Privacy Policy

The controller responsible for data processing on this website is:

We take the protection of your personal data seriously. We process personal data only to the extent required and on the basis of applicable legal provisions.

We process personal data in particular when you:

Processed data may include in particular:

• Visit our website.
• Create a customer account.
• Purchase a subscription.
• Contact us.
• Use our services.
• Master and contact data.
• Contract and subscription data.
• Payment data.
• Payment and transaction data.
• Email addresses and communication data.
• technical usage data such as IP address, browser information and timestamps.

Processing takes place in particular to:

• Provide and optimize our website.
• Manage user accounts.
• Process subscriptions.
• Assign the respective subscription plan.
• Process payments.
• Handle requests and support.
• Ensure IT security.

Depending on the individual case, we process data on the basis of:

• Art. 6(1)(b) GDPR for the performance of a contract.
• Art. 6(1)(c) GDPR for compliance with legal obligations.
• Art. 6(1)(f) GDPR on the basis of legitimate interests.
• Art. 6(1)(a) GDPR where consent has been given.

We use Stripe exclusively for payment processing. Stripe Payments Europe, Limited is the responsible entity / controller for the EU with processing in Ireland (Dublin). During payment, data required to carry out and process the payment is transferred to Stripe. The legal basis is Art. 6(1)(b) GDPR. Stripe provides a Data Processing Agreement (DPA) for GDPR compliance.

We use Supabase for backend functions, authentication and storage of application data. Supabase offers EU Data Residency with hosting in the Frankfurt region (eu-central-1). Your personal data is stored in data centers in Germany. There is no automated third-country transfer for Supabase data. Supabase provides a Data Processing Agreement (DPA) for GDPR compliance.

We use Resend to send emails such as order, security and system emails. Resend offers EU regional sending (Ireland), but account data, metadata and logs remain in the United States. Data transfers to the United States are based on the European Commission's Standard Contractual Clauses (SCC), which are part of Resend's Data Processing Agreement. The legal basis is Art. 6(1)(b) GDPR.

We use only technically necessary cookies or similar technologies where required to operate the website. Non-essential cookies or tracking technologies are used only after prior consent.

Recipients of personal data may include technical service providers, payment providers and email providers where this is required to provide the website and services.

We store personal data only for as long as required for the respective purposes. User accounts and the data they contain are deleted after subscription cancellation and expiry of a 30-day transition period. We retain contract and invoice data for 10 years due to tax and commercial-law retention obligations.

Where we process personal data on behalf of our customers (for example coaches) as part of our SaaS offering, this takes place on the basis of a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR. This agreement is concluded electronically when the contract is entered into.

You have the right of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent granted.

You have the right to lodge a complaint with a data protection supervisory authority.

If you have questions about privacy, you can reach us at support@proofshield.app.