Privacy Policy
Last updated: July 2026
1. Data Controller
Sanftware GmbH
Hasenau 18, A-4813 Altmünster
Email: hallo@ekkosync.com
2. Data Collected
We collect and process the following personal data:
- Email address (upon registration)
- Name / display name (upon registration)
- Usage data (access times, pages visited)
- Device information (browser type, operating system, IP address)
3. Legal Basis
Processing is based on Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract performance), and Art. 6(1)(f) GDPR (legitimate interests, e.g., platform security and operation).
4. Data Processors
We use the following service providers as data processors:
Supabase (EU/Frankfurt)
Database and authentication – servers in the EU (Frankfurt/Main). Supabase Inc., processes data on our behalf pursuant to Art. 28 GDPR.
Vercel Inc.
Hosting and delivery of the web application. Vercel Inc., USA – EU Standard Contractual Clauses apply.
Resend
Sending of authentication emails (sign-up, password reset). Resend Inc., USA – EU Standard Contractual Clauses apply.
Anthropic (via Vercel AI Gateway)
AI features (planning assistant). Only when you actively use the AI feature, the required content (idea titles and categories, happening title, description and location, and task texts) is transmitted to Anthropic via the Vercel AI Gateway. Recipients are Vercel Inc. and Anthropic PBC, USA – EU Standard Contractual Clauses apply. Pursuant to Anthropic's commercial terms, the content is not used to train AI models.
5. Cookies
This website uses only technically necessary cookies. No tracking or marketing cookies are used.
Authentication cookie (sb-*)
Technically necessary to maintain your login session. Deleted upon logout.
6. Data Retention
Your personal data is stored for as long as your user account exists. After account deletion, your data will be completely removed within 30 days, unless legal retention obligations apply.
7. Your Rights (Art. 15–22 GDPR)
You have the following rights regarding your personal data:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to withdraw consent (Art. 7(3) GDPR)
8. Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The competent authority depends on the federal state of your residence.
Provisionally approved. Further legal review pending.