Privacy policy
This policy explains which personal data we process when you use Prepkit, and what your rights are.
Controller
The controller is [Name bzw. Firma], [Straße und Hausnummer], [PLZ Ort], Deutschland. Email: [kontakt@example.com].
Hosting
Prepkit runs on our own servers in the EU at [Hosting-Anbieter, z. B. Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen], which processes data on our behalf (Art. 28 GDPR). Legal basis: Art. 6(1)(b) and (f) GDPR.
Account and sign-in
For your account we store your email address, display name and language. You sign in with a magic link sent to your email. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
Content
What you create — projects, moodboard images and notes, shots, equipment, kits, packing lists and comments — is stored to provide the service. Members of your workspace can see it. With a share link, guests can view and comment on a moodboard; their name is stored only in their browser and with the comments they post.
Emails
Sign-in links and invites are sent through [E-Mail-Versanddienst für Anmeldelinks und Einladungen] as a processor. It processes the recipient address and the email content.
Cookies and local storage
We only set strictly necessary cookies: for sign-in (session), your language and the workspace you used last. Guest names on share links live in the browser's local storage. No consent is required for these (§ 25(2) TDDDG). We don't use tracking cookies.
Payments
Paid plans are sold by Paddle.com Market Ltd. as merchant of record, which is responsible for payment data, invoices and taxes. We only receive subscription details (plan, status, term) and a customer id from Paddle. Paddle's privacy policy also applies.
Server logs
When you use Prepkit, the server keeps technical logs (IP address, time, requested address) for up to 14 days to fend off attacks and find errors (Art. 6(1)(f) GDPR). To prevent abuse we also count requests per user or per share link and IP address; these counters are deleted after one day at most.
Retention
We keep your data as long as your account exists. Deleted content is first marked as deleted and then removed for good; backups are overwritten after 30 days at most. Statutory retention duties remain unaffected.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). Email us at [kontakt@example.com].
Right to complain
You can lodge a complaint with a data protection supervisory authority, in particular in the member state where you live.