Privacy

Draft, under review by our lawyers

This page carries the required structure, but no binding text yet. The reviewed version will replace it before branding.supply opens to everyone. Until then: nothing here is something you can rely on.

Draft, under review by our lawyers. This page carries the structure, but no binding text yet. Every line with [FILL IN: …] is an open spot.

Controller

[FILL IN: same as in the imprint — name, address, contact]

Representative in the Union (Art. 27 GDPR)

[FILL IN: open — waiting for our lawyer's answer (plan §9 question 3)]

What we process

[FILL IN: the twelve processing activities from the fact sheet (plan §1.2) — account, sessions, wizard content, AI calls, brand check, market comparison, share links, waiting list, email, server logs, operator events; each with purpose, recipients, legal basis and retention]

AI processing of your brand texts

[FILL IN: review point for our lawyer (plan §9 question 2). This section says in plain words that brand texts go through OpenRouter to a model provider, under which conditions (zero data retention, no fallback, no training) and how long the result stays with us. Source: fact sheet, row 4.]

Fetching third-party websites

[FILL IN: review point for our lawyer. Brand check and market comparison fetch third-party pages; the bot notice lives at /market-bot, plus the TDM reservation and the PII filter. Source: fact sheet, rows 5 and 6.]

Public scoring of third-party brands

[FILL IN: review point for our lawyer. What the brand score measures, who appears in the ranking (opt-in by the person running the check) and which correction route is open.]

Recipients and sub-processors

[FILL IN: the sub-processor list (plan §2.2 point 7) — at least Hetzner, ploi.io, OpenRouter including the allowed model providers, the SMTP provider, and Google only for the Google sign-in]

What does NOT happen

[FILL IN: no ad network, no embedded third-party content, no third-party fonts, no analytics, no cookie banner — because there is nothing to consent to. Source: fact sheet, paragraph after the table.]

Retention

[FILL IN: per processing activity; two retention periods are open today (server logs, operator events)]

Your rights

[FILL IN: access, rectification, erasure, restriction, portability, objection, complaint to a supervisory authority — and where export and deletion live inside the account]