dialog on the start page has already been shown in this session
• during registration, your email address and password — solely so that you pass seamlessly from email confirmation into the signed-in session. For that automatic sign-in the details stay valid for two minutes; after that the password is removed from storage automatically, including if you abandon the registration. At the very latest it is gone once you close the browser tab.

9. Cookies

We use exclusively technically necessary cookies. These are exempt from consent under Sec. 25(2) no. 2 of the German Telecommunications-Digital-Services Data Protection Act (TDDDG).

• Identity refresh token (HttpOnly, Secure): keeps your sign-in active across multiple browser tabs.
• OAuth refresh token (HttpOnly, Secure): allows silent renewal of the short-lived access token without signing in again.
• MFA trust cookie (HttpOnly, Secure, 30 days): is only set if, with two-factor authentication enabled, you actively select the "Trust this browser for 30 days" option at login; marks the browser as "trusted" so that the second step is not requested again at every login.

We do not set any tracking, analytics or marketing cookies. Third-party cookies are set only when you yourself start a third-party service — by the respective provider during an SSO login, or by YouTube when you play the video on the home page (see Section 10) — and on their domain, not on ours.

10. Processors and Third-Party Providers

We use third-party services only where they are technically necessary. User data is not disclosed for advertising purposes. In use are:

• SSO providers (Google, Apple, Microsoft, GitHub): data flow only during active login by the user; see Section 5.
• Video on the home page (YouTube; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): The introductory video is embedded in privacy-enhanced mode via youtube-nocookie.com and is only loaded when you click “Play video”. Until then we only show our own preview image, and no data is transmitted to YouTube. By clicking, you consent to the video being loaded. Google then receives in particular your IP address, information about your browser and device, and the address of our home page; YouTube may store and read information in your browser’s storage. We are jointly responsible with Google for collecting and transmitting this data through the embedding; Google alone is responsible for any further processing. A transfer to the USA is possible (see Transfer to third countries, EU-U.S. Data Privacy Framework). More information: https://policies.google.com/privacy. Your consent applies only to the current page view; after the page is reloaded, the video is only loaded again when you click.
• Payment service providers (Stripe Payments Europe, Ltd., Dublin, Ireland; PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg): independent controllers for payment processing; data flow only with an active paid subscription.
• Chargebacks and payment disputes: if a payment is charged back or disputed, Stripe or PayPal transmit the case data to us (case identifier, amount, reason code, deadlines, fees, outcome; for cards the last four digits). We keep these cases in a chargeback register and submit evidence of the order to the payment service provider to defend against unjustified chargebacks: time and version of the consent given at booking, IP address and browser identifier of the ordering device, logins and usage counters after the purchase. Legal basis: Art. 6(1)(b) (performance of the contract), (c) (accounting obligations) and (f) GDPR (defence against unjustified chargebacks, fraud prevention). Decisions on a suspension or termination because of a chargeback are taken by a member of staff; you can state your point of view at any time (support@opergow.com).
• European Commission / VIES: if you provide a VAT ID, it is transmitted for validity checking to the European Commission's VAT Information Exchange System (VIES) (Art. 6(1)(c) GDPR in conjunction with tax-law obligations). For sole traders the VAT ID may constitute personal data.
• Hosting/cloud: Google Cloud Platform (compute, managed MySQL databases, object storage, messaging/pub-sub services, key management) in the EU region. Processing under a data processing agreement pursuant to Art. 28 GDPR.
• MaxMind (geo-IP): the country is determined against a local copy of the GeoLite2 database held on our own server. Your IP address is not transmitted to MaxMind and is not stored for this purpose. We obtain the database itself from MaxMind at regular intervals; no user data leaves our systems in doing so.
• Email sending (SMTP via Scaleway SAS, 8 rue de la Ville-l’Évêque, 75008 Paris, France, and Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, Luxembourg, each as processor; the sender domain belongs to that provider): for service and verification messages — the confirmation code during registration and when you change your email address, the notice to the holder of an address when a further account is about to be created with it or a password reset is requested for an account that signs in through an external provider, team invitations, confirmation of a cancellation, and the single reminder before a scheduled account deletion.
• External API/AI providers integrated by the user (e.g. OpenAI, Anthropic, Google/Gemini, Mistral or others — depending on your choice): These receive your inputs only because and insofar as you enable them yourself and store your own credentials. They act as third-party services under your responsibility, not as our sub-processors. The same applies to any asynchronous media services (e.g. generation services) if you integrate them.

Transfer to third countries: Insofar as processing outside the EU or the EEA may take place with the services mentioned (e.g. GitHub, Inc. for the GitHub login, or US group companies of the cloud and payment service providers), the transfer is based on an adequacy decision of the EU Commission — in particular the EU-U.S. Data Privacy Framework for US providers certified thereunder — or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), supplemented by additional technical protective measures. A copy of the appropriate safeguards — in particular the Standard Contractual Clauses — or information on their availability can be obtained on request at contact@opergow.com.

Our hosting (Google Cloud) is contractually fixed to the EU region; your organization's business and content data does not leave the selected region. For third-party services that you integrate yourself, the data protection provisions and transfer mechanisms of the respective provider apply (see above).

11. Storage Location of the Data (Regional)

Data is stored separately by region; each organization is assigned to exactly one region. The regions EU, USA and Rest of World (ROW) are planned, each cleanly separated from the others. Currently only the EU region is operated (Google Cloud); further regions will follow. Identity/authentication services are operated globally.

When an organization is created, the hosting region is set once and cannot be changed afterwards. The region results from the country you select; automatic country detection (geo-IP) is merely a non-binding suggestion that you can override at any time before submitting — the selection and its correctness are your responsibility. A subsequent transfer of the data to another region does not take place; this requires creating a new organization. The current hosting region of your organization can be viewed in the Platform at any time.

12. Retention Period

• Verification/recovery codes: short-lived (a few minutes); SSO/reauth states: 10 minutes.
• Trusted devices: 30 days; automatic cleanup thereafter. Revoked upon disabling 2FA, changing the password or deleting the account.
• Sign-in and security logs: 90 days; the five most recent entries per account and the list of known sign-in countries are kept beyond that until the account is deleted (details in Section 3).
• Account and content data: indefinitely until your deletion request; then deletion in all services of the platform without undue delay, as a rule within 24 hours, at the latest within 30 days. If you have scheduled the deletion for a future date, this period only begins on the scheduled date.
• Public templates in the Hub: until withdrawn by you or by an owner or administrator of your organization. If your account is deleted, we remove your nickname and the name of your organization from your publications; the template stays public without a name until it is withdrawn. If your organization is deleted, we withdraw all of its publications and delete their content; where a publication must be retained as evidence (paid sale or block due to a violation), it remains stored with pseudonymous identifiers only. If we block a template due to a violation, we retain its content as evidence for as long as this is necessary to defend against legal claims (Art. 17(3)(e) GDPR). Records of installed public templates remain beyond an account deletion; they contain no name and no email address. We retain data on paid purchases, payments and payouts in the Hub for 8 years due to tax and commercial-law obligations (Art. 17(3)(b) GDPR).
• Invoice data: 8 years pursuant to Sec. 147 German Fiscal Code (AO), Sec. 14b VAT Act (UStG) and Sec. 257 German Commercial Code (HGB) in the version applicable since 01.01.2025 (statutory retention obligation, exception under Art. 17(3)(b) GDPR). During this period the data is processed only for tax and commercial law purposes. After the retention period lapses, this data is deleted or blocked from further processing.
• Chargeback register: 8 years as an accounting record (§ 147 AO). Order evidence (consent time, IP address, browser identifier): 18 months from the last payment — for as long as a payment can still be disputed with the payment service provider. Login records and usage counters are not retained for this purpose beyond the periods described in Section 3 and for operation. Sign-up block after account deletion (Section 13): the pseudonymised check value of the email address remains stored until we lift the block — usually after open claims have been settled or the dispute has been resolved; there is no fixed period. You can request the lifting at any time (support@opergow.com); we then review the entry and remove it once the reason no longer applies.
• Cancellation, deletion and waiver record: if you cancel a paid subscription, or it ends with the deletion of your account, we store a brief record of the process — date and time your declaration reached us, the affected plan and remaining term, the amount of any credit forfeited in the process, and the version of the notice text shown to you. Name, email address and IP address are not stored. The purpose is to evidence the cancellation and the mandatory notices given with it, and to defend legal claims. The legal basis is the statutory retention duty for commercial letters (§ 257 German Commercial Code, § 147 German Fiscal Code; Art. 17(3)(b) GDPR). Retention: 6 years, then automatic deletion.
• Deletion log: when your account is deleted, the deletion log stores only a pseudonymous identifier of your account and technical details of the execution (responsible region, time) — no name and no email address. Entries for deleted organizations contain only the organization’s identifier. The log serves solely to ensure and evidence the deletion in all services, including after backups have been restored; it is not used for any other purpose. Legal basis: Art. 6(1)(c) and (f) GDPR in conjunction with Art. 17 and Art. 5(2) GDPR. Retention: permanently, because only then can a deletion be reliably repeated after older backups have been restored.

13. Purposes and Legal Bases

• Provision of the Platform, authentication and account/organization management — Art. 6(1)(b) GDPR (performance of contract / pre-contractual measures).
• Execution of your flows and calling the external services you have enabled — Art. 6(1)(b) GDPR.
• Billing of paid plans and processing of payments via the integrated payment service providers — Art. 6(1)(b) GDPR; the statutory retention of invoices additionally Art. 6(1)(c) GDPR.
• Fulfilment of legal obligations (tax/commercial law, accounting) — Art. 6(1)(c) GDPR.
• Ensuring and evidencing deletion in all services, including after backups have been restored (deletion log with a pseudonymous identifier, see Section 12) — Art. 6(1)(c) and (f) GDPR in conjunction with Art. 17 and Art. 5(2) GDPR.
• IT security, abuse prevention, security logging — Art. 6(1)(f) GDPR (legitimate interest).
• Logging of chargebacks, payment disputes and refunds per organisation for fraud prevention — Art. 6(1)(f) GDPR (legitimate interest).
• Blocking a new sign-up after account deletion if an organisation owned by the account was blocked at that time (e.g. because of chargebacks, payment disputes or breaches of the Terms and Conditions), for fraud and abuse prevention (pseudonymised check value of the email address together with details of the organisation's block) — Art. 6(1)(f) GDPR (legitimate interest).
• Communication with the user (service messages, verification) — Art. 6(1)(b) GDPR.
• Feedback and error reports — Art. 6(1)(a) GDPR (consent, see the section on feedback and error reports).
• Playing the introductory video on the home page via YouTube — Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent by clicking “Play video”). You can withdraw it at any time with effect for the future by reloading the page and deleting the data YouTube has stored in your browser.
• Geo-IP country assignment (non-binding suggestion during registration) and browser-local storage — Art. 6(1)(b) or (f) GDPR; storage and read operations on your device take place only insofar as they are technically necessary (Sec. 25(2) no. 2 TDDDG).

14. Disclosure to Third Parties

Your data is disclosed only where required by law (e.g. official requests with a valid legal basis), necessary for performing the contract via the processors mentioned, or where you have expressly consented. Content flows to external API/AI providers integrated by you exclusively based on your own enablement and with your own credentials (see Sections 6 and 10). Invoice and accounting data (Section 2, billing data) are transmitted to our tax advisor, who is bound by statutory professional secrecy (§ 57 StBerG), as part of our bookkeeping and tax obligations, and to the competent tax authorities where reporting and filing obligations require it (Art. 6(1)(c) GDPR).

15. Your Rights under the GDPR

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent given (Art. 7(3) GDPR)

To exercise your rights, contact: contact@opergow.com.

16. Right to Lodge a Complaint

Irrespective of contacting us, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the authority of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de.

17. Account and Organization Deletion

How to delete your account:

1. Sign in
2. Open the menu → Profile
3. Scroll to the “Delete account” section in your profile
4. Choose "Delete account"
5. Confirm your identity (with your password; for SSO accounts by signing in again with the SSO provider — currently available for Google, further providers to follow shortly)
6. Finally confirm the deletion in the confirmation dialog

Upon a request for immediate deletion, your account is immediately blocked and then removed from all services of the platform. As a rule, deletion is fully completed within 24 hours; at the latest it takes place within 30 days — this period ensures that your data is also removed from backups and logs. Until deletion is complete, no new account can be created with the same email address; re-registration is only possible after the deletion has been fully completed. Deletion covers login data and the user profile together with dependent data (two-factor entries, login logs, known locations). Security counters for failed logins (tied to a cryptographic email hash, with no plain-text link to your person) may briefly outlast the deletion for abuse-protection reasons. Before the deletion, we show you all organizations you belong to and what happens to each of them. Organizations of which you are the only member are deleted together with your account, including their files and credentials. In all other organizations your membership ends; your private content there is deleted, and references to your person in content that remains with the organization are anonymized. If you are the owner or the last administrator of an organization with other members, deletion is only possible after you have transferred ownership to an administrator or, respectively, made another member an administrator, or removed the other members; there is no automatic transfer. Organizations with an individual contract are deleted in the course of the termination of that contract. To ensure that the deletion is reliably carried out in all services, we keep a deletion log with a pseudonymous identifier (see Section 12).

Scheduled deletion: instead of immediate deletion, you can schedule the deletion of your account for a future date (e.g. the end of a billing period you have already paid for, at most 400 days in advance). Until that date your account remains fully usable, and you can cancel the scheduled deletion in your profile at any time. About seven days before the date we remind you once by email. On the date we check the requirements again: if you are then the owner or the last administrator of an organization with other members, the deletion is not carried out and the scheduled deletion is canceled; we notify you by email, and you can request the deletion again after the transfer. Otherwise your account is blocked on the date and the deletion is carried out as described above.

Invoice data is retained due to statutory retention obligations (see Section 12), blocked from further use and deleted once the periods lapse. Other personal data is removed upon account/organization deletion, unless a statutory retention obligation applies; only the deletion log with a pseudonymous identifier remains (see Section 12). If a paid subscription ends with the deletion, the deletion/waiver record described in Section 12 additionally remains (6 years, § 257 German Commercial Code, Art. 17(3)(b) GDPR). You can also submit a deletion request in text form by email to the address stated in the legal notice; to protect against unauthorized requests, it is executed only after it has been confirmed via the email address registered for the account.

Public templates: if your account is deleted, we remove your nickname and the name of your organization from your publications in the Hub; the template stays public without a name until an owner or administrator of the organization withdraws it. If the organization is deleted — including together with your account if you are its only member —, we withdraw all of its publications and delete them unless they must be retained as evidence (see Section 12). Copies already installed remain with the organizations that installed them.

18. Feedback and Error Reports

If you send us feedback via the feedback function or — after an error — submit an error report, we process the following data for handling it and for any follow-up questions. Submission takes place exclusively after your express consent (checkbox in the feedback window):

• Your email address – for follow-up questions and a possible status reply.
• Your internal user ID – to assign the report to your account.
• Account and team details: your display name, the identifier and name of your active organization, the plan booked there and the type of sign-in you use (password or SSO provider) – so that we can assess your request in the right context and match up any follow-up questions.
• Technical metadata: time, affected page/function, type of request, app version, language and display settings, and browser/device information (user agent, platform, window and screen size, time zone, connection status).
• For error reports, additionally technical error details (error message and stack trace) so that we can reproduce the problem.

The legal basis is exclusively your consent (Art. 6(1)(a) GDPR): without the checkbox actively ticked, nothing is transmitted at all. If you withdraw your consent, we stop processing the report concerned and delete it.

We store this data for as long as necessary to handle your request and for any follow-up questions, and delete it thereafter. When your account is deleted, associated feedback and error reports are removed automatically. You can withdraw your consent at any time with effect for the future (see the section on your rights under the GDPR).

19. Changes to This Privacy Policy

We reserve the right to adapt this Privacy Policy to changed legal situations or to changes in the platform functionality. The respective current version is available on this page.

We announce material changes that noticeably affect your rights or the data processing with reasonable notice — by message to the address stored in your account or by notice after login.