Privacy Policy
1. Who We Are
Gravify (gravify.co) is operated by Tom Pohlandt, Osterlund 3, 24944 Flensburg, Germany ("we", "us"). This policy explains what personal data we collect, why, and your rights under the EU General Data Protection Regulation (GDPR / DSGVO).
2. Data We Collect
Account data: Email address, password (hashed), subscription status. Collected when you sign up.
Payment data: Payments are processed by Paddle.com Market Limited. We do not store your credit card details. Paddle shares with us: subscription status, country, and a transaction reference.
Usage data: Product events (e.g. exports created, features used, session length) collected via PostHog (EU-hosted). No cross-site tracking. Used to improve the product.
Technical data: IP address (anonymised after processing), browser type, device type. Collected automatically on each visit.
Communications: If you contact us by email, we store your message and email address to respond.
3. Legal Basis for Processing
- Contract (Art. 6(1)(b) GDPR): Account data and payment data — necessary to provide the Service.
- Legitimate interests (Art. 6(1)(f) GDPR): Usage analytics to improve the product, security monitoring.
- Consent (Art. 6(1)(a) GDPR): Waitlist emails — you can unsubscribe at any time.
4. Third-Party Processors
- Paddle.com Market Limited — payment processing and tax compliance (Merchant of Record). Paddle's privacy policy: paddle.com/legal/privacy.
- PostHog (EU Cloud) — product analytics, hosted in the EU. Data processing agreement in place. posthog.com/privacy.
- Porkbun / DNS provider — domain and email forwarding only; no personal data stored beyond forwarding rules.
We do not sell your personal data. We do not use your data for advertising.
5. Data Retention
Account data is retained for as long as your account is active, plus up to 90 days after deletion for backup purposes. Usage analytics are retained for 24 months. Payment records are retained for 10 years as required by German tax law (§ 147 AO).
6. Your Rights (GDPR)
You have the right to:
- Access the personal data we hold about you (Art. 15 GDPR)
- Correct inaccurate data (Art. 16 GDPR)
- Request deletion ("right to be forgotten", Art. 17 GDPR)
- Restrict processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing based on legitimate interests (Art. 21 GDPR)
- Withdraw consent at any time (where processing is based on consent)
To exercise your rights, contact us at hello@gravify.co. We will respond within 30 days. You also have the right to lodge a complaint with the supervisory authority in your EU member state. The competent authority for Germany is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), datenschutzzentrum.de.
7. Cookies
We use only technically necessary cookies (session management, authentication). We do not use advertising or tracking cookies. No consent banner is required for technically necessary cookies.
8. Data Transfers
All personal data is processed within the EU/EEA. If any processor transfers data outside the EU, this is done under EU Standard Contractual Clauses (SCCs).
9. Changes to This Policy
We will notify registered users of material changes by email at least 14 days before they take effect.
10. Contact
Tom Pohlandt · Osterlund 3, 24944 Flensburg, Germany · hello@gravify.co