Privacy Policy
Information regarding the processing of personal data pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR / DSGVO)
1. Controller (Verantwortlicher)
The controller responsible for data processing on this website pursuant to Art. 4(7) GDPR is:
Thomas Kremer
Mülhauser Straße 6, 10405 Berlin, Germany
A Data Protection Officer (Datenschutzbeauftragter) is not legally required for this operation and has not been appointed (pursuant to Art. 37 GDPR and § 38 BDSG).
2. Server Log Files & Hosting
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit our website, Vercel automatically collects and processes technical server log files transmitted by your browser.
The technical data processed in these server logs includes:
- IP address of the accessing terminal device
- Browser type and browser version
- Operating system of the accessing device
- Referrer URL (the previously visited web page)
- Date and time of the server request
- Host name and requested page or resource
The legal basis for processing this technical data is Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest lies in the technical delivery, security monitoring, attack defense, and operational stability of our website. Log data is stored only for security purposes and is automatically deleted in accordance with Vercel's standard retention schedules. Data transfer to Vercel Inc. in the USA is protected by EU Standard Contractual Clauses (SCCs) and Vercel's certification under the EU-U.S. Data Privacy Framework.
Vercel Web Analytics (Cookieless)
We use Vercel Web Analytics, provided by Vercel Inc. (USA), to analyze traffic and optimize website performance. Vercel Web Analytics operates completely cookieless without storing persistent tracking cookies on your device. Technical request telemetry (visited path, referrer, device type, browser, and geographic country or region derived from the IP address) is processed using ephemeral cryptographic hashes. IP addresses are not stored permanently. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in technical optimization and reach measurement without user profiling). Data transmission to Vercel Inc. in the USA is safeguarded under the EU-U.S. Data Privacy Framework (DPF) and EU Standard Contractual Clauses.
3. Sub-Processors & Infrastructure Providers (Art. 13 & 14 GDPR)
To provide our digital calculation engine, cloud project persistence, payment processing, and transactional notifications, we engage specialized sub-processors pursuant to Art. 28 GDPR:
Supabase Inc. (Cloud Database & Storage)
We use Supabase Inc. (970 Toa Payoh North #07-04, Singapore 318992) to store saved project states, tile configurations, and room dimensions. All databases and project backups are hosted exclusively in the European Union (Frankfurt, Germany region, AWS eu-central-1). Personal data is processed on the basis of Art. 6(1)(b) GDPR (contract performance) under a Data Processing Agreement (DPA) including EU Standard Contractual Clauses (SCCs).
Lemon Squeezy, LLC (Merchant of Record & Payments)
All payment transactions, invoice generation, and sales tax / EU VAT processing are handled by our Merchant of Record, Lemon Squeezy, LLC (222 S. Main Street, Suite 500, Salt Lake City, UT 84101, USA). When you unlock a blueprint, Lemon Squeezy collects your payment details and billing address. To enable the checkout overlay, our website loads the client script lemon.js from assets.lemonsqueezy.com. Data processing is based on Art. 6(1)(b) GDPR (contract execution), Art. 6(1)(c) GDPR (statutory tax compliance), and Art. 6(1)(f) GDPR (secure checkout delivery). International data transfers are safeguarded via EU Standard Contractual Clauses (SCCs).
Resend, Inc. (Transactional Email Dispatch)
We utilize Resend, Inc. (2261 Market Street #5039, San Francisco, CA 94114, USA) to dispatch transactional emails containing your permanent access link and project receipt. Resend processes your email address solely to deliver these system notifications. The legal basis is Art. 6(1)(b) GDPR (contract fulfillment). Transfers to Resend are secured under a Data Processing Agreement and EU Standard Contractual Clauses (SCCs).
PostHog Inc. (Cookieless Analytics & Product Intelligence)
We utilize PostHog Inc. (EU Cloud Region, Frankfurt Germany, AWS eu-central-1) for privacy-friendly audience measurement and funnel analytics. PostHog operates in strict cookieless mode: zero cookies and zero device storage (localStorage/sessionStorage) are utilized pursuant to § 25(2) TDDDG and Art. 5(3) ePrivacy Directive. Telemetry is routed through our first-party reverse proxy (/ingest) where IP addresses are immediately anonymized via daily-salted ephemeral hashes without storing raw IPs or creating persistent person profiles (person_profiles: 'never'). Processing is based on Art. 6(1)(f) GDPR (our legitimate interest in aggregate audience measurement and feature optimization without user profiling). A Data Processing Agreement (DPA) including EU Standard Contractual Clauses (SCCs) is in place pursuant to Art. 28 GDPR. Pursuant to your Right to Object (Art. 21 GDPR), our analytics architecture strictly honors browser privacy signals including 'Do Not Track' (DNT) and 'Global Privacy Control' (GPC) (respect_dnt: true), automatically suppressing telemetry collection.
All third-party sub-processors are bound by strict Data Processing Agreements (DPAs) pursuant to Art. 28 GDPR ensuring data confidentiality and GDPR-compliant technical and organizational measures.
4. Cookies & Tracking Disclosure
All room dimension calculations, tile geometry calculations, and visual layout previews are processed entirely on the client side in your web browser. We do not transmit or store your room measurements or tile configurations on our servers for advertising, marketing, or user profiling.
URL query parameters (for sharing layouts) and browser local storage (specifically storing your selected measurement unit preference under key tileria_unit_system and calculation draft under key tileria_calculator_draft to preserve your work pursuant to § 25(2) No. 2 TDDDG) are used exclusively on the client side to preserve and restore your layout calculations. No persistent cross-site tracking mechanisms or marketing cookies are used.
Our product analytics (PostHog EU) operates completely cookieless in volatile browser memory without reading or writing to your device storage (zero cookies, zero localStorage/sessionStorage, and zero device fingerprinting). Telemetry requests are routed through our first-party reverse proxy with daily-salted ephemeral IP hashing, ensuring aggregate usage statistics without individual profiling. Pursuant to § 25(2) TDDDG and Art. 5(3) ePrivacy Directive, no cookie consent banner is required. Furthermore, pursuant to Art. 21 GDPR, your Right to Object is respected automatically via browser 'Do Not Track' (DNT) and 'Global Privacy Control' (GPC) signals (respect_dnt: true).
5. Local Typography / Web Fonts
This website uses the typography font family Geist provided via Next.js Font Optimization (next/font/google).
The font files are downloaded and bundled locally on the web server at build time and served directly from our own domain. When you access our website, no connection is established to Google servers, and no personal data (such as your IP address) is transmitted to Google or any other third-party font provider.
6. User Rights under GDPR
As a data subject, you have the following rights under Chapter III of the GDPR regarding personal data concerning you:
Right of Access (Art. 15 GDPR)
You have the right to request confirmation as to whether personal data concerning you is being processed, and to obtain information about such data.
Right to Rectification (Art. 16 GDPR)
You have the right to obtain without undue delay the rectification of inaccurate personal data or completion of incomplete personal data.
Right to Erasure / 'Right to be Forgotten' (Art. 17 GDPR)
You have the right to obtain the erasure of personal data concerning you where one of the statutory grounds applies, provided that statutory retention duties do not require its retention.
Right to Restriction of Processing (Art. 18 GDPR)
You have the right to request the restriction of data processing where statutory conditions are met.
Right to Data Portability (Art. 20 GDPR)
You have the right to receive personal data concerning you in a structured, commonly used, and machine-readable format.
Right to Object (Art. 21 GDPR)
You have the right to object at any time to the processing of personal data concerning you based on Art. 6(1)(e) or (f) GDPR.
Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)
You have the right to lodge a complaint with a competent data protection supervisory authority (Datenschutzaufsichtsbehörde), in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
The competent supervisory authority for Berlin is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany.
7. Data Protection Inquiries
If you have questions regarding data protection or wish to exercise any of your rights under the GDPR, please contact the controller using the contact details provided in the Controller section above.
When you submit an inquiry via our contact form, your email address and message are processed solely to respond to your inquiry based on Art. 6(1)(b) GDPR (pre-contractual inquiries) or Art. 6(1)(f) GDPR (general communication). Transient client IP addresses are evaluated in volatile server memory solely for DDoS and spam defense (rate limiting) and are not stored in persistent databases.