Privacy Policy

Heartpiece is a project of Die Quadratur UG (haftungsbeschränkt), a sumthink venture. We have not appointed a data protection officer, as we are not legally required to do so.

When you submit the waitlist form, we store the e-mail address you enter and a short source label describing which page the form was submitted from. The data is stored in our database at Supabase (EU region).

Purpose: sending beta invitations and related product updates. Legal basis: your consent, Art. 6(1)(a) GDPR, given by submitting the form. You can withdraw your consent at any time with effect for the future.

Storage period: until the beta programme ends or until you ask us to delete the entry, whichever comes first. Write to info@die-quadratur.de and we will remove your address.

To use the vault you create an account. Authentication runs on Supabase (EU region). We process your e-mail address, an encrypted password credential (or, if you sign in with Google, the identifier and e-mail address provided by that sign-in), and timestamps such as account creation and last sign-in.

Purpose: providing the account and securing access. Legal basis: Art. 6(1)(b) GDPR, performance of a contract or pre-contractual measures. Storage period: for the lifetime of your account. When you ask us to delete your account, the account data is removed.

Session tokens are stored in your browser's localStorage. These are strictly necessary for the sign-in function you requested and therefore do not require consent under Sec. 25(2) no. 2 TDDDG. They are not used for analysis or advertising.

Files you upload to your vault, together with the metadata you enter (title, medium, description, creation date) and derived technical values such as file hashes, are stored in Supabase storage and database (EU region), isolated per user through row level security.

Purpose: registering and documenting your authorship, and running the checks you request on your own material. Legal basis: Art. 6(1)(b) GDPR. We do not sell your works, we do not share them with third parties, and we do not use them to train AI models.

Storage period: until you delete the individual work or your account.

The application is hosted on Lovable infrastructure, delivered via Cloudflare. When you access the site, the infrastructure processes connection data such as IP address, date and time of the request, the requested resource, referrer, and browser and operating system information.

Purpose: delivering the site, operational security, and abuse prevention. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a stable and secure service. These logs are kept for a short period and then deleted or aggregated.

We use Supabase for database, authentication, and file storage, and Lovable together with Cloudflare for hosting and content delivery. These providers act as processors under Art. 28 GDPR. Data is stored in the European Union. Where a provider's network makes a transfer to a third country unavoidable, it is based on the EU standard contractual clauses.

We do not use tracking or advertising cookies, and we do not run web analytics. The only browser storage we use is the strictly necessary session storage described in section 03.

Web fonts are served from our own server. No font data is requested from Google or any other external font provider, so no IP address is transmitted to a font CDN.

Under Art. 15 to 21 GDPR you have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time with effect for the future.

To exercise these rights, write to info@die-quadratur.de.

You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Hamburg, Germany

We update this policy when the product or the underlying processing changes. The version you are reading is the current one.