Privacy Policy

1. Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

2. General Information on Data Processing

The protection of personal data is of high importance. Personal data on this platform is processed exclusively in accordance with the applicable statutory data protection regulations, in particular the General Data Protection Regulation (GDPR).

Data processing is carried out only to the extent necessary for providing the platform, enabling the use of the available features, or fulfilling legal obligations.

3. Hosting

This platform is hosted by the following provider:

IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany

Processed Data

When accessing the platform, the hosting provider automatically processes the following data:

IP address
Date and time of access
Accessed URL
HTTP status code
User agent (browser/device)

Purpose of Processing

Ensuring the technical operation of the platform
Ensuring stability and security

Legal Basis

Art. 6(1)(f) GDPR (legitimate interest in the secure and reliable operation of the platform)

Data Retention Period

Server log files are stored for 7 days and then deleted.

Data Processing Agreement

A data processing agreement pursuant to Art. 28 GDPR exists with IONOS SE.

Use of the platform requires authentication via Discord (OAuth process).

Processed Data

As part of the login process, the following data may be transmitted by Discord:

Discord user ID
Username
Avatar (profile image)
Email address (if released by Discord)

Purpose of Processing

User authentication
Creation and management of a user account

Legal Basis

Art. 6(1)(b) GDPR (performance of a contractual relationship)

Recipient

Discord Inc. processes the data as an independent controller.

Third-Country Transfer

Discord is headquartered in the United States. A transfer of personal data to a third country takes place.

The transfer is based on Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46 GDPR. It cannot be ruled out that U.S. authorities may access the data.

5. Web Analytics with Umami

This platform uses Umami Analytics for statistical analysis of usage.

Processed Data

Anonymized IP address
Accessed pages
Device type and browser (truncated)

No cookies are set and no user profiles are created.

Purpose of Processing

Analysis of platform usage
Improvement of the platform

Legal Basis

Art. 6(1)(f) GDPR (legitimate interest in optimizing the service)

Consent is not required, as Umami is used without cookies and without personal user tracking.

6. Feedback and Contact

Signed-in members can submit feedback (bug reports, ideas, criticism, questions and other remarks) through a form.

Data Processed

the selected category of the message
the message text
optionally up to three uploaded images
optionally a different email address for follow-up questions; without it, the address stored in the user account is used
the association with the sender's user account
the time at which this privacy notice was acknowledged

When the form is submitted, technical details required to handle bug reports are recorded automatically:

the address of the page the message was sent from
the browser identification (user agent)
the version of the application
the size of the browser window

No IP address is stored in connection with the feedback form.

Purpose of Processing

handling and answering the message
fixing bugs and improving the platform

Legal Basis

Art. 6(1)(f) GDPR (legitimate interest in handling feedback and fixing defects) and Art. 6(1)(b) GDPR within the existing user relationship.

The confirmation in the form serves to acknowledge this notice and does not constitute consent within the meaning of Art. 6(1)(a) GDPR.

Recipients

The message is delivered to the platform administrators by email. Administrators additionally receive a Discord notification containing only the category of the message and the sender's name — neither the message text nor the images are transmitted to Discord.

Mailjet is used as a processor for sending the email.

Note on Uploaded Images

Uploaded images are stored under a randomly generated, non-guessable address and displayed in the platform's administration area. The address itself is not additionally access-protected. We recommend not uploading images with particularly sensitive content.

Retention

Messages are deleted once they have been handled, and at the latest 90 days after they are marked as resolved. Uploaded images are deleted along with them. If the user account is deleted, the associated messages are deleted as well.

7. Cookies and Local Storage Technologies

This platform uses only technically necessary cookies or comparable storage technologies, for example to maintain the login status.

Legal Basis

Section 25(2) No. 2 TTDSG
Art. 6(1)(b) GDPR

8. Data Retention

Personal data is stored only for as long as necessary for the respective purposes or as required by statutory retention obligations.

User accounts can be deleted upon request.

9. Rights of Data Subjects

Data subjects have the following rights at any time:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to withdraw consent (Art. 7(3) GDPR)

To exercise these rights, an informal email to the contact address stated above is sufficient.

10. Right to Lodge a Complaint with a Supervisory Authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority.

The competent authority is:

State Commissioner for Data Protection and the Right of Access to Files Brandenburg (LDA Brandenburg)

11. Automated Decision-Making

Automated decision-making, including profiling, does not take place.

12. Status of this Privacy Policy

Status: August 7, 2026