https://morningmail.ai/_nuxt/k91s5lOU.js

1import{d as n,c as d,g as r,j as t,f as s,w as o,an as i,p as l,o as c}from"./C_pwUvic.js";const g={class:"max-w-4xl mx-auto px-4 py-8"},y={class:"bg-blue-50 dark:bg-blue-900/20 border border-blue-200 dark:border-blue-800 rounded-lg p-4 mb-8"},p={class:"text-blue-800 dark:text-blue-200"},u={class:"prose prose-lg max-w-none"},m={class:"mb-4 text-gray-700 dark:text-gray-300"},h={class:"mb-4 text-gray-700 dark:text-gray-300"},k=n({__name:"index",setup(b){return(x,e)=>{const a=l;return c(),d("div",g,[r("div",y,[e[3]||(e[3]=r("h2",{class:"text-lg font-semibold text-blue-900 dark:text-blue-100 mb-2"},"Datenschutzerklärung auf Deutsch",-1)),r("p",p,[e[1]||(e[1]=t(" MorningMail ist in Deutschland eingetragen. Unsere Datenschutzerklärung ist daher auf Deutsch. Sie können die rechtlich verbindliche deutsche Version ",-1)),s(a,{to:"/privacy-policy",class:"text-blue-700 dark:text-blue-300 underline"},{default:o(()=>[...e[0]||(e[0]=[t("hier",-1)])]),_:1}),e[2]||(e[2]=t(" lesen. ",-1))])]),r("div",u,[e[13]||(e[13]=i('<h1 class="text-3xl font-bold mb-8 text-gray-900 dark:text-white">Privacy Policy</h1><p class="mb-6 text-sm text-gray-600 dark:text-gray-400 italic"> This is a legally non-binding translation of the German Datenschutzerklärung. The German version is legally binding. </p><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 1 Controller</h2><p class="mb-4 text-gray-700 dark:text-gray-300"> (1) Below we inform you about the processing of personal data when you use our website and the MorningMail application (the “Service”). Personal data is all data that can be personally related to you, e.g., name, address, email addresses, user behaviour. With this statement we comply with our information duties under Art. 13, 14 GDPR. </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (2) The controller within the meaning of Art. 4 No. 7 GDPR is: </p><div class="bg-gray-50 dark:bg-gray-800 p-4 rounded-lg mb-4"><p class="font-semibold text-gray-900 dark:text-white">Web Highlights GmbH</p><p class="text-gray-700 dark:text-gray-300">Glockenstr. 35</p><p class="text-gray-700 dark:text-gray-300">40476 Düsseldorf</p><p class="text-gray-700 dark:text-gray-300">Germany</p><p class="text-gray-700 dark:text-gray-300">General contact: [email protected]</p><p class="text-gray-700 dark:text-gray-300"> Privacy enquiries: [email protected] (please prefix the subject with “Datenschutz”) </p></div><p class="mb-4 text-gray-700 dark:text-gray-300"> (3) A data protection officer is not required by law (Art. 37 GDPR, Sec. 38 BDSG); please direct any privacy enquiries to the controller named above. </p><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 2 Your Rights</h2><p class="mb-4 text-gray-700 dark:text-gray-300"> (1) You have the following rights regarding your personal data: </p><ul class="list-disc pl-6 mb-4 text-gray-700 dark:text-gray-300"><li>Right of access (Art. 15 GDPR),</li><li>Right to rectification (Art. 16 GDPR),</li><li>Right to erasure (Art. 17 GDPR),</li><li>Right to restriction of processing (Art. 18 GDPR),</li><li>Right to data portability (Art. 20 GDPR),</li><li>Right to object (Art. 21 GDPR),</li><li>Right to withdraw consent with effect for the future (Art. 7 (3) GDPR).</li></ul>

1',10)),r("p",m,[e[5]||(e[5]=t(" (2) ",-1)),e[6]||(e[6]=r("strong",null,"Self-service:",-1)),e[7]||(e[7]=t(" Signed-in users can request a complete data export in JSON format (Art. 15, 20 GDPR) and irrevocably delete their account (Art. 17 GDPR) directly from the ",-1)),s(a,{to:"/profile",class:"text-blue-600 dark:text-blue-400 hover:underline"},{default:o(()=>[...e[4]||(e[4]=[t("profile settings",-1)])]),_:1}),e[8]||(e[8]=t(". Requests are processed within 30 days (Art. 12 (3) GDPR). ",-1))]),e[14]||(e[14]=i('<p class="mb-4 text-gray-700 dark:text-gray-300"> (3) You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for our seat is: </p><div class="bg-gray-50 dark:bg-gray-800 p-4 rounded-lg mb-4"><p class="font-semibold text-gray-900 dark:text-white">Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen</p><p class="text-gray-700 dark:text-gray-300">Kavalleriestr. 2-4, 40213 Düsseldorf, Germany</p><p class="text-gray-700 dark:text-gray-300"><a href="https://www.ldi.nrw.de" target="_blank" class="text-blue-600 dark:text-blue-400 hover:underline">https://www.ldi.nrw.de</a></p></div><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 3 Processing when Visiting our Website</h2><p class="mb-4 text-gray-700 dark:text-gray-300"> When you simply browse our website, your browser automatically transmits the following data to our server. We need this data to display the website to you and to ensure stability and security. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in operating the website securely): </p><ul class="list-disc pl-6 mb-4 text-gray-700 dark:text-gray-300"><li>IP address</li><li>Date and time of the request</li><li>Time-zone difference to Greenwich Mean Time (GMT)</li><li>Content of the request (page visited)</li><li>Access status / HTTP status code</li><li>Volume of data transferred</li><li>Referring URL</li><li>Browser, operating system, browser language and version</li></ul><p class="mb-4 text-gray-700 dark:text-gray-300"> Server logs are rotated and deleted automatically after 14 days, unless a security incident requires a longer retention. </p><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 4 Hosting (Hetzner Online GmbH)</h2><p class="mb-4 text-gray-700 dark:text-gray-300"> Our website and application servers are hosted by <strong>Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany</strong>, in data centres located in Germany. No third-country transfer occurs. We have entered into a data processing agreement with Hetzner pursuant to Art. 28 GDPR. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in reliable EU-based hosting). </p><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 5 Registration and Authentication </h2><p class="mb-4 text-gray-700 dark:text-gray-300"> (1) When you register for MorningMail we process the following data: email address, first and last name (if provided), profile picture (if provided). Without these data registration is not possible. Legal basis is Art. 6 (1) (b) GDPR (performance of a contract). </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (2) Optionally you can extend your profile with language, time zone, location (city/country) and content preferences (e.g. news to

1pics, weather unit, date/time format). Legal basis is Art. 6 (1) (a) GDPR (consent). You can change or remove this data at any time in your profile. </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (3) For authentication we use <strong>Firebase Authentication</strong>, a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, represented by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. We have entered into a data processing agreement with Google (Google Cloud Data Processing Addendum). Transfers to the USA are safeguarded under the EU-US Data Privacy Framework and additionally by Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR. For details see the <a href="https://firebase.google.com/support/privacy" target="_blank" class="text-blue-600 dark:text-blue-400 hover:underline">Firebase Privacy Policy</a>. </p><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 6 Data Storage (Cloud Firestore)</h2><p class="mb-4 text-gray-700 dark:text-gray-300"> (1) All application data is stored in <strong>Cloud Firestore</strong> (Google LLC). The database region is <code class="text-sm bg-gray-100 dark:bg-gray-700 px-1 rounded">eur3</code> (multi-region inside the European Union). The same DPA referenced in § 5 (3) applies. </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (2) The following categories of data are stored: </p><ul class="list-disc pl-6 mb-4 text-gray-700 dark:text-gray-300"><li><strong>Profile:</strong> the master data referenced in § 5</li><li><strong>Email templates &amp; modules:</strong> the templates you create and their module configuration, including the recipient addresses your morning emails are sent to</li><li><strong>Execution history:</strong> logs of every email generated and dispatched (status, credits consumed, error messages where applicable)</li><li><strong>Credit transactions:</strong> credit ledger entries, including the link to Paddle purchases</li><li><strong>Topic feedback:</strong> up/down votes on individual AI-generated items used to improve quality</li></ul><p class="mb-4 text-gray-700 dark:text-gray-300"> Legal basis is Art. 6 (1) (b) GDPR (performance of the contract). Concrete retention periods are listed in § 14. </p><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 7 AI-powered Email Generation</h2><p class="mb-4 text-gray-700 dark:text-gray-300"> (1) To generate your personalised morning emails we use Large Language Models (LLMs) provided by external vendors. Access is routed through the API gateway <strong>OpenRouter</strong> (OpenRouter, Inc., 2261 Market Street #5519, San Francisco, CA 94114, USA), which forwards each request to the chosen model provider. </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (2) We currently use the following model providers: </p><ul class="list-disc pl-6 mb-4 text-gray-700 dark:text-gray-300"><li><strong>OpenAI</strong> (OpenAI OpCo, LLC, 3180 18th Street, San Francisco, CA 94110, USA) — models <code class="text-sm bg-gray-100 dark:bg-gray-700 px-1 rounded">gpt-5</code>, <code class="text-sm bg-gray-100 dark:bg-gray-700 px-1 rounded">gpt-5-mini</code>, <code class="text-sm bg-gray-100 dark:bg-gray-700 px-1 rounded">gpt-5-nano</code></li><li><strong>Anthropic</strong> (Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA) — models <code class="text-sm bg-gray-100 dark:bg-gray-700 px-1 rounded">claude-haiku-4.5</code>, <code class="text-sm bg-gray-100 dark:bg-gray-700 px-1 rounded">claude-sonnet-4.5</code>, <code class="text-sm bg-gray-100 dark:bg-gray-700 px-1 rounded">claude-opus-4.5</code></li><li><strong>Google</strong> (Google LLC, USA) — models <code class="text-sm bg-gray-100 dark:bg-gray-700 px-1 rounded">gemini-2.5-flash-lite</code>, <code class="text-sm bg-gray-100 dark:bg-gray-700 px-1 rounded">gemini-2.5-flash</code>, <code class="text-sm bg-gray-100 dark:bg-gray-700 px-1 rounded">gemini-2.5-pro</code></li></ul><p class="mb-4 text-gray-700 dark:text-gray-300"> (3) <strong>What we transmit:</strong> system prompts, module configuration (e.g. topics, language, tone), and where applicable the content of public web pages we crawled for research (see § 8 Google Custom Search). If you have enabled the calendar module, the title, description, location and time of your next three days of calendar entries are included as well. </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (4) <strong>What we do NOT transmit:</strong> we transmit neither your email address nor the email addresses of recipients, neither your name nor your profile picture, nor any payment data, nor your Firebase user ID to LLM providers. </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (5) Legal basis is Art. 6 (1) (b) GDPR (performance of the contract) — AI generation is a core part of the booked service. Transfers to the USA are safeguarded under the EU-US Data Privacy Framework (where the respective vendor is certified) or by Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR. We have endeavoured to choose providers whose API terms commit not to use submitted content for training. </p><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 8 Google APIs (Custom Search &amp; Calendar)</h2><p class="mb-4 text-gray-700 dark:text-gray-300"> (1) <strong>Google Custom Search API:</strong> for researching news content we use the Google Custom Search API. Only the search terms you configured (or terms derived therefrom) are transmitted — no personal data. Provider: Google LLC. Legal basis: Art. 6 (1) (b) GDPR. </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (2) <strong>Google Calendar integration (optional):</strong> if you enable the calendar module, you grant explicit consent through Google OAuth that we may read from your primary Google calendar (scope: <code class="text-sm bg-gray-100 dark:bg-gray-700 px-1 rounded">calendar.readonly</code>). We only read events of the next three days and use them for your daily overview. Access and refresh tokens are stored encrypted in Firestore. You can revoke access at any time, either in the module settings or directly in your <a href="https://myaccount.google.com/permissions" target="_blank" class="text-blue-600 dar

1k:text-blue-400 hover:underline">Google Account</a>. Legal basis: Art. 6 (1) (a) GDPR (consent). </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (3) MorningMail&#39;s use and transfer to any other app of information received from Google APIs adheres to the <a href="https://developers.google.com/terms/api-services-user-data-policy" target="_blank" class="text-blue-600 dark:text-blue-400 hover:underline">Google API Services User Data Policy</a>, including the Limited Use requirements. </p><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 9 Email Delivery (Amazon SES)</h2><p class="mb-4 text-gray-700 dark:text-gray-300"> For the dispatch of your morning emails we use <strong>Amazon Simple Email Service (Amazon SES)</strong>, a service of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Processing takes place in the region <strong>eu-central-1 (Frankfurt am Main, Germany)</strong>; your recipient lists and HTML email content therefore do not leave the EU. We have entered into a data processing agreement with AWS (AWS DPA). Nodemailer is used as the transport library. Legal basis: Art. 6 (1) (b) GDPR. </p>',30)),r("p",h,[e[10]||(e[10]=r("strong",null,"Onboarding and service emails:",-1)),e[11]||(e[11]=t(" in addition to the morning emails you configure, we send occasional onboarding and guidance emails to your account email address (e.g. a welcome after sign-up, plus tips when you get stuck during setup). These are dispatched via the same provider (Amazon SES). Legal basis is Art. 6 (1) (f) GDPR (legitimate interest in activating and supporting our own registered users). Every such email contains a one-click unsubscribe link, and you can also turn them off at any time in your ",-1)),s(a,{to:"/profile/notifications",class:"text-blue-600 dark:text-blue-400 hover:underline"},{default:o(()=>[...e[9]||(e[9]=[t("notification settings",-1)])]),_:1}),e[12]||(e[12]=t(". Essential service messages (e.g. email verification, low-credit notice) are unaffected. We use no open tracking (tracking pixel). ",-1))]),e[15]||(e[15]=i('<h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 10 Payment Processing (Paddle)</h2><p class="mb-4 text-gray-700 dark:text-gray-300"> (1) For the processing of paid plans and top-ups we use <strong>Paddle.com Market Ltd, Judd House, 18-29 Mora Street, London, EC1V 8BT, United Kingdom</strong>. Paddle acts as the “Merchant of Record” — you formally enter into the payment contract with Paddle, while we appear as the supplier vis-à-vis Paddle. </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (2) During checkout the following data is transmitted to Paddle: name, email address, country, postal code where applicable, and the payment method you choose. <strong>We do not receive or store full credit card numbers</strong> — they are processed exclusively by Paddle and its PCI-DSS-certified payment processors. </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (3) Paddle informs us by webhook about successful payments, refunds and subscription changes. We store the Paddle customer ID, subscription ID, webhook event IDs (for idempotency) and the monthly credit allocation in Firestore. </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (4) Transfers to the United Kingdom are safeguarded by the EU Commission&#39;s adequacy decision of 28 June 2021. Legal basis: Art. 6 (1) (b) GDPR. For details see the <a href="https://www.paddle.com/legal/privacy" target="_blank" class="text-blue-600 dark:text-blue-400 hover:underline">Paddle Privacy Policy</a>. </p><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 11 Audience Measurement (Plausible Analytics)</h2><p class="mb-4 text-gray-700 dark:text-gray-300"> (1) To measure reach and operational health of the website we use <strong>Plausible Analytics</strong> (Plausible Insights ehf., Kennitala 010422-0490, Reykjavík, Iceland). Plausible works <strong>cookie-free</strong>, sets no device identifiers, builds no cross-device profiles and uses a daily-key hash on truncated IP addresses. No cross-site tracking takes place. </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (2) We operate Plausible on our own subdomain (<code class="text-sm bg-gray-100 dark:bg-gray-700 px-1 rounded">analytics.web-highlights.com</code>), so no data flows to Plausible-owned servers outside of our control. Only anonymous reach and usage metrics are collected (page views, time on page, device category, country at country-level granularity) as well as anonymous product events for individual usage steps (e.g. sign-up, template created, subscription completed) carrying strictly non-identifying properties only — never your email address or user ID. To measure conversions we additionally record the revenue of a completed subscription anonymously. No open- or pixel-based tracking takes place. </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (3) Because Plausible itself sets no cookies and collects no personal data, no consent is required for it under Sec. 25 TTDSG. Legal basis is Art. 6 (1) (f) GDPR (legitimate interest in anonymous audience analytics to improve the offering). You may object at any time on grounds relating to your particular situation (see § 2). Iceland is part of the EEA; no third-country transfer takes place. </p><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">

1§ 12 Cookies and Local Storage</h2><p class="mb-4 text-gray-700 dark:text-gray-300"> (1) We exclusively use technically necessary cookies and storage technologies within the meaning of Sec. 25 (2) No. 2 TTDSG. No consent is required for these. </p><ul class="list-disc pl-6 mb-4 text-gray-700 dark:text-gray-300"><li><strong><code class="text-sm bg-gray-100 dark:bg-gray-700 px-1 rounded">i18n_locale</code></strong> — cookie storing your chosen language (German / English). Lifetime: 1 year. Purpose: remember your language preference on subsequent visits.</li><li><strong>Firebase authentication</strong> — after a successful login, a session token is stored in your browser&#39;s IndexedDB. Required to keep you logged in across browser restarts and to authenticate API requests.</li><li><strong><code class="text-sm bg-gray-100 dark:bg-gray-700 px-1 rounded">mm_ab_hero</code></strong> — cookie storing which of two wordings of the landing page headline your browser was shown, as a single letter (&quot;a&quot; or &quot;b&quot;). Lifetime: 1 year. Purpose: to keep the page stable for you across visits, and to compare which wording readers find clearer. It contains no identifier, is not read across sites, and is not used for advertising or profiling.</li></ul><p class="mb-4 text-gray-700 dark:text-gray-300"> (2) We do not use advertising cookies, tracking pixels or cross-site tracking mechanisms. Should we introduce consent-requiring cookies in the future, we will obtain your explicit prior consent through a consent banner. </p><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 13 Transfers to Third Countries</h2><p class="mb-4 text-gray-700 dark:text-gray-300"> Where personal data is transferred outside the European Economic Area, this is highlighted in the relevant section above. The safeguards in summary: </p><div class="overflow-x-auto mb-4"><table class="min-w-full text-sm text-gray-700 dark:text-gray-300 border border-gray-200 dark:border-gray-700"><thead class="bg-gray-100 dark:bg-gray-800"><tr><th class="px-3 py-2 text-left font-semibold">Recipient</th><th class="px-3 py-2 text-left font-semibold">Country</th><th class="px-3 py-2 text-left font-semibold">Safeguard</th></tr></thead><tbody><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">Hetzner</td><td class="px-3 py-2">Germany</td><td class="px-3 py-2">No third-country transfer</td></tr><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">Amazon SES (eu-central-1)</td><td class="px-3 py-2">EU (Luxembourg / Frankfurt)</td><td class="px-3 py-2">No third-country transfer</td></tr><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">Plausible Insights</td><td class="px-3 py-2">Iceland (EEA)</td><td class="px-3 py-2">No third-country transfer</td></tr><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">Google (Firebase, Firestore, Custom Search, Calendar, Gemini)</td><td class="px-3 py-2">USA</td><td class="px-3 py-2">EU-US Data Privacy Framework + Standard Contractual Clauses (Art. 46 (2) (c) GDPR)</td></tr><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">OpenRouter</td><td class="px-3 py-2">USA</td><td class="px-3 py-2">Standard Contractual Clauses (Art. 46 (2) (c) GDPR)</td></tr><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">OpenAI</td><td class="px-3 py-2">USA</td><td class="px-3 py-2">EU-US Data Privacy Framework + Standard Contractual Clauses</td></tr><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">Anthropic</td><td class="px-3 py-2">USA</td><td class="px-3 py-2">Standard Contractual Clauses (Art. 46 (2) (c) GDPR)</td></tr><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">Paddle.com Market Ltd</td><td class="px-3 py-2">United Kingdom</td><td class="px-3 py-2">EU Commission adequacy decision of 28 June 2021</td></tr></tbody></table></div><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 14 Retention Periods</h2><div class="overflow-x-auto mb-4"><table class="min-w-full text-sm text-gray-700 dark:text-gray-300 border border-gray-200 dark:border-gray-700"><thead class="bg-gray-100 dark:bg-gray-800"><tr><th class="px-3 py-2 text-left font-semibold">Data category</th><th class="px-3 py-2 text-left font-semibold">Retention</th></tr></thead><tbody><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">Profile and master data</td><td class="px-3 py-2">

1with account deletion</td></tr><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">Email templates and modules</td><td class="px-3 py-2">until account deletion</td></tr><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">Execution history</td><td class="px-3 py-2">12 months from creation</td></tr><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">Credit transactions / invoice-related data</td><td class="px-3 py-2">10 years (statutory retention under Sec. 257 HGB, Sec. 147 AO) — pseudonymised after account deletion</td></tr><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">Paddle webhook events (idempotency log)</td><td class="px-3 py-2">90 days</td></tr><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">Server logs (Hetzner / Nginx / PM2)</td><td class="px-3 py-2">14 days</td></tr><tr class="border-t border-gray-200 dark:border-gray-700"><td class="px-3 py-2">Topic feedback (up/down votes)</td><td class="px-3 py-2">until account deletion</td></tr></tbody></table></div><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 15 Data Security</h2><p class="mb-4 text-gray-700 dark:text-gray-300"> (1) All data transfers between your device and our servers are encrypted with TLS (HTTPS, at least TLS 1.2). Data in Cloud Firestore is encrypted server-side (AES-256). </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (2) Sensitive tokens (in particular OAuth refresh tokens for Google Calendar) are stored encrypted in addition. </p><p class="mb-4 text-gray-700 dark:text-gray-300"> (3) Administrative access to the Hetzner server is restricted to SSH with public-key authentication; the reverse proxy (Nginx) enforces HTTPS and renews Let&#39;s Encrypt certificates automatically. We continuously improve our security measures in line with technological developments. </p><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 16 Changes to this Privacy Policy </h2><p class="mb-4 text-gray-700 dark:text-gray-300"> We reserve the right to amend this privacy policy so that it always meets current legal requirements or to reflect changes in our service, e.g. when introducing new functionality. The new version applies to any future visit. We will notify you of material changes by email or in-app before they take effect. </p><h2 class="text-2xl font-semibold mt-8 mb-4 text-gray-900 dark:text-white">§ 17 Contact</h2><p class="mb-4 text-gray-700 dark:text-gray-300"> For questions about the collection, processing or use of your personal data, or to exercise your rights under § 2, please contact: </p><div class="bg-gray-50 dark:bg-gray-800 p-4 rounded-lg"><p class="font-semibold text-gray-900 dark:text-white">Web Highlights GmbH</p><p class="text-gray-700 dark:text-gray-300">Glockenstr. 35</p><p class="text-gray-700 dark:text-gray-300">40476 Düsseldorf, Germany</p><p class="text-gray-700 dark:text-gray-300">Email: [email protected]</p><p class="text-sm text-gray-600 dark:text-gray-400 mt-2"> Please prefix privacy enquiries with the subject “Datenschutz” — we will respond within 30 days. </p></div><p class="mt-4 text-sm text-gray-600 dark:text-gray-400"> Last updated: May 2026 </p>',28))])])}}});export{k as default};