Privacy policy

This English version is provided for convenience. Only the German version is legally binding.

As of: release date

This policy explains which personal data we process when you visit this website, order from us and manage your instance in the dashboard. You are responsible for the data of your community's members; we only process it on your behalf (section 9).

1. Controller
2. The short version
3. Visiting this website
4. Contact by email or phone
5. Orders and the dashboard
6. Payment through Stripe
7. Emails from us
8. Status page
9. Data in your instance
10. Recipients and third countries
11. Retention
12. Your rights

1. Controller

We are not required to appoint a data protection officer. check: § 38 BDSG

2. The short version

• This website sets no cookies (not even when you order) and uses no tracking, no analytics and no third-party content (fonts and images come from our own server).
• The dashboard only uses cookies that are strictly necessary for signing in and for your language.
• Your community's content is stored in Germany, backups in France. Payments go through Stripe.
• We don't sell data and don't use it for advertising.

3. Visiting this website

This website is delivered through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you open it, Cloudflare processes technically necessary connection data: IP address, time, requested address, browser identifier (user agent) and the previous page (referrer). This is needed to deliver the site and protect it from attacks.

The legal basis is our legitimate interest in a secure and fast website (Art. 6(1)(f) GDPR). We don't keep access logs of this website ourselves. Cloudflare keeps security-related data according to its own rules check Cloudflare retention; see Cloudflare's privacy policy.

4. Contact by email or phone

When you write to us or call, we process your details to answer: name, contact details and the content of your message. The legal basis is Art. 6(1)(b) GDPR where a contract or order is concerned, otherwise our legitimate interest in replying (Art. 6(1)(f) GDPR). Our mailboxes are on our own mail server in Germany; no external email provider is involved.

We delete messages once the matter is closed, unless we have to keep them (for example as business correspondence, up to 6 years under § 257 HGB).

5. Orders and the dashboard

For orders through the order form on this website and for your dashboard at app.giegler.software we process:

• your email address and, if you give it, your name,
• the plan, the address you want for your instance and the optional description of your community,
• your language setting,
• sign-in data: one-time sign-in links by mail (valid for 15 minutes) and, if you set them up, passkeys (we only store their public key),
• what happens in your account: orders, plan changes, exports, cancellations, maintenance windows and your instance's resource usage.

The legal basis is performing the contract and the steps before it (Art. 6(1)(b) GDPR). We check every new order by hand to prevent abuse (Art. 6(1)(f) GDPR).

Cookies in the dashboard: a session cookie keeps you signed in (up to 30 days or until you sign out), and a language cookie remembers English or German (1 year). Both are strictly necessary for the service (§ 25(2) no. 2 TDDDG) and aren't used for anything else.

The dashboard runs on Cloudflare Workers; account data is stored in a Cloudflare D1 database check the D1 region, e.g. Western Europe.

6. Payment through Stripe

We process payments through Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter your payment details directly with Stripe; we never receive them. We pass Stripe your email address, the plan and an order number and get the payment status back.

The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for keeping invoice records. Stripe is a controller in its own right for fraud prevention and its own legal duties; see Stripe's privacy policy. Stripe may transfer data to Stripe, Inc. in the USA (section 10).

7. Emails from us

We only send you emails that belong to the contract: sign-in links, order and payment confirmations, and notices about maintenance, outages, exports and cancellations. There is no newsletter. We send these mails through Cloudflare (Email Service). The legal basis is Art. 6(1)(b) GDPR.

8. Status page

status.fluxer.software publicly shows whether our services are reachable. It shows no people. If you switch the language, the page sets a language cookie (1 year). Each instance has a private status link that only its customers receive.

9. Data in your instance

Everything stored in your Fluxer instance (your members' accounts, messages, files, connection data) we process as a processor on your behalf (Art. 28 GDPR). You, as the operator of the community, are the controller. The details are in our data processing agreement.

If you're a member of a community we host, please contact that community's operators first with questions about your data. We forward requests that reach us to them.

Where the data lives: instances run on our own servers in Germany or on OVHcloud servers in Frankfurt am Main. Files are stored with OVHcloud in Frankfurt am Main, backups with OVHcloud in Strasbourg (France). Access from the internet goes through Cloudflare.

10. Recipients and third countries

We have agreements under Art. 28 GDPR with everyone who processes data for us. Transfers to the USA rely on the adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, otherwise on standard contractual clauses (Art. 46(2)(c) GDPR).

We only hand data to authorities where the law requires us to.

11. Retention

If the law or an authority requires us to keep data (for example an order to preserve evidence), we keep a separate copy with restricted access until that duty ends.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). Write to legal@giegler.software.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Die Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

Your details are needed to place an order; without them we can't conclude the contract. There is no automated decision-making within the meaning of Art. 22 GDPR; a person checks every order.