Privacy policy
Draft – to be reviewed by a qualified person before launch. The German version is the legally binding one; this is a translation for convenience.
1. Controller
The controller for the processing of personal data on this website is:
[Company name]
[Address]
Email: [address]
2. What is not processed here
The tools on this site run entirely in your browser. What you type into a tool – text, lists, passwords, IBANs, files – is not transmitted to us and is neither stored nor analysed by us. It does not leave your device.
You do not have to take our word for it: open your browser’s developer tools, look at the network tab, and you will see that using a tool sends no request carrying your input.
3. Visiting the site (server log files)
On every visit our host automatically records data sent by your browser: the address requested, date and time, volume transferred, referring address, browser type and operating system, and the IP address.
Purpose is the technical operation, stability and security of the site. Legal basis is Art. 6(1)(f) GDPR; our legitimate interest is running the site securely and without disruption. Retention: [X days].
4. Cookies and storage on your device
Access to information on your device is governed by § 25 TDDDG. Without your consent we only set what is strictly necessary for operation (§ 25(2) TDDDG): the language cookie (1 year), the consent cookie (1 year), a session cookie while you are signed in, an optional “stay signed in” cookie (30 days), and your favourites in localStorage. You can clear all of these in your browser at any time.
5. Anonymous usage count
We count on the server how often each tool is opened – by tool, language and day. No IP address, no cookie and no identifier is stored; two visits on the same day are indistinguishable from one person returning. The figures cannot be linked to a person and are therefore not personal data, so no consent is required.
6. Google Analytics 4
We use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Analytics is only loaded after you have agreed. Before you click “I agree”, no connection to Google is made.
Legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. Withdrawal is possible at any time through the “change your choice” link in the footer, with effect for the future.
Transfer to the USA: a transfer to Google LLC in the United States cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition. Even so, a level of protection equivalent to the European one cannot be guaranteed in every case; access by US authorities cannot be excluded.
Retention: [value configured in Google Analytics]. More at Google’s privacy policy.
7. Consent management
We use tarteaucitron.js to ask for and store your choice. The software is served from our own server, so no connection to a third party is made before you have been asked. Only your decision is stored, in the cookie.
8. User account
An account is optional. No tool requires signing in. The account remembers which tools you like – not what you do with them.
Data processed: email address, an optional display name, an optional password (stored only as a hash), preferred language, the time of the last sign-in and your saved tools. Legal basis is Art. 6(1)(b) GDPR – the processing is necessary to provide the service.
Sign-in by link: on request we send you an email with a sign-in link. It is valid for 30 minutes and works once. The number of requests is limited so the form cannot be misused to send mail to other people’s inboxes.
Deletion: you can mark your account for deletion in your profile at any time. It is then deleted for good after 14 days; until then you can cancel. We tell you about the request by email. We also delete accounts unused for 24 months.
Data export: your profile lets you download everything stored with your account as a file (Art. 20 GDPR).
9. Newsletter
If you agree when signing up, we will occasionally email you about new tools. Legal basis is your consent under Art. 6(1)(a) GDPR. We store the time and source of that consent in order to be able to demonstrate it. You can object at any time, through the unsubscribe link in every email or in your profile. The consent is separate from the account; withdrawing it does not affect your account.
10. Recipients
We pass on personal data only as far as operating the service requires: [host], [address], for running the website; [email provider], [address], for sending account emails; both as processors under Art. 28 GDPR. And Google Ireland Limited, but only where consent has been given – see section 6.
11. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You may withdraw any consent at any time with effect for the future.
Write to the address above. For access and portability the export in your profile is also available.
Right to complain: you may complain to a data protection supervisory authority, in particular in the member state of your residence or of the alleged infringement. The authority responsible for us is [supervisory authority].
12. No automated decision-making
There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
13. Version and changes
This policy is dated [date]. We update it when the processing changes – for instance when a tool or a service is added.