Privacy Policy

This page is a courtesy translation. The German version of this document is legally binding and prevails in case of any discrepancy.

Diese Seite ist eine Übersetzung zur Orientierung. Die deutsche Fassung ist rechtlich maßgeblich.

The controller within the meaning of the GDPR is:

[FULL NAME], [LEGALLY VALID ADDRESS], email: [EMAIL], phone: [PHONE].

No data protection officer has been appointed at this time. [If one has been appointed, add contact details here.]

Every visit to this website causes our hosting provider to automatically record technical connection data (including IP address, date and time of the request, page requested, browser used) in server log files, for the purpose of technical delivery, fault detection and IT security.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, functioning operation).

Hosting provider: Hetzner Online GmbH, Germany (data center in the EU). A data processing agreement under Art. 28 GDPR is in place with Hetzner.

Using the customer portal (managing subscription, devices and invoices) requires signing in with an email address (passwordless magic-link). We process your email address, sign-in time and a session-related, technically necessary cookie ID.

Legal basis: Art. 6(1)(b) GDPR (performance of the usage contract).

Purchasing a subscription is processed by our payment provider Polar, acting as Merchant of Record. Name, email address, billing address and payment data (e.g. card data) are transmitted to Polar and processed there for contract fulfillment, invoicing, VAT remittance and fraud prevention.

Polar may process this data as an independent controller (Merchant of Record) where required to fulfil its own legal obligations (e.g. tax law), and otherwise as our processor. Please see Polar's own privacy policy for details.

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (tax retention obligations).

[Add Polar's place of business and, where applicable, safeguards for third-country transfers (e.g. standard contractual clauses) once the underlying data processing agreement is finalized.]

To issue and enforce the software license we process the license key, a customer name (embedded in the license file), a device-generated fingerprint, and activation/verification timestamps. This data is processed on activation, on periodic validity checks (heartbeat), and when a device is replaced or deactivated.

Legal basis: Art. 6(1)(b) GDPR (contract performance, in particular enforcing the agreed number of devices) and Art. 6(1)(f) GDPR (abuse prevention).

To send necessary emails (license key and download link, trial confirmation, pre-charge reminder, cancellation confirmation, device replacement, withdrawal confirmation) we use Amazon Simple Email Service (SES), operated by Amazon Web Services, in production. Email address, name and the relevant message content are transmitted to Amazon SES for this purpose.

In local development, a local mail-catcher (Mailpit) is used instead of Amazon SES; no data is transmitted to any third party in this case.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

Every email we send is logged internally (recipient, template, timestamp) to track delivery and support requests.

When you contact us (e.g. via the contact form or by email) we process the data you provide (name, email, subject, message) to handle your request.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual/contractual request) or Art. 6(1)(f) GDPR (legitimate interest in handling inquiries).

We use technically necessary and functional cookies (always on) and — only with your consent — cookies in the categories statistics, marketing, and external media. No consent is required for necessary and functional cookies under Sec. 25(2) TDDDG; you control all consent-requiring categories yourself via our cookie banner (Sec. 25(1) TDDDG; Art. 6(1)(a) GDPR).

Your consent is voluntary. You can adjust your selection at any time via the »Cookie settings« button (bottom left on every page) or withdraw it with effect for the future. If you decline, no non-necessary cookies are set; the site remains fully usable.

NEXT_LOCALE (cookie, functional): Stores your chosen language (German/English) so the site is served in the right language. Contains only the language code, lifetime up to one year. Necessary for the service you requested (Sec. 25(2) no. 2 TDDDG); no consent required.

mihikopoa_portal (cookie, necessary): Session cookie for the customer portal (contains a signed identifier and the expiry time). Set only after you sign in; httpOnly, lifetime up to 30 days (Sec. 25(2) no. 2 TDDDG; Art. 6(1)(f) GDPR).

mihikopoa_admin (cookie, necessary): Session cookie for the isolated internal administration area. Set only after internal sign-in; httpOnly, lifetime up to 8 hours (Sec. 25(2) no. 2 TDDDG; Art. 6(1)(f) GDPR).

mihikopoa_consent (cookie, necessary): Stores your cookie choice so we can honor it and don't ask again on every visit. Contains only your category selection and the time of consent, lifetime around 6 months.

Theme preference (local storage / localStorage): Your light/dark choice is stored only locally in your browser, never leaves your device, and is not personal data under the GDPR.

The statistics, marketing, and external media categories only become active after your consent. As long as no service is integrated in one of these categories, no corresponding cookies are set even with consent. The specific services used (e.g. traffic measurement, advertising pixels, embedded media) and their respective storage periods will be added here once they are in use; advertising and media services may transfer data to third parties, including to countries outside the EU.

Polar — payment processing, subscription management, VAT, invoicing (Merchant of Record).

Amazon Web Services (Amazon SES) — sending transactional emails (production only).

Hetzner Online GmbH — hosting the application and database (Germany/EU).

Data processing agreements under Art. 28 GDPR are, or will be prior to production launch, in place with all processors.

Contract and invoicing data (customer, subscription, license) is stored for the duration of the contractual relationship and afterwards in accordance with statutory commercial and tax retention periods (generally 6 or 10 years under German law).

Server log files are automatically deleted after [PERIOD, e.g. 14 days], unless needed to investigate a specific security incident.

Logs of sent emails (email events) are retained for [ADD PERIOD].

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on Art. 6(1)(f) GDPR (Art. 21).

To exercise these rights, an informal message to [EMAIL] is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement. Our competent authority is: [COMPETENT STATE DATA PROTECTION AUTHORITY].

If you exercise your right of withdrawal, we process the data required for that purpose (email address, any order reference/license key, time of declaration) to process the withdrawal, deactivate the affected license, and document proper handling (confirmation by email as a durable medium). Legal basis: Art. 6(1)(b) and (c) GDPR.

We update this privacy notice whenever the tools actually used or the underlying data processing change. The version published at the time of your visit applies.