Privacy Policy

1. Controller

2. Overview of processing

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects.

Types of data processed

• Master data (name, e-mail address)
• Payment data (Stripe transaction data)
• Usage data (pages visited, access times)
• Meta / communication data (IP addresses, browser type)

Categories of data subjects

• Customers and prospective buyers
• Website visitors
• Users of the download system

3. Legal bases

Below is an overview of the legal bases of the GDPR on which we process personal data:

• Consent (Art. 6(1)(a) GDPR) – The data subject has given consent to the processing (e.g. cookie consent).
• Performance of a contract (Art. 6(1)(b) GDPR) – Processing is necessary for the performance of a contract (e.g. order handling, provision of downloads).
• Legitimate interests (Art. 6(1)(f) GDPR) – Processing is necessary to safeguard our legitimate interests (e.g. operational security, abuse protection).

4. Hosting & CDN

Our website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). Vercel processes personal data (IP addresses, access times) in the course of providing the website.

A data processing agreement (DPA) is in place with Vercel. The transfer of data to the USA is based on the EU Standard Contractual Clauses.

5. Payment processing

For payment processing we use the service Stripe Inc. (510 Townsend Street, San Francisco, CA 94103, USA). Stripe processes payment data (card number, SEPA data) directly and in a PCI-DSS-compliant manner. We only receive a confirmation of payment.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

6. Authentication

For user authentication we use Supabase (Supabase Inc., USA). An e-mail address and a hashed password are stored. Data transmission is encrypted (TLS). Legal basis: Art. 6(1)(b) GDPR.

7. Cookies & tracking

We use technically necessary cookies required to operate the website. Additional cookies (analytics, marketing) are only set after your explicit consent via our cookie banner.

Technically necessary cookies

• Session cookie (Supabase Auth)
• Cookie-consent preference
• CSRF token

Optional cookies (only with consent)

• Google Analytics 4 – usage analysis
• Facebook Pixel – marketing / remarketing

You can withdraw your consent at any time via the cookie banner.

8. Product analytics (PostHog)

To analyse website usage and for session replays we use PostHog (PostHog Inc., USA). Processing takes place exclusively after your explicit consent via our cookie banner.

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TTDSG. The transfer of data to the USA is based on the EU Standard Contractual Clauses (Art. 46 GDPR).

You can withdraw your consent at any time via the cookie settings.

9. E-mail delivery (Resend)

For sending transactional and system e-mails (purchase confirmation, password, newsletter confirmation) we use Resend (Resend Inc., USA).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) or (f) (legitimate interest) or (a) (consent). The transfer of data to the USA is based on the EU Standard Contractual Clauses.

10. AI-generated content (OpenAI)

To create text and voice-over content we use services of OpenAI (OpenAI L.L.C., USA). No personal customer data is processed in this context.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest). The transfer of data to the USA is based on the EU Standard Contractual Clauses.

11. Storage period

We delete personal data as soon as the purpose of processing ceases to apply and no statutory retention obligations prevent deletion. The following periods apply in particular:

• Contract / invoice data: 10 years (§ 147 AO, § 14b UStG)
• Customer account data: until the account is deleted
• Newsletter data: until withdrawal / unsubscription
• Server log files: max. 30 days
• Support requests: up to 6 months after resolution

12. Newsletter & unsubscription

Our newsletter is only sent after your explicit consent using the double-opt-in procedure (confirmation link by e-mail). Legal basis: Art. 6(1)(a) GDPR (consent).

You can withdraw your consent at any time with effect for the future – via the unsubscribe link at the end of every newsletter e-mail or by e-mail to info@8ff.pro. After unsubscription your newsletter data is deleted.

13. Your rights

You have the following rights regarding your personal data:

• •Right of access (Art. 15 GDPR)
• •Right to rectification (Art. 16 GDPR)
• •Right to erasure (Art. 17 GDPR)
• •Right to restriction (Art. 18 GDPR)
• •Right to data portability (Art. 20 GDPR)
• •Right to object (Art. 21 GDPR)

To exercise your rights, please contact: info@8ff.pro

14. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

15. SSL / TLS encryption

For security reasons this site uses SSL / TLS encryption. You can recognise an encrypted connection by the address bar of the browser switching from „http://“ to „https://“ and by the lock symbol in your browser bar.

16. Download system & watermarking

When you download workflow bundles, a licence file (_license.json) is automatically embedded into the ZIP archive. It contains your user ID and the time of purchase to protect against unauthorised redistribution. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting digital products).