Privacy policy
In short: without an account, your processes stay in your browser. We do not use analytics or tracking services. The site is hosted on Cloudflare; the database is located in the EU. The operator is a German company, so the EU General Data Protection Regulation (GDPR) applies to all visitors.
1. Controller
C-led Solutions GmbH, Feringastraße 9a, 85774 Unterföhring, Germany. Managing directors: Thomas Rosenstiel, Erik Reisig. Email: [email protected], phone: +49 89 809 1314 60. More details in the legal notice.
2. Hosting, delivery and server logs
The application runs on Cloudflare (Pages, Workers, D1 database, R2 object storage, Durable Objects). When you open the site, Cloudflare processes technically necessary data such as IP address, time, requested URL, browser identifier and referrer to deliver the site and fend off attacks. The legal basis is Art. 6 (1) (f) GDPR (secure and stable operation).
Cloudflare, Inc. (101 Townsend St, San Francisco, USA) processes this data as our processor under Art. 28 GDPR on the basis of the Cloudflare Data Processing Addendum including the EU Standard Contractual Clauses. Cloudflare is certified under the EU-U.S. Data Privacy Framework. The database is set up in the EU region.
3. Use without an account
Without an account, the editor stores your processes only in your browser's local storage (localStorage). Content is not sent to us unless you deliberately create a share or live link or send your process to your computer with "Send me the link". Your language setting and view options are also stored locally. This storage is strictly necessary for the function you request (Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).
4. Account and cloud storage
When you sign in, we store your email address and, optionally, a display name and branding (company name, logo). Sign-in uses a one-time 6-digit code sent by email; there are no passwords. The session is kept as a hashed token in an HttpOnly cookie for 30 days.
Saved processes, versions, metric histories, tags, folders, comments, action items and uploaded background images are stored in the database or object storage and are visible only to your account. The legal basis is Art. 6 (1) (b) GDPR (provision of the service).
5. Share and live links, mobile capture
Share links show a process read-only, without an account. Guests can optionally leave comments with a name; to prevent abuse we store the IP address only as a hash. Live links allow joint editing; guests enter a display name that other participants see. With mobile capture, times and reported problems are transferred to the process of the account. All links are random 144-bit tokens and the owner can end them at any time.
6. Emails and feedback
We send system emails (sign-in codes, comment notifications, action item reminders) via Cloudflare Email Sending from [email protected]. With "Send me the link" (on a phone) we email you a link once, at your request, so you can open the application on your computer. We use the address only for this one email and never for marketing. We store only a hash of the address and its domain (abuse prevention, measuring whether the link was opened on a computer), a hash of your IP address and, only if you choose so, the process you sent along; the entry is deleted after 30 days. Feedback from the editor is stored with category, text, an optional email address and technical figures (without the content of your process) and forwarded to our team by email. The legal basis is Art. 6 (1) (b) or (f) GDPR.
7. Fonts and external content
We serve fonts ourselves; no connection is made to Google Fonts or other font providers. No external content such as videos or maps is embedded. Links to c-led.net and other sites connect to the respective provider only when you click them.
8. Retention
Processes remain stored until you delete them; versions, shares, comments and images are removed with them. Sign-in codes expire after 10 minutes, sessions after 30 days, links from "Send me the link" including any process sent along also after 30 days; if you delete your account, we delete them immediately as well (including links sent to your account address without signing in). You delete your account yourself in the account settings with "Delete account" (confirmed with a code by email); there you can first download all data stored for your account as a file with "Download data", including links from "Send me the link". Alternatively, an email to [email protected] is enough. We delete feedback once it has been handled and is no longer needed.
9. Security
Data is transmitted only in encrypted form (TLS, HSTS) and stored encrypted at Cloudflare. Sign-in codes and session tokens are stored only as hashes. Write requests are protected against cross-site request forgery (CSRF). Only the administrators of C-led Solutions GmbH have access to the production environment, with two-factor authentication.
10. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. You can lodge a complaint with a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
11. No automated decision-making
There is no automated decision-making, including profiling, under Art. 22 GDPR.