Privacy Policy

1. Data Controller

The data controller responsible for processing your personal data is:

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Password (stored as cryptographic hash)
• Account type and organization name (if applicable)

2.2 Evidence Packages

When you use our capture service, we process and store:

• URLs of captured webpages
• Screenshots and HTML source code
• Network request logs (HAR files)
• Video recordings of capture sessions
• Cryptographic signatures and timestamps

2.3 Usage Data

We automatically collect:

• IP address
• Browser type and version
• Access times and dates
• Pages viewed and features used

3. Legal Basis for Processing

We process your personal data based on the following legal grounds (Art. 6 GDPR):

Where we rely on legitimate interest, we have conducted a balancing test to ensure your rights and freedoms are not overridden. You may request details of this assessment.

4. Data Storage and Security

Your data is stored securely with industry-standard encryption. We implement appropriate technical and organizational measures including:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• Regular security audits
• Access controls and authentication mechanisms
• Employee training on data protection

Evidence packages are stored in data centers within the European Union (Germany).

5. Data Retention

We retain your data for the following periods:

• Account data: For as long as your account is active, plus 30 days after deletion
• Evidence packages: Until you delete them or close your account
• Audit logs: 10 years (legal requirement for evidence services)
• Billing records: 10 years (tax law requirement)
• Usage analytics: 26 months (anonymized after 14 months)

6. Data Sharing and Processors

We do not sell your personal data. We share data with the following categories of recipients:

6.1 Service Providers

We use the following processors to operate our service:

• Hetzner Online GmbH (Germany) — Cloud hosting and infrastructure
• Paddle.com Market Ltd (UK) — Payment processing and merchant of record
• Bundesdruckerei GmbH / D-Trust (Germany) — Qualified timestamps

All processors are bound by Data Processing Agreements (DPA) in accordance with Art. 28 GDPR.

6.2 Other Disclosures

• Legal requirements: When required by law, court order, or government request
• Business transfers: In connection with a merger, acquisition, or sale of assets (you will be notified)

7. International Data Transfers

Your data is primarily processed within the European Union. When we transfer data outside the EU/EEA (e.g., to Paddle in the UK), we ensure appropriate safeguards:

• UK adequacy decision by the European Commission
• Standard Contractual Clauses (SCCs) where required
• Supplementary technical measures where required

You may request a copy of the relevant safeguards by contacting us.

8. Your Rights

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Access (Art. 15): Request a copy of your personal data
• Rectification (Art. 16): Correct inaccurate or incomplete data
• Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Restriction (Art. 18): Limit how we process your data
• Portability (Art. 20): Receive your data in a machine-readable format
• Objection (Art. 21): Object to processing based on legitimate interest
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise these rights, please contact us at [email protected]. We will respond within one month.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority for our company is:

9. Cookies

We use the following types of cookies:

Essential Cookies

Required for the service to function. No consent needed (Art. 6(1)(f) GDPR):

• Session cookies for authentication
• CSRF protection tokens
• User preferences (language, theme)

Analytics and Marketing Cookies

We do not use third-party tracking, advertising, or social media cookies. We do not participate in cross-site tracking.

10. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. Our fraud detection systems may flag suspicious activity for manual review, but final decisions are always made by humans.

11. Children's Privacy

Our service is not intended for persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have collected data from a minor, please contact us immediately for deletion.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 30 days before they take effect. The "Last updated" date at the top indicates when the policy was last revised.

13. Contact Us

For questions about this Privacy Policy or to exercise your rights:

Email:[email protected]

Contact Us:
Gradient Zero Deutschland GmbH
Vogesenring 57
79219 Staufen, Germany