Privacy Policy

1. Controller, personal data, contact

The person responsible (Controller) for the collection, processing and use of your personal data in accordance with Art. 4, Section 7 of the General Data Protection Regulation ("GDPR") is:

hereinafter referred to as "we" or "us".

Personal data means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Article 4 (1) GDPR).

If you contact us by email we will collect and record your disclosed data (e.g. email address) to be able to answer your questions.

2. Your rights

At all times, you are entitled to claim your rights in relation to us as an affected person. Should the respective statutory requirements be met, these include the following rights:

• Right of access in accordance with Article 15 GDPR
• Right to rectification in accordance with Article 16 GDPR
• Right to erasure in accordance with Article 17 GDPR
• Right to restriction of processing in accordance with Article 18 GDPR
• Right to data portability in accordance with Article 20 GDPR
• Right to object in accordance with Article 21 GDPR

In other words, Users have the right to do the following, to the extent permitted by law:

• Withdraw their consent at any time. Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data.
• Object to processing of their Data. Users have the right to object to the processing of their Data if the processing is carried out on a legal basis other than consent.
• Access their Data. Users have the right to learn if data is being processed by the Controller, obtain information about certain aspects of the processing and obtain a copy of the Data undergoing processing.
• Verify and seek rectification. Users have the right to verify the accuracy of their Data and ask for it to be updated or corrected.
• Restrict the processing of their Data. Users have the right, under certain circumstances, to restrict the processing of their Data.
• Have their personal Data deleted or otherwise removed. Users have the right, under certain circumstances, to obtain the erasure of their Data from the Controller.
• Receive their Data and have it transferred to another controller. Users have the right to receive their Data in a structured, commonly used and machine-readable format and, if technically feasible, to have it transmitted to another controller without any hindrance.
• Lodge a complaint. Users have the right to bring a claim before their competent data protection authority.

You can exercise these rights at any time by contacting us under the contact details listed under section 1.

In addition you have the right to lodge a complaint with a responsible data protection authority:

3. Collection, processing and use of personal data

When visiting the website

When you visit our website, the hosting provider of our website automatically collects and stores various information in so-called server log files that your browser transmits to us. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources. The data is collected on the basis of Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website — for this purpose, the server log files must be recorded.

When using the Service

When you upload a photo or ask us to get in touch, we collect and process the following data:

• Uploaded images: the photo you upload, its file name, file type, size and pixel dimensions, and any information visible in the image.
• Delivery Sheet data: the assessment generated from your photo (product description, photo quality assessment, proposed imagery, ALT text and suggested file name), stored together with your photo under a unique, unlisted web address.
• Contact request data: your name and email address, and optionally your company name and message, when you ask us to get in touch from a Delivery Sheet; your name, email address and message, and the page you sent it from, when you use the contact form on our website. Contact form messages are sent to us by email and are not stored in our database.
• Usage data: whether a draft Delivery Sheet led to a contact request, and the time at which you left the Delivery Sheet page without requesting contact.
• Technical data: your IP address, used briefly and only in memory to limit the number of uploads and contact requests per visitor and protect the Service from abuse. It is not stored with your Delivery Sheet or contact request.
• Bot check data: when you upload a photo or send a form, Cloudflare Turnstile checks in the background that the request comes from a person (see section 6).

This data is processed on the basis of Art. 6 (1) (b) GDPR to take steps at your request prior to entering into a contract, and on the basis of Art. 6 (1) (f) GDPR in our legitimate interest to provide, secure and improve our services. When you request contact, our team is notified by email with the details of your request so that we can respond.

Images containing personal data

Please upload photos of products only. If an image shows people, vehicle registration plates or other personal data, that information is processed as part of the image. The User is solely responsible for having the right to share such images with us. On request, we delete uploaded images and the related Delivery Sheet.

4. Cookies

Many websites use so-called "cookies": small data packages stored on your end device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). This Application currently does not set any cookies.

Local storage

If you switch between day and night mode, we remember your choice in your browser's local storage, so the site is shown the same way on your next visit. This setting stays on your device, is never sent to us, and contains no personal data. You can remove it at any time by clearing your browser's site data. It is stored on the basis of Art. 6 (1) (f) GDPR, as we have a legitimate interest in showing the site in the mode you selected.

5. Analytics

We use Vercel Web Analytics to count page views and understand how our website is used. It works without cookies and without storing anything on your device, and it does not create individual user profiles or follow you across other websites. For each page view, it records the page address, the referring website, and your approximate country, device type, operating system and browser. To tell visits apart within a single day, Vercel uses a value derived from your IP address and browser that changes daily and cannot be traced back to you; your IP address itself is not stored. The address of a Delivery Sheet is never recorded: sheet pages are counted only as a generic Delivery Sheet page. This is done on the basis of Art. 6 (1) (f) GDPR, our legitimate interest in understanding and improving our website.

Vercel Web Analytics privacy information: https://vercel.com/docs/analytics/privacy-policy

We do not use any other analytics or tracking tools.

6. Third-party services

We use the following third-party services to provide and operate our application:

Anthropic (Claude API)

We use the Claude API by Anthropic to analyse uploaded photos and generate draft Delivery Sheets. For this purpose, a resized copy of your photo, its pixel dimensions, file size and file name are sent to Anthropic. Anthropic processes this data on our behalf to return the analysis; under its commercial terms, Anthropic does not use this data to train its models.

Privacy policy: https://www.anthropic.com/legal/privacy

Hosting, database and file storage

Our website, database and the images you upload are hosted by our infrastructure providers, who process this data on our behalf under data processing agreements in accordance with Art. 28 GDPR.

Cloudflare Turnstile (bot protection)

To protect photo uploads and our forms from automated abuse, we use Cloudflare Turnstile, provided by Cloudflare, Inc. (USA), in its invisible mode: nothing is shown to you. When you upload a photo or send a form, Turnstile checks in the background that the request comes from a person and not a bot. For this, Cloudflare processes information such as your IP address, details about your browser and device, and signals from how the page is used, as described in Cloudflare's Turnstile Privacy Addendum. We receive only the result of the check. This is done on the basis of Art. 6 (1) (f) GDPR, our legitimate interest in protecting the Service from abuse.

Turnstile Privacy Addendum: https://www.cloudflare.com/en-gb/turnstile-privacy-policy/

Resend (email delivery)

We use Resend to deliver notification emails to our own inbox. When you ask us to get in touch from a Delivery Sheet or send the contact form, your name, email address, company name (if given), message, and the link to your Delivery Sheet or the page you wrote from are sent through Resend to us. Resend processes this data on our behalf under a data processing agreement. We do not use Resend to send marketing emails.

Privacy policy: https://resend.com/legal/privacy-policy

Fonts

This website uses the typefaces Instrument Sans, designed by Instrument (https://github.com/Instrument/instrument-sans), and Geist Mono, designed by Vercel in collaboration with basement.studio (https://github.com/vercel/geist-font), both licensed under the SIL Open Font License 1.1. All fonts are served directly from our own website: your browser does not contact Google Fonts or any other third-party font service when you visit us.

7. Data transfers outside the EU/EEA

Some of the third-party services listed above, such as Anthropic, Cloudflare and Resend, may process data outside the European Union or European Economic Area. Where such transfers occur, they are carried out in compliance with GDPR requirements, including the use of Standard Contractual Clauses (SCCs) or other appropriate safeguards as required by Art. 46 GDPR. Users may contact us at the details listed in section 1 to obtain further information about the specific safeguards applied to such transfers.

8. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

• Uploaded images and draft Delivery Sheets that don't lead to a request are deleted 12 months after they were created. Delivery Sheets of customers, with their images, are kept for the lifetime of the product, for as long as we provide the service, unless you request earlier deletion.
• Contact request data is retained for as long as needed to handle your request and any resulting business relationship, subject to legal retention obligations such as accounting requirements.
• Messages sent through the contact form are kept only in our email inbox, for as long as needed to handle your request and any resulting business relationship.
• Server log files are retained by our hosting provider for a limited period in accordance with its retention policies.

Upon a deletion request, we will delete or anonymise personal data within 30 days, except where retention is required by law.

9. Data security

We use the widespread SSL (Secure Socket Layer) procedure in conjunction with the highest level of encryption supported by your browser. You can recognise whether an individual page of our website is transmitted in encrypted form by the closed display of the key or lock symbol in the lower status bar of your browser.

We also take appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

10. Timeliness and amendment of this data privacy statement

This data privacy statement is currently valid as stated on the page header.

Due to the further development of our website and offers or due to changed legal or official requirements, it may become necessary to amend this data privacy statement. The respectively current data privacy statement can be accessed and printed by you at any time on the website.

11. Definitions and legal references