Privacy policy

Controller

Daniel Schreiner
Rostocker Straße 39a
49090 Osnabrück
Germany
Email: info@slait.io

In short

This website sets no cookies of its own. The Slait account at app.slait.io sets only the cookies needed to log in. Neither shows ads or uses analytics or tracking services. Fonts, images and scripts come from our own server; opening a page makes no connection to Google or any other third party. We process personal data only to provide the website and the account, to answer your request, to perform our contracts and where the law requires it.

Hosting and delivery

The website is delivered through Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). With every visit Cloudflare processes technically necessary data such as your IP address, the page requested, the date and time, and details of your browser and operating system, to deliver the site and protect it from attacks. The legal basis is our legitimate interest in a secure and fast website (Art. 6 (1) (f) GDPR).

Cloudflare processes the data on our behalf (Art. 28 GDPR) and is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). To protect against attacks, Cloudflare may set technically necessary cookies, which need no consent (§ 25 (2) no. 2 TDDDG).

The questionnaire

When you send the questionnaire, we receive your answers (what you need, for which business, by when), your optional message, your email address, and the language and page on which you filled it in. We use them only to answer your request. The legal basis is taking steps at your request before a contract (Art. 6 (1) (b) GDPR).

To send it we use the service Web3Forms (Web3Creative, Kerala, India), which forwards the details to our mailbox. Its servers are in the USA. By its own account, Web3Forms does not store the content and deletes server logs every two months. There is no adequacy decision of the European Commission for India, and the EU-US Data Privacy Framework does not apply to this provider; the transfer takes place because it is necessary for the reply you asked for (Art. 49 (1) (b) GDPR). If you prefer not to use it, write to us directly at hello@slait.io.

Email

Emails to addresses at slait.io are forwarded through Cloudflare Email Routing (Cloudflare, Inc., as above) to a mailbox at Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google may also process data in the USA and is certified under the EU-US Data Privacy Framework. We use your email and contact details to answer your message (Art. 6 (1) (b) GDPR, for general questions Art. 6 (1) (f) GDPR).

The Slait account

Slait's clients have an account at app.slait.io. It holds your name, your company and town, your email address for logging in, your websites and services with plan and prices, the recorded working time, change requests and chat messages with the photos and PDFs you attach, answers from the questionnaire, invoices and payment method, referral codes and credit, plan changes, cancellations and their withdrawal, a month we give you free, your setting for emails about steps in between, the language and theme you choose, and a copy of your website. This information comes from you, from your company or from our contract. The account also stores when we invited you and when you last logged in, and while you are logged in, the IP address and browser of your session. If you have not chosen a language, we take your browser's when you first log in; our emails to you use it too.

We use this data to perform our contracts: to handle requests, record and bill working time, look after your website and show you everything in the account (Art. 6 (1) (b) GDPR). If you are listed as a company's contact person, the legal basis is our legitimate interest in performing the contract with that company (Art. 6 (1) (f) GDPR). The IP address and browser are used only to protect the account (Art. 6 (1) (f) GDPR).

You log in without a password, with a code or link sent by email. The button in an email about your request logs you in too; that link is good for seven days and works once. For this the account sets technically necessary cookies, which need no consent (§ 25 (2) no. 2 TDDDG). They are deleted when you log out and otherwise expire 400 days after their last use at the latest. Anyone who does not log in does not get them. If you open a request without being logged in, one more cookie remembers for an hour where you wanted to go and is deleted when you log in. If you enter your address for a code, one more cookie remembers that address for an hour, so that the code screen stays open, and is deleted when you log in.

The account also stores in your browser what concerns only this device: which changes you have already looked at, whether you closed the note about the app, a questionnaire not yet sent, and the offline page. This stays on your device and serves only to make the account work (§ 25 (2) no. 2 TDDDG).

Notifications on your device only come if you turn them on there. The account then stores the address your browser gives this device, with two keys, and sends you a short notification, for example when we have answered a request. The notification is encrypted and can only be read on your device. It is delivered through the notification service of the maker of your device or browser, under that maker's own responsibility: Apple (Apple Distribution International Ltd., Ireland), Google (Google Ireland Limited, Ireland), Mozilla (Mozilla Corporation, USA) or Microsoft (Microsoft Ireland Operations Limited, Ireland). That service learns your device's address, when a notification arrives and how large it is, but not what it says. It may also process data in the USA. The legal basis is your consent, which you give by turning notifications on (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw it at any time by turning them off in the account or in your device's settings. We delete the address when you turn them off, when you log out, and as soon as the service reports that the device no longer exists.

Our monitor at uptime.slait.io checks from outside every five minutes whether your website can be reached. For each website and day it stores only the number of checks and of failures. It processes no data about visitors or from the account.

Services for the account

Three services work on our behalf for the account and our emails (Art. 28 GDPR).

Supabase (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513) runs the database, file storage and login. The data is held in Frankfurt am Main. Photos and PDFs you attach go there directly from your browser; in the account only you and we can see them. For operations and support, Supabase and its sub-processors may access it from Singapore and the USA. The European Commission's standard contractual clauses apply to this (Art. 46 (2) (c) GDPR).

Cloudflare (Cloudflare, Inc., as above) runs the account and the monitor through Cloudflare Workers. What is said under Hosting and delivery applies.

Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) sends our emails from slait.io, such as login codes and links, invitations, confirmations and notices about your requests. For this Resend receives the recipient's address, the subject and the content of the email. Emails are sent from Ireland and stored in the USA. The European Commission's standard contractual clauses apply to this (Art. 46 (2) (c) GDPR); by its own account, Resend also takes part in the EU-US Data Privacy Framework (Art. 45 GDPR).

New requests and messages you write in the account also reach us by email, and we hear by email when you send files or approve or decline an estimate. The section on email applies to them. For photos and PDFs we get only a note that something has arrived, without the file and without its name.

Cancel contracts here

At app.slait.io/kuendigen you can cancel contracts without logging in. We store the kind of cancellation, the reason for an extraordinary one, your name, your email address, the contract, the date you ask for, the end date, the time it arrived and when we dealt with it. If the address matches an account, we link the cancellation to that account. The confirmation goes to the address you give, and a copy to us. The legal basis is performing the contract (Art. 6 (1) (b) GDPR), for consumers also § 312k BGB (Art. 6 (1) (c) GDPR).

How long we keep data

We delete requests once they are dealt with and no order follows. If an order follows, we keep the business correspondence for as long as the law requires, above all § 147 AO (Art. 6 (1) (c) GDPR).

Your Slait account stays as long as a contract with us is running. We delete it three months after the end of the last contract. What we must keep we hold separately until the legal period ends: invoices and what they are based on for eight years, business letters such as cancellations and messages for six years, each from the end of the calendar year (§ 147 AO, Art. 6 (1) (c) GDPR). We delete photos and PDFs from requests together with the account; the line in the chat that names them stays with the message, with the file name.

Cloudflare and Supabase delete technical logs after seven days at most. Resend deletes emails and sending data after 30 days.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to info@slait.io.

You may also complain to a data protection supervisory authority, for example the one responsible for us:
Der Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover, Germany

Encryption

The website and the account are only transmitted encrypted (TLS).