Privacy policy

1. Controller and scope

70six – Thomas Peter Webconsulting

Owner: Thomas Peter

Odenwaldstraße 7, 63814 Mainaschaff, Deutschland

Telefon: +49 179 10 70 272

E-Mail: thomas@70six.de

This policy covers bleibt.app, host accounts and event albums, including guest uploads. For privacy requests and deletion requests contact thomas@70six.de.

2. Website and hosting

The application is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Connections involve technical data such as IP address, time, requested address, and browser and connection information. We process this information to deliver and secure the service and investigate errors, under Article 6(1)(f) GDPR (our legitimate interest in reliable and secure operation).

Provider information: https://www.hetzner.com/de/legal/privacy-policy/

3. Account and event administration

Registration involves your display name, email address, authentication information and an internal user identifier. We also process event title, date, settings, invitations, permissions and selected package periods to provide accounts and album administration under Article 6(1)(b) GDPR.

Supabase provides authentication, the database and private media storage. The selected project region is Frankfurt am Main (EU). Supabase operates internationally; choosing an EU project region does not rule out processing of operational or support data outside the EEA. Provider, recipient and transfer information: https://supabase.com/privacy and https://supabase.com/legal/customer-resources/data-processing-addendum.

4. Photos, videos and voice messages

Guests can upload without a host account. We process selected files, file name, type, size, upload time, event assignment and, where supplied, guest name, category or answer to an audio prompt. Media may include images, audio and metadata relating to other people.

Files are stored, technically checked and prepared for preview, gallery display and download. This may generate thumbnails and playback versions. Hosts can manage and export content. Guest gallery visibility depends on event settings.

Providing the album to the host is based on Article 6(1)(b) GDPR. Guests give consent before voluntarily submitting media (Article 6(1)(a) GDPR). The host determines the occasion, invitations and authorised access and is responsible for their own use or disclosure of content.

Only upload content you are entitled to share. Your upload consent does not replace necessary rights or consent from people depicted or recorded. You can withdraw consent for the future through the host or thomas@70six.de. Earlier lawful processing remains unaffected. Withdrawal cannot automatically recall copies already downloaded by recipients.

5. Access and recipients

Depending on event settings, event links and QR codes permit uploads and gallery access. Sharing a link may give additional people access. Keep it confidential. Media uses private storage; downloads use time-limited links.

Recipients include hosts, administrators and guests authorised by event settings and service providers used for hosting, authentication and storage. Operator access may be necessary for support, security, technical processing or deletion requests. Disclosures required by law remain possible.

6. Cookies and local storage

Authentication uses necessary session cookies. Your browser may also store the accepted upload consent and information or files used to resume interrupted uploads (Local Storage and IndexedDB). Camera and microphone access requires your browser permission for the recording function you select.

Necessary storage or access relies on section 25(2)(2) TDDDG. Subsequent processing relies on Article 6(1)(b) or (f) GDPR, depending on its purpose, or on upload consent. Clearing site data in your browser may remove your session or upload resume information.

bleibt.app currently has no advertising or analytics trackers. Fonts are served locally.

7. Retention and deletion

Account data is processed for the duration of account use and related matters. Event media availability follows the period displayed in the album. The end of gallery access does not mean all stored data is immediately and completely deleted.

Hosts can delete individual content or the event. Data subjects can request deletion from the host or us. Data that is no longer needed is deleted unless legal obligations or necessary legal claims require retention. Temporary uploads and export files are technically cleaned up; the export download availability is shown in the album.

Information required for statutory retention or the establishment, exercise or defence of legal claims may be retained for that purpose under Article 6(1)(c) or (f) GDPR.

8. Contact and email

Email or telephone enquiries involve processing contact details and the enquiry to respond. Contract-related enquiries rely on Article 6(1)(b) GDPR; other enquiries rely on Article 6(1)(f) (our interest in responding).

Account sign-in and confirmation emails are initiated through the authentication service. Additional automatic service emails are currently disabled. Enquiries are retained only as long as handling them and necessary records require.

9. Payments

Online payments are currently disabled on bleibt.app. bleibt.app currently sends no payment data to Stripe. Before activating payments, we will add information about the actual provider and payment and order data processed.

10. Your rights

Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability (Article 20). You can withdraw consent at any time for the future.

Where processing relies on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation (Article 21). You may object to direct marketing at any time.

You may complain to a supervisory authority. The authority responsible for the operator is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany; https://www.lda.bayern.de. Account information is needed for a host account; guest uploads are voluntary. We do not make automated decisions within the meaning of Article 22 GDPR.