1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
A38 digital processing GmbH
Bürgermeister-Finsterwalder-Ring 10
82515 Wolfratshausen
Germany
Email: datenschutz@a38dp.io
2. Collection and storage of personal data
When you visit our websites www.a38dp.io and www.appster.eu, the browser on your device automatically sends information to the server of the respective website. This information is temporarily stored in a so-called log file.
The following information is collected without any action on your part and stored for 30 days and then deleted automatically: the IP address of the requesting computer, the date and time of access, the name and URL of the file retrieved, the website from which access was made (referrer URL), the browser used and, where applicable, the operating system of your computer, and the name of your access provider. The processing is based on Art. 6(1)(f) GDPR; our legitimate interest lies in the technical provision, security and stability of the websites.
3. Disclosure of data
Your personal data will not be transmitted to third parties for purposes other than those listed below. We only pass on your personal data to third parties if you have given your express consent, if the processing is necessary for the performance of a contract with you, or if we are legally obliged to do so.
Payment processing via Stripe
We use the payment service provider Stripe (Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland, and Stripe, Inc., USA) to process payments (paid plans and sales via the marketplace). During the payment process, data is passed to Stripe or entered by you directly there: name, email address, billing address and country, where applicable the VAT identification number, the selected plan and the amount, and your payment details (e.g. card details or bank account). Your payment details are transmitted directly to Stripe; we do not receive them. Sellers on the marketplace connect their own Stripe account; Stripe collects the required information for this, including for identity verification, and processes it under its own responsibility in accordance with its privacy policy (https://stripe.com/privacy). The legal basis is Art. 6(1)(b) GDPR (performance of a contract). A transfer to Stripe, Inc. in the USA cannot be ruled out; it takes place on the basis of the safeguards recognised by the European Commission (adequacy decision on the EU-US Data Privacy Framework or standard contractual clauses).
Email delivery via Sweego
We use the email service provider Sweego (MINDBAZ, 19 rue d'Amiens, 59800 Lille, France) to send system emails (e.g. the confirmation of your email address when you register, notifications and the confirmation of a withdrawal). In doing so, your email address, where applicable your name, the content of the respective message (e.g. a confirmation link or a reference number) and delivery data (time, delivery status) are transmitted to Sweego and processed there for sending the email and for proof of delivery. Sweego processes this data on our behalf and only for this purpose. The legal basis is Art. 6(1)(b) GDPR insofar as the emails are necessary for the performance of the contract, and otherwise Art. 6(1)(f) GDPR (our interest in reliable email delivery).
AI functions via Mistral AI
For the AI-supported functions (e.g. the assistant in the editor and the dashboard) we use the language models of Mistral AI (15 rue des Halles, 75001 Paris, France). In doing so, your inputs in the assistant (messages and the conversation so far) and content that the assistant retrieves from your account to answer your request (e.g. the structure, content and key figures of your questionnaires) are transmitted to Mistral AI and processed there to generate the answer. We do not separately transmit your account identifier. Mistral AI processes this data on our behalf and only for this purpose. The legal basis is Art. 6(1)(b) GDPR (providing the function you use).
Hosting and infrastructure (OVH)
Our websites and the platform are operated on the infrastructure of OVH SAS (2 Rue Kellermann, 59100 Roubaix, France), in data centres in the European Union. All personal data is stored encrypted. OVH processes the data exclusively on our behalf and on our instructions. For business customers (B2B) we provide a data processing agreement under Art. 28 GDPR on request, which sets out the details of the data processed. The legal basis is Art. 6(1)(b) GDPR insofar as the processing is necessary for the performance of the contract, and otherwise Art. 6(1)(f) GDPR (our interest in secure and efficient operation).
4. Cookies and similar technologies
Cookies are small files that your browser stores when you use a page or application. Similar technologies include the browser’s local storage. We only use technically necessary (functional) cookies and storage entries that are required for login, security and the function you request. We do not use cookies for analytics, advertising or social networks, and no third-party cookies are set. Therefore no consent is required under Section 25(2) no. 2 TDDDG, and we do not show a cookie banner. The processing of personal data by these cookies is based on Art. 6(1)(b) GDPR (performance of the contract, login) or Art. 6(1)(f) GDPR (our legitimate interest in a secure and functional service).
The websites www.a38dp.io and www.appster.eu themselves do not set any cookies. Cookies are only created when you log in or use our applications (dashboard, editor, analytics, questionnaires, user account).
Cookies
a38dp.io_session
Login session: keeps you logged in after you have signed in.
Duration: 10 hours. Provider: A38 (first-party cookie, domain a38dp.io).
access_token
Login access token: authorises your requests to our applications.
Duration: validity of the access token. Provider: A38 (first-party cookie).
a38dp_session, a38dp_editor_session
Encrypted session data of the dashboard and analytics applications and of the editor (login state).
Duration: until you log out, at most 14 days. Provider: A38 (first-party cookie).
quest_embed_session
Session while filling in a questionnaire: assigns your answers to the current filling-in process.
Duration: duration of the session. Provider: A38 (first-party cookie).
csrf_token_…, ory_hydra_…
Security cookies during login and registration (protection against cross-site request forgery).
Duration: duration of the login process. Provider: A38 (first-party cookie).
Similar technologies (local storage)
editor.chat.sessionId, dashboards.chat.sessionId, dashboards.marketplaceChat.sessionId, dashboards.publishChat.sessionId
Session identifier of the AI assistant so that a conversation that has been started can be continued after the page is reloaded.
Duration: until you delete your browser data. Provider: A38.
Your options
You can delete or block cookies and local storage at any time in your browser settings. If you block the necessary cookies, you cannot log in and cannot use some functions of the applications. When you pay via Stripe, Stripe sets its own cookies on its pages; Stripe’s privacy policy applies to these.
5. Audience measurement without cookies
To improve our websites and applications, we measure their use with our own method without cookies and without third-party services. We record the page visited (path), the referrer URL, the time, clicks on controls, the scroll depth reached and the sections displayed, as well as a random identifier. This identifier exists only in the memory of the open page and is discarded when the page is reloaded or closed. Nothing is stored on your device (no cookies, no local storage), and you are not recognised across several visits. The data is transmitted to our own server at OVH in the European Union; your IP address is not stored with the measurement data. The measurement data is deleted automatically after six months. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in improving our service). You may object to the processing at any time (see section 7).
6. Further processing, purposes and legal bases
Registration and user account
For registration we process your email address, the passkey data stored for login (the public key; the private key stays on your device) and your account and usage data. Certain services, in particular paid sales via the marketplace, require further information (e.g. name, address and, where required by law or to prevent abuse, proof of identity). The purpose is to provide your account and our services and to keep them secure. The legal basis is Art. 6(1)(b) GDPR. The information is required for registration; without it we cannot set up an account. We store the data until your account is deleted; statutory retention obligations remain unaffected.
Contract, payment and billing
For paid plans we process your billing data (name, address, country, where applicable VAT identification number, plan and amounts) and the data of payment processing via Stripe (see section 3). The purposes are performance of the contract, invoicing and compliance with tax and commercial law obligations. The legal bases are Art. 6(1)(b) and (c) GDPR. We store the data for the duration of the contract and beyond that for as long as statutory retention periods require (six or eight years under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)).
Contact
If you contact us by email, via a contact form or the chat, we process your details (e.g. name, email address, message) in order to handle your request. The legal basis is Art. 6(1)(b) GDPR insofar as the request relates to a contract, and otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). We delete the data once the request has been dealt with conclusively and no retention obligations exist.
Withdrawal from contracts
If you, as a consumer, withdraw from a contract using the withdrawal function, we process your name, the email address of your account and your details on the contract in order to handle the withdrawal, to confirm receipt (by email via Sweego, see section 3) and to prove it. The legal bases are Art. 6(1)(c) GDPR (statutory obligations under the German Civil Code) and Art. 6(1)(f) GDPR (proof and legal defence). We store the proof until the statutory limitation periods have expired.
Questionnaires, apps and third-party answers
Users of our platform create questionnaires and apps into which respondents or end customers enter data. The respective user is the controller for this data; we process it on the user’s behalf (processing under Art. 28 GDPR) and not for our own purposes. If you fill in a questionnaire, please contact the operator of the questionnaire for access, rectification and erasure.
7. Your rights
You have the following rights against us with regard to the personal data concerning you:
Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to withdraw consent you have given (Art. 7(3) GDPR)
To exercise your rights, please contact datenschutz@a38dp.io.
Right to object (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(f) GDPR. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Withdrawal of consent
Where we base processing on your consent (e.g. the use of the structure of your questionnaires for AI training if you are a consumer, see clause 6.7 of the Terms of Service), you can withdraw it at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach.
Automated decision-making
There is no exclusively automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
8. Contact
If you have any questions about the collection, processing or use of your personal data, or about information, rectification, blocking or erasure of data, please contact: datenschutz@a38dp.io