AutoChart.eu

Privacy Policy

1. Controller

Controller within the meaning of the GDPR:
Phil Taubert, Kapellenstr. 9B, 04315 Leipzig, Germany
Email: admin@autochart.eu

2. What data we process

  • Account data: email address, optionally your name and avatar, chosen language and, when using the app, a device token for push notifications.
  • Uploaded content: audio files, entered metadata (title, artist, album) and the generated conversion results.
  • Payment data: payments are processed by Stripe. We never store card details, only the purchase status, the purchased pack, a Stripe reference and a fingerprint of the card used, created by Stripe (an identifier from which the card number cannot be derived).
  • Refer a friend: your personal invite code. If you came through an invite link, also who invited you, a hash of your email address and the state of your invitation (signed up, pack bought, bonus credited or withdrawn including the reason).
  • Technical data: server logs (IP address, timestamp, requested resource) to keep the service running securely.

3. Purposes and legal bases

  • Providing the service, including conversion and download (Art. 6(1)(b) GDPR, performance of a contract).
  • Payment processing via Stripe (Art. 6(1)(b) GDPR).
  • Email notifications about the status of your conversions (Art. 6(1)(b) GDPR).
  • Running the refer-a-friend program, including crediting bonus credits and notifications about it (Art. 6(1)(b) GDPR).
  • Operational security and abuse prevention, including against repeated use of the free trial conversion and against inviting yourself in the refer-a-friend program by comparing email hashes and card fingerprints (Art. 6(1)(f) GDPR, legitimate interest).
  • Audience measurement to improve our service (Art. 6(1)(f) GDPR, see section 7).

4. Recipients and processors

  • Hosting and email delivery: netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. A data processing agreement is in place with netcup.
  • Conversion: Audio files are converted on the controller's own hardware in Germany; no data is passed to third parties in the process.
  • Stripe Payments Europe, Ltd. (Ireland), payment processing. Data may be transferred to third countries (including the USA); Stripe relies on EU standard contractual clauses. Details: stripe.com/privacy. When you buy credits, Stripe acts as the seller (merchant of record) and processes your payment and billing data under its own responsibility.
  • Google and Apple (only when signing in with Google or Apple): you are redirected to Google Ireland Ltd. or Apple Distribution International Ltd. (both Ireland) to sign in. We receive your email address and, where applicable, your name and profile picture. Data may be transferred to the USA; the providers rely on the EU-US Data Privacy Framework or EU standard contractual clauses (Art. 6(1)(b) GDPR).
  • Google Firebase Cloud Messaging (mobile app only, if you allow push notifications): to deliver push notifications we store a device token and send it together with the notification text to Google Ireland Ltd.; data may be transferred to the USA (EU-US Data Privacy Framework). You can turn off push notifications in your device settings at any time (Art. 6(1)(a) GDPR).

The person who invited you: if you came through an invite link, the person who invited you sees on their invite page and in notifications, without your name or email address, when you signed up, whether you bought a pack that counts for the bonus and, if there is no bonus, the reason (refund, disputed payment, a report by your bank or payment with a card used on the inviting person's account). The legal basis is Art. 6(1)(b) GDPR.

We do not share your data with any other third parties.

5. Retention

Uploaded audio files and conversion results are stored until you delete them or delete your account. Purchase records are kept for the statutory retention periods. Server logs are deleted after 14 days at the latest. Once the free trial conversion has been used, we keep an irreversible hash of your email address (in a normalized form, e.g. without a "+" suffix) to prevent repeated use of the free trial. This hash is kept after your account is deleted (Art. 6(1)(f) GDPR, legitimate interest in preventing abuse). So that the free trial can only be used once per internet connection, we also store a hash of your IP address (of the network prefix for IPv6), created with a secret key, and delete it after 30 days. For the same purpose your IP address is processed when we check whether a free trial is available to you (Art. 6(1)(f) GDPR).

The card fingerprint is stored with the purchase record and deleted with it. Invitations are kept as long as the inviting person's account exists. If you delete your account as an invited person, only the hash of your email address remains with the invitation, so the same address cannot be invited again (Art. 6(1)(f) GDPR, legitimate interest in preventing abuse).

6. Cookies and local storage

For signing in, remembering your language, keeping the code of an invite link until you sign in and not showing dismissed hints again (e.g. the question whether you want to rate a song or the refer-a-friend banner) we use technically necessary browser storage entries and a functional cookie (Art. 6(1)(f) GDPR; § 25(2) German TDDDG). For audience measurement, Rybbit also stores a random visitor ID in your browser's local storage (see section 7).

7. Audience measurement with Rybbit

We use the open-source software Rybbit, which we run ourselves on our server; the data is not passed to third parties. It records the pages you visit (including URL parameters), the referring page, page titles, screen size, language, browser, operating system and device type, and clicks on external links. Your IP address is processed to determine your approximate location (country, region, city) and network provider; only this result is stored, not the IP address. To recognize returning visits, Rybbit stores a randomly generated visitor ID in your browser's local storage. The purpose is to improve our service (Art. 6(1)(f) GDPR). The data is deleted after 24 months.

You can object to audience measurement at any time. This turns it off in this browser and deletes the stored visitor ID.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21 GDPR). You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). You can delete your account and all associated data yourself at any time in your profile settings.