SafeDoc
Start for free
Menu
FeaturesPricingPasswordsFor businessSecurityToolsHelp
Sign in
DeutschEnglish
Appearance

Privacy policy

Last updated: [PLACEHOLDER date]

Draft – not yet legally reviewed. This text is a skeleton. Everything in square brackets will be completed before launch. The German version is authoritative.

1. Controller

Dienstleistungen24 Inh. Jim Eichholz, [PLACEHOLDER address], email: support@safedoc.de. Full details in the Legal notice.

Data protection officer: [PLACEHOLDER name and contact – or statement that no appointment is required]

2. Roles

We are the controller for your account, contract and billing data. Where business customers store files containing personal data of third parties, we process those files as a processor under Art. 28 GDPR on the basis of a data processing agreement. This also applies to self-employed people on an individual account: the agreement is available on every paid plan (Settings → Contracts), and professionals bound by secrecy can additionally conclude a confidentiality agreement under Section 203 StGB. The free plan is intended for private use.

The service providers that help us as subprocessors are listed, with date and change history, on the subprocessors page.

3. Data we process

  • Account data: name, email address, password (hash only), settings, two-factor details.
  • Content: the files and folders you upload, including names, sizes and timestamps.
  • Shares: links you create, their settings and access times.
  • Contract and payment data: plan, invoices, payment status. Card details are processed by the payment provider, not by us.
  • Technical data: IP address, time, browser information in server logs. [PLACEHOLDER retention period of IP addresses]

4. Purposes and legal bases

  • Providing the service and performing the contract – Art. 6(1)(b) GDPR.
  • Retaining invoices under tax and commercial law – Art. 6(1)(c) GDPR.
  • Security of the service, abuse prevention – Art. 6(1)(f) GDPR.
  • [PLACEHOLDER further purposes, e.g. statistics – only if used, with legal basis]

5. Where your data is stored

Files and database are stored in data centres in Germany. Backups are also planned for Germany; they are being set up right now. For payments, email delivery and optional sign-in with Google or Apple we use external providers (see section 6). This may involve transfers to third countries.

5a. No AI on your files

We do not use the contents of your files to train AI models and do not pass them on to providers of AI services. Search and previews run on our own systems or with the sub-processors listed in section 6, without third-party AI services. We would only change this with at least 30 days’ notice and only with your explicit consent. Details are in section 2a of the terms.

5b. Newsletter

You only receive the newsletter with news and tips if you explicitly subscribe (checkbox at sign-up, in your account settings or in the form on the website) AND confirm via the link in our confirmation email (double opt-in). The link is valid for 7 days. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) UWG). Signing up for an account works without the newsletter.

For this we process your email address, your language and, as proof of consent: the time of subscription and confirmation, the way you subscribed, the version of the consent text and your IP address only as a keyed hash (HMAC), not in plain text. The legal basis for keeping this proof is our obligation to be able to demonstrate consent (Art. 7(1), Art. 6(1)(c) and (f) GDPR). We measure neither opens nor clicks – the newsletter contains no tracking pixels and no redirected links. We only store whether delivery succeeded.

You can unsubscribe at any time with one click via the link in every issue, in your account settings or by email to support@safedoc.de – with effect for the future. After that, your address remains only as a hash on a suppression list so that you receive no further newsletter. Unconfirmed subscriptions are deleted 30 days after the link expires. Proof of an ended consent is kept for 3 years (limitation period for possible claims) and then deleted; the hash on the suppression list remains. If you delete your account, we delete the newsletter data with it. Emails are sent via our domain's mailbox at STRATO AG, Berlin (processing on our behalf, section 6).

6. Recipients and processors

ProviderPurposeSeat / place of processingRole and basis
Hetzner Online GmbHServers, database, file storage, backupsGermany [PLACEHOLDER locations]Processor, DPA [PLACEHOLDER date]
[PLACEHOLDER payment provider (e.g. Stripe)]Payment processing[PLACEHOLDER seat, third-country transfer][PLACEHOLDER role, legal basis, safeguards]
[PLACEHOLDER payment provider (e.g. PayPal)]Payment processing[PLACEHOLDER seat, third-country transfer][PLACEHOLDER role, legal basis, safeguards]
[PLACEHOLDER email provider]Sending system emails (e.g. confirmations)[PLACEHOLDER seat][PLACEHOLDER processor, DPA]
Google [PLACEHOLDER legal entity] – optionalSign-in with Google, only if you choose it[PLACEHOLDER seat, third-country transfer][PLACEHOLDER role, legal basis]
Apple [PLACEHOLDER legal entity] – optionalSign-in with Apple, only if you choose it[PLACEHOLDER seat, third-country transfer][PLACEHOLDER role, legal basis]

Transfers to third countries: [PLACEHOLDER basis per recipient, e.g. adequacy decision or standard contractual clauses]

7. Cookies and device access

In the customer area we only use cookies that are strictly necessary for the service, for example for signing in and protecting against forged requests. There is no tracking there. We store your choice in the banner in the necessary cookie safedoc_einwilligung for 6 months.

Microsoft Clarity – only with your consent

On our public website pages we use Microsoft Clarity, but only if you choose “Accept” in the banner. The provider is Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Purpose: we want to understand how visitors use the website (clicks, scrolling, mouse movements, device and browser, approximate location from the IP address) in order to improve it. Text and input on the page are masked before transmission.

Clarity never runs in the customer area, never on your files, never on share links, never during sign-in and sign-up, never on our tool pages and never during cancellation or withdrawal. Clarity sets the cookies _clck (up to 1 year) and _clsk (1 day).

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Microsoft may transfer data to the USA; Microsoft participates in the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR). You can withdraw your consent at any time with effect for the future: click “Cookie settings” at the bottom of any page and choose “Decline”. We then no longer load Clarity and delete the Clarity cookies. More in Microsoft’s privacy statement.

8. Retention and deletion

Deleted files stay in the trash for 30 days and are then removed. After your contract ends you can still download your files for [PLACEHOLDER export period]; after that we delete them. We keep invoices for the statutory periods. [PLACEHOLDER retention periods for backups and logs]

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can withdraw consent at any time. You may lodge a complaint with a data protection supervisory authority, for example [PLACEHOLDER competent supervisory authority]. Write to us at support@safedoc.de with the subject “Privacy”.