Privacy Policy

1. Controller

SENSUENA
Owner: Dennis Rohr
Höferstraße 15
47447 Moers
Germany
Email: info@framebuddy.de

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

We process personal data only insofar as this is necessary to provide this website, to perform your contract for FRAMEBUDDY, to process payments, to keep our service secure or – with your consent – for statistics and marketing. The legal bases are Art. 6 (1) (a) (consent), (b) (contract), (c) (legal obligation) and (f) GDPR (legitimate interest).

3. Hosting and server log files

This website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit it, technically necessary data is processed (e.g. IP address, date and time, page visited, browser and operating system) in order to deliver the website and ensure its security (Art. 6 (1) (f) GDPR). We have a data processing agreement with the host. The host decides on the server log files; they are deleted after a short time.

4. Customer account and use of the generators

For registration we process your first name, optionally your last name, your email address and a password stored in encrypted form. We send you a confirmation link to verify your email address. To perform the contract we store your plan, your generator selection, the devices on which you use FRAMEBUDDY (device ID and browser name) and logs of logins, opened generators and changes to your account (Art. 6 (1) (b) and (f) GDPR). In these logs we store IP addresses only as a non-reversible hash in order to detect misuse (e.g. mass login attempts).

The content you enter into a generator (e.g. names) is processed in your browser and stored locally there so that your entries are kept the next time you open it. It is not transmitted to our server.

After registering you receive a free trial licence. To count the included trial exports and prevent multiple use, we log each export with time and generator; when granting the trial we store a non-reversible hash of the IP address (Art. 6 (1) (b) and (f) GDPR).

During the trial licence we send you at most four emails about it: at the start with tips, shortly before it ends, when all trial exports have been used, and when it ends. For this we use your email address, your first name, your saved language and the term and number of used exports of your trial licence (Art. 6 (1) (b) and (f) GDPR). You can unsubscribe from these emails at any time via the link at the end of each of them; we then store a note so that you receive no further ones.

Sign in with Google (optional): Instead of email and password, you can also sign up and log in with your Google account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you choose “Sign in with Google”, you are redirected to Google and log in there. Google then sends us your name, your email address, whether Google has verified the address, and a permanent ID of your Google account. We store the ID and the email address to link your Google account to your FRAMEBUDDY account; no password is transmitted to us. We do not access any other data in your Google account (e.g. contacts or files). The legal basis is Art. 6 (1) (b) GDPR (contract or pre-contractual steps at your request). Google may also process data in the USA; Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). You can find out which data Google itself processes during sign-in in Google’s privacy policy (policies.google.com/privacy). The link is deleted together with your account.

Wish Box: If you submit a generator wish, we store the title, description, time and processing status together with your customer account (Art. 6 (1) (b) GDPR). If your wish is chosen, we only name the title of the wish on the website, not your name. The entries are deleted with your customer account; on request we also delete individual wishes earlier.

We store your account data for the duration of the contract and delete it after your account is closed, unless statutory retention obligations prevent this.

5. Payment processing with Stripe

We process payments via Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. When paying, you enter your payment details directly with Stripe; we do not receive complete card or account details. We send Stripe your email address, the chosen plan and a customer number; Stripe sends us the payment and subscription status (Art. 6 (1) (b) GDPR). Stripe may also transfer data to the USA; Stripe is certified under the EU-US Data Privacy Framework. More information: stripe.com/privacy. We keep invoice and payment data in accordance with tax and commercial law retention periods (up to 10 years) (Art. 6 (1) (c) GDPR).

6. Protection against misuse (Cloudflare Turnstile)

During registration, password resets and after repeated failed logins we use Cloudflare Turnstile by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, to block automated access (bots). Technical data from your browser and your IP address are transmitted to Cloudflare (Art. 6 (1) (f) GDPR; our legitimate interest is the security of our service). Cloudflare is certified under the EU-US Data Privacy Framework. More information: cloudflare.com/privacypolicy.

7. Emails

We send you emails that are necessary for your account and your contract (e.g. confirmation links, contract and cancellation confirmations). They are sent via our host’s servers. We only send promotional emails with your express consent.

8. Cookies and similar technologies

The following are technically necessary and permitted without consent (§ 25 (2) TDDDG): a session cookie for login (deleted when you close the browser or log out), a device cookie that recognises on which of your devices you use the generators (device limit of your plan; lifetime 12 months), a cookie that stores your choice in the consent banner (lifetime 6 months) and a cookie that stores your chosen language (German/English; lifetime 12 months). Storing your generator entries locally in your browser (see section 4) is necessary for the function you requested.

9. Links to social networks

On our website we link to our profiles on Instagram, TikTok. These are simple links; no data is transmitted to these networks when you visit our website. The privacy policy of the respective network only applies once you follow a link.

10. Recipients

Your data is only received by the service providers named above, insofar as this is necessary for their tasks, and by authorities where we are legally obliged to disclose it. Transfers to third countries only take place as described above.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future. To do so, contact info@framebuddy.de.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

12. Obligation to provide data

The information requested at registration and purchase is required to conclude the contract. Without it we cannot provide FRAMEBUDDY to you. No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.