Privacy Policy / Datenschutzerklärung
Planning-stage document. Final version to be drafted by German data protection counsel before website launch.
1. Data Controller / Verantwortliche Stelle
BuildFlow (planning-stage venture)
Berlin, Germany
Email: datenschutz@buildflow.de (planning stage)
The data controller for all personal data processed via this website and the BuildFlow service is the legal entity registered in Germany (UG or GmbH to be confirmed upon incorporation).
2. Data We Process
BuildFlow processes personal data in the following contexts:
- Account registration data: name, work email, company name
- Workflow data: process step records, assignee identifiers, completion timestamps
- Audit log entries: actor identity, action type, timestamp, content hash (tamper-evident)
- Usage analytics: session data collected via privacy-first analytics (Plausible, no cookies)
- Support communications: email correspondence for support tickets
3. Legal Basis (Art. 6 DSGVO)
| Processing Activity | Legal Basis |
|---|---|
| Account registration and service delivery | Art. 6(1)(b) DSGVO — contract performance |
| Audit log retention | Art. 6(1)(c) DSGVO — legal obligation (GoBD, HGB) |
| Marketing communications (opt-in) | Art. 6(1)(a) DSGVO — consent |
| Security and fraud prevention | Art. 6(1)(f) DSGVO — legitimate interest |
| Usage analytics | Art. 6(1)(f) DSGVO — legitimate interest (privacy-first, no cookies) |
4. Data Storage and International Transfers
All customer data is stored exclusively in Germany on Hetzner Cloud infrastructure (Frankfurt data center). No data is transferred outside the European Economic Area (EEA).
BuildFlow does not use US-based cloud infrastructure for customer data. Sub-processors are listed in the AVV provided to each customer.
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account and contract data | Duration of contract + 10 years (§ 147 AO, § 257 HGB) |
| Audit log entries | 10 years (GoBD retention requirement) |
| Support communications | 3 years after case closure |
| Usage analytics | Rolling 13 months (Plausible default) |
| Deleted account data | 30 days after deletion request, then permanent erasure |
6. Your Rights (Art. 15–22 DSGVO)
You have the right to:
- Access (Art. 15): receive a copy of your personal data
- Rectification (Art. 16): correct inaccurate data
- Erasure (Art. 17): request deletion of your data (where legally permissible)
- Restriction of processing (Art. 18)
- Data portability (Art. 20): receive your data in machine-readable format
- Object to processing (Art. 21)
- Lodge a complaint with a supervisory authority (Art. 77). Competent authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit
To exercise any of these rights, contact: datenschutz@buildflow.de
7. Cookies and Tracking
BuildFlow uses Plausible Analytics — a privacy-first, cookieless analytics tool hosted in the EU. Plausible does not set cookies, does not track individual users, and does not transfer data outside the EU.
No third-party advertising cookies or cross-site tracking pixels are used on this website. A cookie consent banner (TTDSG-compliant) will be implemented before the public launch.
8. AI Features and Transparency
BuildFlow uses the Anthropic Claude API to provide AI-assisted workflow suggestions ("KI-Vorschläge"). In accordance with Art. 52 EU AI Act:
- All AI-generated content is clearly labeled as "KI-Vorschlag" (AI suggestion)
- Users are informed when they interact with AI-generated content
- Anthropic is listed as a sub-processor in the AVV; Standard Contractual Clauses (SCCs) and Transfer Impact Assessment (TIA) are executed
9. Contact
Data protection questions: datenschutz@buildflow.de (planning stage)
This document will be replaced by a legally verified Datenschutzerklärung in German before the website launches. Final version to be reviewed by a German Datenschutzbeauftragter.