This page is a translation. The German version is binding.
Controller
Jochen Hilgers, Reiherweg 53, 50829 Köln, Germany, hello@stashu.app.
What we process and why
Account
Your email address and settings, and when you sign in with Google, your Google account id, name and profile picture; otherwise a hash of your password.
Legal basis: Art. 6(1)(b) GDPR.
Emails
We only send the mails your account needs, such as confirming your address or resetting your password. No marketing, no tracking.
Legal basis: Art. 6(1)(b) GDPR.
Collections
What you enter: collections, items, photos, documents, share links, imports and exports. A share link shows its content to anyone who has the link.
Legal basis: Art. 6(1)(b) GDPR.
Last use
When you last used stashu, to recognise abandoned accounts.
Legal basis: Art. 6(1)(f) GDPR.
Server logs
For each request, the IP address, user agent, address requested and, when you are signed in, your account id, to run the service and prevent abuse.
Legal basis: Art. 6(1)(f) GDPR.
Telemetry
Technical measurements of requests, to find errors. They can include your account id, but no IP addresses, names or email addresses.
Legal basis: Art. 6(1)(f) GDPR.
Messages to us
Your address and message, to reply to you.
Legal basis: Art. 6(1)(b), (c) or (f) GDPR.
Account administration
When we suspend or delete an account, we record what we did and why.
Legal basis: Art. 6(1)(f) GDPR.
Recipients
These providers process data on our behalf (Art. 28 GDPR):
- Vercel Inc. (USA): hosting the website, Frankfurt.
- Google LLC (USA): API, files, server logs and backups, EU.
- Dash0 Inc. (USA): telemetry, the Netherlands.
- Neon Inc. (USA): database, Frankfurt.
- Plus Five Five, Inc. (Resend, USA): sending email, Ireland.
- Heinlein Hosting GmbH (mailbox.org, Berlin): our mailbox.
When you sign in with Google, Google is responsible for that itself.
Transfers outside the EU
The data is stored in the EU, but the US providers above may access it from the USA. The basis is the EU standard contractual clauses (Art. 46(2)(c) GDPR), and for certified providers also the EU-US Data Privacy Framework (Art. 45 GDPR).
How long we keep it
- Your account and its content: until you delete the account, in the settings or by writing to hello@stashu.app.
- Deleted files and exports: 7 days.
- Backups: 30 days.
- Server logs: 30 days.
- Telemetry: up to 13 months.
- Emails at Resend: 30 days.
- Account administration records: as long as we need them as evidence.
- Messages to us: until dealt with; requests about your rights three years.
- Cookies: as listed under Cookies and local storage.
Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15 to 18, 20 and 21 GDPR).
You can complain to a data protection supervisory authority (Art. 77 GDPR).
Do you have to provide data?
An account needs an email address. No law requires you to provide anything.
Automated decisions
None, and no profiling (Art. 22 GDPR).