Privacy

The German version of these details is the authoritative one. This English version is a translation.

Controller

The controller within the meaning of the General Data Protection Regulation is Leafcutter UG (haftungsbeschränkt), Schlesische Straße 26, 10997 Berlin, Germany. We answer questions about data protection at kontakt@leafcutteros.ai.

This policy applies to the website leafcutteros.ai, the members area app.leafcutteros.ai and the package registry packages.leafcutteros.ai.

Hosting and backups

The website, the members area, the database, the registry and the reach measurement run on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in the Nuremberg data centre. We have a data processing agreement with Hetzner under Article 28 of the General Data Protection Regulation.

We back up the database every night. The backups stay on the server for seven days and are also transferred to Hetzner storage in Helsinki, Finland, where each backup is deleted after 14 days. Deleted data therefore disappears from the backups as well at the latest three weeks after deletion.

When you open the website

So that a page can be delivered, your browser transmits technically necessary data to our server, including your IP address. The website uses it only to deliver the page and keeps no access logs. The legal basis is Article 6(1)(f) of the General Data Protection Regulation; our legitimate interest lies in operating the site.

We maintain the content of the website and the members area in the content management system Sanity. Our server fetches it from there; your browser makes no connection to Sanity, not even for images.

Fonts

We serve the fonts Newsreader, Schibsted Grotesk and DM Mono from our own server. Your browser makes no connection to Google for them.

Cookies and embeds

The website sets no cookies and embeds no content from third-party servers. How we measure its reach is set out under "Reach measurement".

After you sign in, the members area sets a cookie that keeps your session (sb-api-auth-token). Signing in is not possible without it. It stays until you sign out, for at most 400 days. While you sign in through Google, GitHub or Microsoft, a second cookie that secures the sign-in is added briefly. Both are strictly necessary within the meaning of § 25(2) no. 2 TDDDG and need no consent. That is why there is no consent banner.

Reach measurement

To see which pages are read and where visits come from, we measure the reach of the website with Matomo. Matomo runs on our own server (see "Hosting and backups"); the data goes to no one else.

Matomo sets no cookies and stores nothing in your browser. With every page view your browser transmits to Matomo the address and title of the page, the page you came from, browser, operating system, language and screen resolution, and your IP address. If you click a link to another website or a download, Matomo also learns its address. Matomo shortens the IP address by two bytes before storing it; 203.0.113.42 becomes 203.0.0.0. Page views in quick succession are combined into one visit. Only aggregated figures are evaluated; a log of individual visits is switched off. We delete the individual page views after 90 days, so that we can evaluate origins and campaigns over a quarter; the aggregated figures remain.

If "Do Not Track" is switched on in your browser, Matomo does not measure you. This is how you can object to the measurement at any time.

The legal basis is Article 6(1)(f) of the General Data Protection Regulation; our legitimate interest lies in recognising which content is read and shaping the website accordingly.

Logs

Some of our services write logs to find errors and detect misuse:

• the sign-in interface of the members area: for each request the time, the address requested, the browser identifier and the IP address, and on sign-in also the email address
• the package registry: for each request the time, the IP address, the package requested and the result
• the mail server: for each email the time and the sender and recipient addresses
• the reach measurement: for each request the time, the IP address, the browser identifier and the measurement data transmitted

We delete all logs after 14 days. The legal basis is Article 6(1)(f) of the General Data Protection Regulation; our legitimate interest lies in operating the services securely.

Email

Our mailboxes and the sending of emails are provided by Google (Google Workspace, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). This concerns messages you write to us and emails our systems send, such as the confirmation of your address or the notification about a sign-up for the waitlist. A transfer to the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework.

Getting in touch

If you write to us, we process your details in order to answer the enquiry. The legal basis is Article 6(1)(b) or (f) of the General Data Protection Regulation. We keep the message for as long as the matter requires and delete it afterwards, unless a statutory retention obligation applies.

Waitlist

When you join the waitlist, we process your name and your email address, and optionally your organisation, your role and your message. We also automatically store the point on the site from which you signed up, and the time of your consent and of the entry being created. We use these details to tell you about the launch of Leafcutter OS and to answer your enquiry. The legal basis is your consent under Article 6(1)(a) of the General Data Protection Regulation.

The details are held in our database. We notify our team of every sign-up by email; that email runs through Google Workspace (see "Email").

We do not store an IP address. To limit repeated sign-ups we create a value for 24 hours that cannot be traced back, and it deletes itself afterwards. The legal basis for that is Article 6(1)(f) of the General Data Protection Regulation; our legitimate interest lies in protecting the waitlist against mass sign-ups.

You can withdraw your consent at any time — a message to kontakt@leafcutteros.ai is enough, and we will delete your entry. At the latest when the purpose no longer applies, we delete it ourselves.

Account in the members area

For an account we process your email address and your password. We store the password only as a hash. At registration we check whether the password appears in known data breaches; for this only the beginning of a hash goes to the service "Have I Been Pwned", never the password and never your address. You confirm your address through a link we send you by email.

We also store when the account was created, when the address was confirmed and when the last sign-in took place.

If your address belongs to a domain for which a company holds a Business licence, we assign your account to that company. Otherwise we keep it as a personal account.

The legal basis is Article 6(1)(b) of the General Data Protection Regulation. An account remains until you have it deleted; a message to kontakt@leafcutteros.ai is enough. Data we have to keep for tax or commercial law reasons is blocked until the retention period ends.

Team with a Business licence

With a Business licence, all persons of the company can see in the members area who else belongs to it: email address and role (admin or member). Admins purchase and manage the licence and grant the role. Whoever can see the addresses belongs to the same domain through their own confirmed address. The legal basis is Article 6(1)(b) and (f) of the General Data Protection Regulation; our legitimate interest and that of the company lie in the persons of a company knowing who manages the shared licence.

Sign-in through Google, GitHub or Microsoft

Instead of a password you can sign in through an existing account with Google, GitHub or Microsoft. Your browser then redirects you to that provider; after your consent there we receive your email address, an identifier of your account and, depending on the provider, your name and your profile picture. We only accept confirmed addresses. If an account with the same address already exists, we connect the two.

The providers are Google Ireland Limited (Dublin, Ireland), GitHub, Inc. (San Francisco, USA) and Microsoft Ireland Operations Limited (Dublin, Ireland). With GitHub, and possibly with Google and Microsoft, data is transferred to the USA; all three are certified under the EU-US Data Privacy Framework. What the provider itself processes during sign-in is governed by its own privacy policy.

The legal basis is Article 6(1)(b) of the General Data Protection Regulation.

Licence purchase

You purchase a licence through Stripe Checkout. The seller is Link, LLC, a company of the Stripe group. At checkout Link collects the company name, billing address, payment details and, if you provide it, your VAT identification number, and processes them for payment, invoicing and tax under its own responsibility. Link's privacy policy applies.

We transmit to Stripe your email address, the name of your account in the members area (your email address for Personal, the domain for Business) and an internal identifier. Stripe tells us whether and until when the licence is valid and whether it renews. Payment details never reach us. We can see the billing address and tax number in our Stripe account but do not store them in our systems.

The legal basis is Article 6(1)(b) of the General Data Protection Regulation, and for retention Article 6(1)(c) in conjunction with the retention periods under commercial and tax law.

Package registry

For the registry you create access tokens in the members area. For each token we store its name, when it was created, until when it is valid, whether it has been revoked and when it was last used. The service that checks the tokens logs neither the token nor the IP address; the registry itself logs requests as described under "Logs".

The legal basis is Article 6(1)(b) of the General Data Protection Regulation. We delete tokens together with your account.

Recipients at a glance

• Hetzner Online GmbH: servers, database, backups (processor)
• Google Ireland Limited: email, sign-in through Google (processor, or independent controller for sign-in)
• GitHub, Inc.: sign-in through GitHub (independent controller)
• Microsoft Ireland Operations Limited: sign-in through Microsoft (independent controller)
• Link, LLC and Stripe: purchase, payment, invoicing (see "Licence purchase")
• Have I Been Pwned: password check, without personal reference

Your rights

You have the right to information, rectification, erasure, restriction of processing, data portability and objection. You can withdraw a consent at any time with effect for the future.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.