Privacy Policy Stack App

Status: 8th June 2026

Table of contents

1. Preamble

2. Privacy Policy App Introduction

3. Who is responsible for processing my personal data and how can I contact the data protection officer?

4. What categories of data do we process as Datapods and where do they come from?

5. Who has access to my personal data?

6. What is the purpose and the legal basis of processing my personal data?

7. Will my data be shared with third parties?

8. Which companies do we contact to import the personal data in the Stack App?

9. Which third-party providers do we use to provide functions in the Stack App?

10. What other data is collected by using third party providers to improve the Stack App?

11. What data is processed for Marketing Activities?

12. For how long will my data be stored?

13. Can I object to the processing of my personal data?

14. Where can I lodge a complaint?

15. Am I obliged to provide my data?

16. What are my rights as a data subject?

1. Preamble

Welcome to the Stack App by Datapods! We consider the protection of your data and your privacy to be of the utmost importance. If you have any questions, be sure to let us know. Have fun scrolling!

2. Privacy Policy App Introduction

According to Art. 4 No. 1 GDPR, personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly. Further information on this can be found in Art. 4 No. 1 GDPR.

This privacy policy can be accessed, saved and printed at datapods.app.

Insofar as we cite our legitimate interest or a legitimate interest of a third party (Art. 6 para. 1 lit. f) GDPR) as the legal basis for the processing of personal data, you have the right to object in accordance with Art. 21 GDPR:

In accordance with Art. 21 GDPR, you have the right to object to the processing of personal data at any time. We will then no longer process the personal data for the purposes of direct marketing or related profiling.

We will also not process your personal data for other purposes following an objection, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims (see, for example, Art. 21 para. 1 GDPR, so-called “limited right to object”). In this case, you must provide reasons for the objection that arise from your particular situation.

You can also object to the processing of your personal data for reasons arising from your particular situation, for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 para. 1 GDPR, unless the processing is necessary for the performance of a task carried out in the public interest (see Art. 21 para. 6 GDPR).

We will also inform you separately about your right to object in the individual sections (e.g. by stating: “You have the right to object”), if this right exists. There you will also find further information on exercising your right to object.

In order to keep the following privacy policy concise, we provide links at various points to information and data protection notices on external websites. We make every effort to keep the links that we list in this privacy policy up to date. Nevertheless, due to the constant updating of the websites, it cannot be ruled out that links may not function correctly. If you notice such a link, we would be pleased if you let us know so that we can update the link.

3. Who is responsible for processing my personal data and how can I contact the data protection officer?

You can contact our data protection coordinator by email at finn@datapods.app.

The controller within the meaning of Art. 4 No. 7 GDPR for the processing of personal data is:

Datapods GmbH

Kölnstraße 179b 53111 Bonn

E-mail: kontakt@datapods.app

represented by: Jakob Endler, Lukas Stein, Finn Rübo, David Goldschmidt.

4. What categories of data do we process as Datapods and where do they come from?

We process your personal data (e.g. from your requests submitted to us, such as downloading our application) in connection with the delivery of Datapods services. The extent to which we collect, process and use this data depends on the services provided by Datapods. This is usually the following data in particular:

• First name and surname,

• gender

• date of birth,

• place of birth,

• e-mail addresses,

• postal address,

• cell phone number,

• nationality,

• IP address,

• device identification

• location information.

When processing your personal data, we differentiate between personal data that we collect directly from you and personal data that we receive from other sources.

4.1 Personal data that we collect directly from you

We collect the personal data that you provide to us when downloading our application (“Stack App”) or when using Stack, as well as master data that is transmitted via interfaces of the companies for which we offer a portability or download function. We also collect personal data that we request from you for the proper delivery of Stack and its offerings. Please refrain from transmitting your data if you do not agree to it being processed. In this case, no further processing will take place.

4.1.1 GPS data

One category of personal data that we collect directly from you is GPS or location data. In our app, you have the option to view your location information. To use this feature, location services must be enabled. Once they are enabled and you add GPS data as a data source for the first time, the app will ask you to grant access to your location information. Your confirmation grants access to your location information for visualization and analysis in the form of a heat map. You can disable the app’s access to your location at any time in the relevant settings within the app and on the corresponding mobile device. If you allow access to your location data in our app, your mobile device will transmit your location within the cell you are in to us. If your mobile device has a GPS receiver, this location data will also be transmitted to us.

4.2 Personal data that we receive from other sources

We use data collected by third party companies for data processing that we receive via portability and download functions of respective companies. This data is transferred to servers in Amsterdam, Netherlands, where it is categorized and encrypted. The encrypted data is stored in our database operated by Supabase (data center in Frankfurt, Germany). We have concluded order processing contracts with the operators of these data centers. Your third-party user data is encrypted at rest with AES-256 and stored in our databases on Supabase servers that are certified according to SOC2 type 2. During transmission, the data is encrypted using TLS. Sensitive information such as access tokens and keys are encrypted at the application level before they are stored in the database.

4.2.1 Google

The transfer of personal data from Google, takes place by means of your authentication via your Google account.

Google Takeout

After successful authentication, exports of Google data can be carried out via Google Takeout and stored in your Google Drive. We access your Google Maps, Chrome and YouTube data. This data is encrypted by us and used for further analysis and visualization.

The data we use for further analysis and thus process and store is:

• the browsing data, in particular the URL, the icon and title and the client ID, page transition as well as the time of access,

• the location data, in particular latitude and longitude as well as the time of the location retrieval,

• YouTube history, in particular video title, video URL, channel name, channel URL, advertisements played and time of access.

Google Data Portability API

After successful authentication, exports of Google data can be carried out via the Google Data Portability API. We access your Google Maps, Chrome-, Play and MyActivity data. This data is encrypted by us and used for further analysis and visualization.

The data we use for further analysis and thus process and store is:

• the browsing data, in particular the URL, the icon and title and the client ID, page transition as well as the time of access of webpages in the past,

• the maps data, in particular your pinned trips and your electric vehicle profile,

• the my activity data, in particular your Maps activity, your My Ad Center activity, your Google Search activity, your Shopping activity and your YouTube activity including time of access,

• the play data, in particular information about your devices with Google Play Store installed, your Google Play Store Grouping tags created by app developers, your Google Play Store app installations, your Google Play Store downloads, including books, games, and apps, information about your Google Play Store promotions, your Google Play Store purchases, your Google Play Store redemption activities, your Google Play Store subscriptions.

The use of information received from the Data Portability API adheres to the Data Portability API user data and developer policy, including the Limited Use Requirements.

To revoke permission to export data from your Google account, you can either disconnect directly in the app or follow these steps:

1. Click on this link: https://myaccount.google.com/data-and-privacy

2. Log in with the Google account you used to connect to us.

3. Search for “Datapods” in the list of “Third-party apps and services.”

4. Delete all existing connections to Datapods.

Gmail

After successful authentication, exports of Gmail data can be carried out via the Gmail API. We access your Gmail inbox via read only access to collect copies of and information from commercial emails. This data is encrypted by us and used for further analysis and visualization.

Commercial Emails we use for further analysis and thus process and store is:

• transactional emails, purchase receipts, sales receipts, delivery confirmations and returns, subscription confirmations and cancellations, registration confirmations, and marketing and promotional emails.

The use of information received from the Gmail API adheres to the Google API user data and developer policy, including the Limited Use Requirements.

Security of your Google data

Datapods uses this data for visualization purposes within the Stack App and for aggregated statistical analysis, in accordance with the User Agreement. Without your consent or a separate Data Monetization Agreement, your Google user data will never be disclosed to third parties in a personally identifiable form (except for those explicitly designated as data processors in this statement).

To verify the security of the Stack app with Google, Datapods undergoes the Cloud Application Security Assessment (CASA) annually.

4.2.2 Meta

The transfer of personal data from Meta, takes place by means of your authentication via your account for the respective Meta service.

Instagram

After successful authentication, exports of Instagram data can be carried out via the Export Your Information function (EYI). We access the information about Your Instagram activity, Personal information, Connections, Logged information, Apps and websites off of Instagram, Preferences and Ads information. This data is encrypted by us and used for further analysis and visualization.

The data that we use for further analysis and thus process and store is:

• the Instagram activity data, in particular Avatars Store, Edits, Shopping, Comments, Events, Fundraisers, Gifts, Guides, Instagram Live, Messages, Meta Spark, Monetization, Quicksnaps, Reports, Saved, Story Sticker Interactions, Subscriptions, Other activity

• the Personal information, in particular Autofill information, Digital Wallets, Loyalty Accounts

• the Connections data, in particular Contacts,

• the Logged data, in particular Link history, Past Instagram Insights and Policy Updates and Permissions,

• the App and website data off of Instagram, Apps and Websites, Data shared with third parties,

• the Preferences, in particular Your Topics,

• the Ads information, in particular the Instagram Ads and businesses, Advertising and Ads and Topics.

Facebook

After successful authentication, exports of Facebook data can be carried out via the Export Your Information function (EYI). We access the information about your Facebook activity, personal information, connections, logged information, apps and websites off of Instagram, preferences, ads information and data logs. This data is encrypted by us and used for further analysis and visualization.

The data that we use for further analysis and thus process and store is:

• the Facebook Activity data, in particular Your AI activity, Comments and reactions, Dating, Events, Notes, Gaming, Groups, Jobs, Short videos, Link hisotry, Live videos, Facebook Marketplace, Messages, Instant savings, Friends, Profile information, Navigation bar, Pages, Facebook payments, Your places, Polls, Posts, Saved items and collections, Shopping, Shops, Stories, Subscriptions, Activity you're tagged in, Other activity,

• the Personal information, in particular Facebook Accounts Center, Facebook Assistant, App name, Other personal information, Profile information,

• the Connections, in particular Followers, Friends and followers, Parental approval you gave,

• the Logged information, in particular in-App messages, Form submissions, Your interactions on Facebook, Location, Other logged information, Activity messages, Music recommendations, Facebook News, Your topics, Search,

• the Apps and websites off of Facebook, in particular Apps and websites off of Facebook, Feed, Preferences,

• the Ads information,

• the Download data logs.

Security of your Meta data

Datapods uses this data for visualization purposes within the Stack App and for aggregated statistical analysis, in accordance with the User Agreement. Without your consent or a separate Data Monetization Agreement, your Meta user data will never be disclosed to third parties in a personally identifiable form (except for those explicitly designated as data processors in this statement).

4.2.3 Apple

The transfer of personal data from Apple, takes place by means of your authentication via your Apple account.

After successful authentication, exports of Apple data can be carried out via the Apple Account Data Transfer API. We access your App Install and Push Notifications Activity data and App Store Information. This data is encrypted by us and used for further analysis and visualization.

The data we use for further analysis and thus process and store is:

• the App Install Activity, in particular data related to your installation of any application in iOS, such as "first time install", "re-install", "auto update", etc.,

• the Push Notifications Activity, in particular data on your user experience impression and click data associated with your push notifications for various services across iOS, macOS, iPadOS, and tvOS.,

• the App Store Information, in particular your App Store Click Activity, Apple ID Device Information, Pre-order History, Report a Problem Refund and Dispute History, Review Profile, Reviews, Store Redownload and Update History, Store Transaction History - Free Apps, Store Transaction History, Subscription Click Activity, Subscription History, Votes,

The use of information received from the Apple Account Data Transfer API adheres to the Apple Account Data Transfer API user data and developer policy.

Security of your Apple data

Datapods uses this data for visualization purposes within the Stack App and for aggregated statistical analysis, in accordance with the User Agreement. Without your consent or a separate Data Monetization Agreement, your Apple user data will never be disclosed to third parties in a personally identifiable form (except for those explicitly designated as data processors in this statement).

4.2.4 Amazon

The transfer of personal data from Amazon, takes place by means of your authentication via your Amazon account.

After successful authentication, exports of Amazon data can be carried out via the Amazon Data Portability API. We access your Amazon customer data. This data is encrypted by us and used for further analysis and visualization.

The data we use for further analysis and thus process and store is:

• the customer profile, product reviews as well as seller feedback,

• advertising preferences and clicked ads, Alexa shopping lists, contact information, custom products, customer attributes, digital order returns, digital orders, digital redemptions, digital software and video games downloads, Digital software and video games entitlements, digital software and video games subscriptions, digital subscription bills, digital subscriptions, garage vehicles, gift lists, lists, physical order returns, physical orders, physical product subscriptions, product substitution preferences, search history, shopping basket,shopping profile preferences, sports interests.

Security of your Amazon data

Datapods uses this data for visualization purposes within the Stack App and for aggregated statistical analysis, in accordance with the User Agreement. Without your consent or a separate Data Monetization Agreement, your Amazon user data will never be disclosed to third parties in a personally identifiable form (except for those explicitly designated as data processors in this statement).

4.2.5 Microsoft

LinkedIn

The transfer of personal data from LinkedIn, takes place by means of your authentication via your LinkedIn account.

After successful authentication, exports of LinkedIn data can be carried out via the LinkedIn Member Portability (3rd Party) API. We access your LinkedIn customer data. This data is encrypted by us and used for further analysis and visualization.

The data we use for further analysis and thus process and store is:

• clicked ads, list of people you follow, stored account logins, URLs of shared content, recent searches, inferred information, comments, contacts imported, events, receipts, ad targeting information, registration date, reviews, articles, patents, groups, companies that you follow, invitations, phone numbers, connections, e-mail addresses, job postings, job applications, job seeker preferences, learning, inbox, saved jobs, profile, skills, positions, education, test scores, causes you care about, publications, projects, organizations, languages, honors, courses, certifications, calendar, recommendations, endorsements, member share info, security challenge pipe, trusted graph, marketplace engagements, marketplace providers, marketplace opportunities, saved items, job applicant saved answers, talent questions saved response, profile summary, all likes, all votes, receipts, learning coach, learning roleplay, volunteering experience, account history, instant reposts;

• People changelog events, endorsement, recommendation, publishing articles, UGC posts, social actions, organizations, invitations, messages, LinkedIn events.

Outlook

After successful authentication, exports of Outlook data can be carried out via the Outlook mail REST API API. We access your Outlook inbox via read only access to collect copies of and information from commercial emails. This data is encrypted by us and used for further analysis and visualization.

Commercial Emails we use for further analysis and thus process and store is:

• transactional emails, purchase receipts, sales receipts, delivery confirmations and returns, subscription confirmations and cancellations, registration confirmations, and marketing and promotional emails.

The use of information received from the Outlook mail REST API adheres to the Microsoft APIs Terms of Use.

Security of your Microsoft data

Datapods uses this data for visualization purposes within the Stack App and for aggregated statistical analysis, in accordance with the User Agreement. Without your consent or a separate Data Monetization Agreement, your Microsoft user data will never be disclosed to third parties in a personally identifiable form (except for those explicitly designated as data processors in this statement).

4.2.6 Data rentention

This data is made available for the duration of your use of the Stack App and deleted or anonymized if you so wish or if you permanently delete your Stack account.

5. Who has access to my personal data?

Our systems are developed according to the principles of privacy by design. We ensure that our employees only have access to the personal data that is absolutely necessary to provide our services. Our employees generally do not have access rights to your personal data that is processed in the Stack App and allows identification (such as personal details, third-party company data or usage data). The only exceptions are developers who work on the database as part of the tasks listed below ("Authorized Personnel"). All available data is stored in encrypted form in our Supabase database (data center in Frankfurt, Germany).

There are some exceptions to this principle of privacy by design in which Authorized Personnel may access your personal data:

• Support requests: if you contact our support, it may be necessary for Authorized Personnel to access your personal data to help you resolve issues.

• Explicit consent: If you provide us with personal data within the Stack App with explicit consent, e.g. to optimize our data analysis or to improve our services.

• Regulatory requirements: Where we are required to do so by law or regulation, for example as part of requirements to combat money laundering or terrorist financing.

• Contract processing: To ensure the proper processing of the services of the Stack App, Authorized Personnel may access the personal data required to carry out the process (e.g. pseudonymization key or order status).

• Data Monetization Platform: If you agree to pass on your data to cooperation partners via the Stack App, it may be necessary for Stack to access your data in order to process the transfer. The data will only be passed on to third parties in pseudonymized and aggregated form if you have expressly concluded a user agreement with us for participation in the data marketing platform.

• Further development and maintenance: To be able to continuously offer the services of the Stack App, to improve them and to be able to develop and offer new functions.

6. What is the purpose and the legal basis of processing my personal data?

6.1 To fulfill our contractual obligations, Art. 6 para. 1 lit. b) GDPR.

We collect your personal data in order to provide you with our Stack app upon your request, which allows you to, by downloading, playing and completing tasks in certain apps, answering surveys, scanning receipts, and providing your user data from certain third-party companies for visualization in the Stack app and for the generation of statistical, non-personal insights for our Customers, receive rewards.

We also collect and use this data when you join the separate Data Monetization Platform.

The applicable legal basis is Art. 6 para. 1 lit. b) GDPR, which permits the processing necessary for the performance of a contract or in order to take steps prior to entering into a contract.

This data is collected:

• to provide relevant apps for downloading, playing, and completing tasks, as well as the necessary tracking through our partner adjoe.

• to provide relevant surveys, as well as the necessary master data and necessary tracking through our partner CPX Research.

• to provide a mobile application with which you can log into your user accounts of third party companies and retrieve data from them via dedicated APIs, e.g. Google Takeout,

• for the automated creation of categorizations and analyses based on the provided third party user account data (e.g. Chrome history, YouTube history, location data),

• to visualize and analyze your data within the Stack App,

• to answer queries relating to the provision of the Stack App,

• to manage and analyze your data and to improve the services we offer,

• to conclude and manage a data monetisation agreement with Datapods,

• for forwarding to service providers for the purpose of carrying out an identity check in compliance with money laundering regulations, if necessary,

• to fulfill regulatory requirements to which we are subject to, in particular to combat money laundering and terrorist financing.

If necessary, we process your personal data at your request for the purpose of arranging, fulfilling and/or terminating a contract to be concluded with us or subsequently concluded or another contract to which you are a party (see User Agreement for the Stack App). In particular, we create a file for your identification when you contact us for the purpose of providing the contractually agreed service. In order to fulfill the contract, we also create needs analyses, manage and service your contract or improve these processes.

6.2 To fulfill our legal obligations, Art 6 para. 1 lit. c) GDPR.

We may collect and process your personal data in order to comply with legal obligations to which we are subject. This includes, for example, compliance with regulatory requirements or legal requirements that apply to the performance of our services.

6.3 To protect our legitimate interests and the interests of other controllers or third parties in data processing, Art. 6 para. 1 lit. f) GDPR.

We process your personal data to protect our legitimate interests where this is necessary. This includes:

• the improvement and further development of our app and services,

• carrying out security analyses to ensure the security of your data

• processing support requests and ensuring the proper operation of the app

• the sending of advertising information within the legally permissible framework (Section 7 Para. Act against Unfair Competition (UWG)), i.e. if you are our customer and you have not objected to this.

• conducting market and opinion research in order to better adapt our services to the needs of our users

• the assertion and defense of legal claims.

6.4 To process your data based on your consent, Art 6 para. 1 lit. a) GDPR.

If you have given us your explicit consent, we will process your personal data for specific purposes agreed by you. These may include the following:

• the processing of the data sources added by you in order to create anonymised, non-personal analyses and insights for Datapods' customers, in return for which you receive a multiplier on your rewards.

• the forwarding of promotional information, e.g. by email,

• the optimization of our analyses, such as the improved visualization of your data,

• to track how you came to use our service and how you use our service via conversions and in-app events.

Multiplier through the addition of data sources:

If you voluntarily add data sources in the Stack App, we process the data stored about you at third-party companies via those sources in order to create, in aggregated form, anonymised statistical analyses and insights, which we provide to Datapods' customers. In return, you receive a multiplier on the rewards you earn through our partners adjoe and CPX Research. Which data sources lead to which multiplier is shown to you in the Stack App.

The legal basis for the processing of your personal data up to the point of anonymisation is your consent pursuant to Art. 6(1)(a) GDPR, which you give by adding the relevant data source. In this context, no personal data is passed on to Datapods' customers; they receive exclusively anonymised, non-personal results.

You can withdraw your consent at any time by removing the relevant data source in the Stack App or by contacting us using the contact details provided above. The withdrawal does not affect the lawfulness of the processing carried out up to that point; the multiplier granted for the relevant data source ceases to apply for the future. Analyses and insights that have already been created in anonymised form can no longer be attributed to you and are not covered by the withdrawal.

7. Will my data be shared with third parties?

Your personal data will not be passed on to third parties unless you conclude a User Agreement for the Data Monetization Platform with us that goes beyond the User Agreement for the Stack App. However, we use the services of certain processors and third party, which you can view in section 9.

8. Which companies do we contact to import the personal data in the Stack App?

In order to import your personal data from companies to the Stack App, display it there, and receive a corresponding multiplier on your rewards, we may need to contact the relevant companies directly or through you. Depending on the company, data is processed by us for authentication and other purposes. Providing your personal data is neither legally nor contractually required. However, if you do not provide it, you will not be able to use the main functions of our app.

We contact the following companies to provide the functions of the Stack App:

8.1 Google

Google collects a range of data when you log into your account via our app. This may include, for example, unique identifiers, the type and settings of the browser, the type and settings of the device, the operating system, mobile network information such as the name of the mobile network provider and the telephone number as well as the version number of the app. In addition, Google may collect data about the interaction of your apps, browsers and devices with its services. This includes the IP address, crash reports, system activity and the date, time and referral URL of your request.

For detailed information on how Google processes your personal data, please refer to Google's privacy policy.

8.2 YouTube

YouTube does not collect any personal data about you via our app. In order to visualize your historical YouTube data with the correct contextual data, we request this data for all videos watched by our users. We use YouTube API Services for this purpose.

8.3 Meta

Meta collects a range of data when you log into your account via our app. This may include, for example, unique identifiers, the type and settings of the browser, the type and settings of the device, the operating system, mobile network information such as the name of the mobile network provider and the telephone number as well as the version number of the app. In addition, Google may collect data about the interaction of your apps, browsers and devices with its services. This includes the IP address, crash reports, system activity and the date, time and referral URL of your request.

For detailed information on how Meta processes your personal data, please refer to Meta's privacy policy.

8.4 Apple

Apple collects a range of data when you log into your account via our app. This may include, for example, unique identifiers, the type and settings of the browser, the type and settings of the device, the operating system, mobile network information such as the name of the mobile network provider and the telephone number as well as the version number of the app. In addition, Apple may collect data about the interaction of your apps, browsers and devices with its services. This includes the IP address, crash reports, system activity and the date, time and referral URL of your request.

For detailed information on how Apple processes your personal data, please refer to Apple's privacy policy.

8.5 Amazon

Amazon collects a range of data when you log into your account via our app. This may include, for example, unique identifiers, the type and settings of the browser, the type and settings of the device, the operating system, mobile network information such as the name of the mobile network provider and the telephone number as well as the version number of the app. In addition, Amazon may collect data about the interaction of your apps, browsers and devices with its services. This includes the IP address, crash reports, system activity and the date, time and referral URL of your request.

For detailed information on how Amazon processes your personal data, please refer to Amazon's privacy policy.

8.6 Microsoft

Microsoft collects a range of data when you log into your account via our app. This may include, for example, unique identifiers, the type and settings of the browser, the type and settings of the device, the operating system, mobile network information such as the name of the mobile network provider and the telephone number as well as the version number of the app. In addition, Microsoft may collect data about the interaction of your apps, browsers and devices with its services. This includes the IP address, crash reports, system activity and the date, time and referral URL of your request.

For detailed information on how Microsoft processes your personal data, please refer to Microsoft's privacy policy.

8.7 ByteDance

ByteDance collects a range of data when you log into your account via our app. This may include, for example, unique identifiers, the type and settings of the browser, the type and settings of the device, the operating system, mobile network information such as the name of the mobile network provider and the telephone number as well as the version number of the app. In addition, ByteDance may collect data about the interaction of your apps, browsers and devices with its services. This includes the IP address, crash reports, system activity and the date, time and referral URL of your request.

For detailed information on how ByteDance processes your personal data, please refer to ByteDance's privacy policy.

9. Which third-party providers do we use to provide functions in the Stack App?

In order to make the Stack App and its functions available to you, we use the services of various third-party providers to whom we transfer certain personal data. Providing your personal data is neither legally nor contractually required. However, if you do not provide it, you will not be able to use certain essential functions of our app.

We use the following third-party providers provide the functions of the Stack App:

9.1 Supabase

Supabase is operated by Supabase, Inc, a Delaware corporation headquartered at 970 Toa Payoh North #07-04, Singapore 318992.

9.1.1 Description and scope of data processing

Supabase serves us as a database solution for storing and managing the data you enter in the app. Personal data may be stored, in particular registration data (such as first and last name, e-mail addresses, cell phone number, date and place of birth, postal address) and the data generated through the use of the app. This information is stored on servers in the EU (data center in Frankfurt, Germany) and secured using modern encryption methods.

Supabase does not rule out the possibility that personal data may also be processed on servers in the USA and Singapore. Supabase is not certified in accordance with the EU-U.S. Data Privacy Framework. However, a data processing annex has been concluded with Supabase as part of a data processing agreement that contains the standard clauses of the European Commission, with which Supabase is obliged to process personal data in compliance with the GDPR and to guarantee the same for its sub-processors.

Further information on data processing by Supabase can be found in Supabase's privacy policy. Supabase states that it uses these sub-processors.

Personal data is stored for as long as it is required to fulfill the purpose of processing. Once it is no longer required, the data will be deleted, provided there are no statutory retention obligations.

9.1.2 Purpose of processing

The purpose of this processing is to provide the functionalities of our app and to enable the correct display of our app on your device as part of your user agreement with Datapods.

9.1.3 Data rentention

Personal data is stored for as long as it is necessary to fulfill the purpose of processing. Once this is no longer necessary, the data is deleted, provided there are no statutory retention obligations.

9.1.4 Right to object

You have the right to object to the processing of your data. You can inform us of your objection at any time (e.g. by e-mail to kontakt@datapods.app).

9.2 Google Cloud

Google Cloud is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

9.2.1 Description and scope of data processing

Google Cloud is used by us to process and store data that is generated as part of the process of downloading and making data available to companies. Personal data may be stored, in particular registration data (such as name, e-mail address) and the data retrieved by the requested companies. This data is processed on servers in the EU (data centers in Amsterdam, Netherlands).

Further information on data processing by Google Cloud can be found in Google's privacy policy. According to its own information, Google Cloud uses these sub-processors.

9.2.2 Purpose of processing

The purpose of this processing is to provide the functionalities of our app and to enable the correct display of our app on your device as part of your user agreement with Datapods.

9.2.3 Data rentention

Personal data is stored for as long as it is necessary to fulfill the purpose of processing. Once this is no longer necessary, the data is deleted, provided there are no statutory retention obligations.

9.2.4 Right to object

You have the right to object to the processing of your data. You can inform us of your objection at any time (e.g. by e-mail to kontakt@datapods.app).

9.3 Firebase Cloud Messaging

Firebase Cloud Messaging (FCM) is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

9.3.1 Description and scope of data processing

Firebase Cloud Messaging is used to send push notifications to your device to inform you about relevant events in the app. Personal data such as device and app instance IDs may be processed in order to deliver the messages in a targeted manner. This data is stored on Google servers, whereby Google is obliged to use the standard contractual clauses for the transfer of personal data to third countries for each transfer of personal data to a third country, which also apply to Google as a sub-processor of Datapods.

Further information on data processing by Firebase Cloud Messaging can be found in Google's privacy policy. Firebase Cloud Messaging states that it uses these sub-processors.

9.3.2 Purpose of processing

The purpose of this processing is to provide the functionalities of our app and to enable the correct display of our app on your device as part of your user agreement with Datapods.

9.3.3 Data rentention

Personal data is stored for as long as it is necessary to fulfill the purpose of processing. Once this is no longer necessary, the data is deleted, provided there are no statutory retention obligations.

9.3.4 Right to object

You have the right to object to the processing of your data. You can inform us of your objection at any time (e.g. by e-mail to kontakt@datapods.app).

9.4 Prelude

Prelude is operated by Ding SAS, 82, rue Dutot, 75015 Paris, France.

9.4.1 Description and scope of data processing

Prelude is used to deliver SMS messages, for example to verify your telephone number or to send important notifications. Personal data such as your telephone number and the content of the messages sent may be processed. This data is stored on AWS servers in the European Union.

Further information on data processing by Prelude can be found in Prelude's privacy policy.

9.4.2 Purpose of processing

The purpose of this processing is to provide the functionalities of our app as part of your user agreement with Datapods as well as to deliver marketing if applicable.

9.4.3 Data rentention

Personal data is stored for as long as it is necessary to fulfill the purpose of processing. Once this is no longer necessary, the data is deleted, provided there are no statutory retention obligations.

9.4.4 Right to object

You have the right to object to the processing of your data. You can inform us of your objection at any time (e.g. by e-mail to kontakt@datapods.app).

9.5 Resend

Resend is operated by Resend, Inc, 2261 Market Street #5039, San Francisco, CA 94114, USA.

9.5.1 Description and scope of data processing

Resend is used to deliver e-mail notifications, for example to confirm your e-mail address or to send important messages. Personal data such as your e-mail address and the content of the messages sent may be processed. This data is stored on Resend's servers.

Resend transfers and processes personal data to servers in the USA. Resend is not certified under the EU-U.S. Data Privacy Framework. However, a data processing annex has been concluded with Resend as part of a data processing agreement that contains the standard clauses of the European Commission, with which Resend undertakes to process personal data in compliance with the GDPR and to guarantee this for its sub-processors as well.

Further information on data processing by Resend can be found in Resend's privacy policy. According to its own information, Resend uses these sub-processors.

9.5.2 Purpose of processing

The purpose of this processing is to provide the functionalities of our app as part of your user agreement with Datapods.

9.5.3 Data rentention

Personal data is stored for as long as it is necessary to fulfill the purpose of processing. Once this is no longer necessary, the data is deleted, provided there are no statutory retention obligations.

9.5.4 Right to object

You have the right to object to the processing of your data. You can inform us of your objection at any time (e.g. by e-mail to kontakt@datapods.app).

9.6 OpenAI

OpenAI is operated by OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.

9.6.1 Description and scope of data processing

OpenAI is used for embedding the data received from third-party companies. This involves converting pseudonymized queries, which are available in the form of text, into vectors in order to calculate the interest clusters. This allows the interests to be visualized in the app.

OpenAI transfers and processes personal data to servers outside of the EU. OpenAI is not certified under the EU-U.S. Data Privacy Framework. However, a data processing annex has been concluded with OpenAI within the framework of a data processing agreement that contains the standard clauses of the European Commission, with which OpenAI undertakes to process personal data in compliance with the GDPR and to guarantee this for its sub-processors as well.

Further information on data processing by OpenAI can be found in OpenAI's privacy policy. According to its own information, OpenAI uses these sub-processors.

9.6.2 Purpose of processing

The purpose of this processing is to provide the exposure report in our app as part of your user agreement with Datapods.

9.6.3 Data rentention

Personal data is stored for as long as it is necessary to fulfill the purpose of processing. Once this is no longer necessary, the data is deleted, provided there are no statutory retention obligations.

9.6.4 Right to object

You have the right to object to the processing of your data. You can inform us of your objection at any time (e.g. by e-mail to kontakt@datapods.app).

9.7 Clickhouse

Clickhouse is operated by ClickHouse, Inc., 650 Castro St., Suite 120 #92426, Mountain View CA 94041, USA.

9.7.1 Description and scope of data processing

Clickhouse serves as our database solution for storing and managing the data you enter in the app as well as user data we receive from third-party companies. Personal data is stored, in particular registration data (such as first and last name, email addresses, mobile phone number, date and place of birth, postal address) and data generated through the use of the app. This information is stored on servers in the EU (data center in Amsterdam, Netherlands) and secured using modern encryption methods.

Clickhouse and Google Cloud do not rule out the possibility that personal data may also be processed on servers outside the EU and, if necessary, in the USA. Clickhouse is certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework with UK Extension, and an addendum on data processing has been concluded with Clickhouse as part of a data processing agreement. This obliges Clickhouse to process personal data in compliance with the GDPR and to guarantee this for its subcontractors as well.

Further information on data processing by Clickhouse can be found in Clickhouse's privacy policy. According to its own information, Clickhouse uses these sub-processors.

9.7.2 Purpose of processing

The purpose of this processing is to provide the functionalities of our app, in particular to store and process the user data received and to enable the correct display of our app on your device within the scope of your User Agreement with Datapods.

9.7.3 Data rentention

Personal data is stored for as long as it is necessary to fulfill the purpose of processing. Once this is no longer necessary, the data is deleted, provided there are no statutory retention obligations.

9.7.4 Right to object

You have the right to object to the processing of your data. You can inform us of your objection at any time (e.g. by e-mail to kontakt@datapods.app).

9.8 Vercel

Vercel is operated by Vercel Inc., 650 California St, San Francisco, CA 94108, USA.

9.8.1 Description and scope of data processing

Each time you visit our website, Vercel, which is our server host and acts as a sub-processor for us, automatically collects data and information from your device's system and stores it in server log files. This data is information that relates to an identified or identifiable natural person (here: you, the website visitor). The data is automatically transmitted by your browser when you visit our website. The following data is collected:

• Date/time of accessing our website or calling up a function (request to the host provider's server),

• Internet protocol addresses (IP addresses),

• character string of the user agent that identifies the browser or operating system to the server,

• installed fonts,

• Mime types, i.e. which data the web server sends - for example, whether it is a plain text document, an HTML document or a PNG image,

• Browser language and time zone,

• installed plugins,

• HTTP header,

• screen resolution.

Vercel transfers the collected personal data to servers in the USA and processes it there. An adequacy decision pursuant to Art. 45 GDPR in the form of the EU-US Data Privacy Framework has been in place since 10 July 2023. According to this, US companies can, under certain conditions, ensure a level of protection for personal data that is adequate in comparison to the EU. Vercel has accordingly been certified as a participant to EU-U.S. and the Swiss-U.S. Data Privacy Framework with UK Extension by the responsible US Department of Commerce. Vercel thereby undertakes to process personal data in compliance with the GDPR and to guarantee this for its subcontractors as well.

Further information on this can be found in Vercel's Privacy Policy. According to its own information, Vercel uses the following subprocessors.

9.8.2 Purpose of processing

The purpose of this processing is to make our website accessible from your device and to enable our website to be displayed correctly on your device or in your browser. Furthermore, we use the data to optimise our website and to ensure the security of our systems. Visiting our website may be necessary, for example, to verify your identity at certain data interfaces.

9.8.3 Data rentention

Personal data is stored for as long as it is necessary to fulfill the purpose of processing. Once this is no longer necessary, the data is deleted, provided there are no statutory retention obligations.

9.8.4 Right to object

You have the right to object to the processing of your data. You can inform us of your objection at any time (e.g. by e-mail to kontakt@datapods.app).

9.9 E2B

E2B is operated by Foundrylabs Inc., 166 Geary St 5th Floor, San Francisco, CA 94108, USA.

9.9.1 Description and scope of data processing

As part of our agentic engineering stack, we use E2B to amplify our ability to process and enrich data at scale.

E2B sandboxes are used in the data exploration and access process, serving as a security layer that isolates data access to ephemeral virtual machines.

Your personal data may be pulled into ad hoc E2B sandboxes during analysis to evaluate data classification, enrichment, or categorization workloads.

You can view the results of these workloads inside your app, e.g. as part of the visualization.

E2B transfers and processes personal data to servers outside of the EU. E2B is not certified under the EU-U.S. Data Privacy Framework. However, a data processing annex has been concluded with E2B within the framework of a data processing agreement that contains the standard clauses of the European Commission, with which E2B undertakes to process personal data in compliance with the GDPR and to guarantee this for its sub-processors as well.

Further information on data processing by E2B can be found in E2B's privacy policy.

9.9.2 Purpose of processing

The purpose of this processing is to prepare the exported raw data and enable the corresponding visualizations of your data in our app.

9.9.3 Data retention

Personal data is only stored for as long as it is processed in the Virtual Machine and is deleted afterwards. Deletion generally takes place within 24 hours.

9.9.4 Right to object

You have the right to object to the processing of your data. You can inform us of your objection at any time (e.g. by e-mail to kontakt@datapods.app).

9.10 adjoe

adjoe is operated by adjoe GmbH, An der Alster 42, 20099 Hamburg, Germany.

9.10.1

Playtime (adjoe) is a third-party feature that is integrated with our app. Playtime allows users to earn in-app currency by playing third-party games and collects device application usage data. The processing of this data is necessary to recommend, via system messages, the installation of apps available in Playtime that match users' interests and to calculate the bonuses earned as a result of users' usage of the corresponding apps. For more information, please refer to the Playtime (adjoe) Data Privacy.

9.10.2

The provision of third-party games to earn rewards in the Stack App.

9.10.3 Widerspruchsrecht

You have the right to object to the processing of your data. You may submit your objection to adjoe at any time (e.g., by email to dataprivacy@adjoe.zone).

9.11 CPX Research

CPX Research is operated by Make Opinion GmbH, Elfenallee 5, 13127 Berlin, Germany.

9.11.1 Description and scope of data processing

CPX Research is our survey provider, through which you are offered paid surveys in the app. To ensure that you are shown suitable surveys, personal data is processed, in particular profile and registration data (such as email address, gender, date of birth or age, ZIP code, and a user ID) as well as technical data (e.g., IP address, device information, cookies, and location data).

According to its own statements, CPX Research stores personal data in Germany but does not rule out processing by survey partners in third countries (including the U.S., Canada, France, Romania, Israel, Pakistan, and India). Make Opinion states that it relies on the European Commission’s Standard Contractual Clauses for transfers to third countries.

For more information, please see the Privacy Policy of Make Opinion GmbH.

9.11.2 Zweck der Datenverarbeitung

The purpose of this processing is to provide survey features in our app, specifically to present you with surveys that are relevant to you and to give you the opportunity to receive compensation for participating in them.

9.11.3 Dauer der Speicherung

Personal data is stored for as long as necessary to fulfill the purpose of processing. Once this necessity no longer applies, the data will be deleted, provided there are no legal retention obligations.

9.11.4 Widerspruchsrecht

You have the right to object to the processing of your data. You may submit your objection to CPX Research at any time (e.g., by email to privacy@makeopinion.com).

9.12 Paypal

To enable the payouts of Rewards, we use the Mass Payments function of Paypal. PayPal itself acts as an independent data controller and is therefore responsible for your data and its processing. Further information on this can be found in the Paypal Privacy Statement.

10. What other data is collected by using third party providers to improve the Stack App?

To further improve the Stack App for you, we use third-party providers to help us understand how you came into the Stack App, which functions you use and how you use them. This allows us to better plan new features and improve existing features for you. Providing your personal data is neither legally nor contractually required. However, if you do not provide it, you will not be able to use certain functions of our app.

We use the following third-party providers to improve the Stack App:

10.1 PostHog

PostHog is operated by PostHog Inc, 965 Mission Street, San Francisco, CA 94103, USA.

10.1.1 Description and scope of data processing

PostHog records and reflects your behavior in our app. The storage of this data is limited in time and is used exclusively to improve our service based on your needs. This allows personal data to be stored and evaluated - in particular the user's activity (which subpages have been visited, which elements have been clicked on), device and browser information (in particular the IP address and operating system) and a tracking code (pseudonymized user ID). The information collected in this way is transmitted by PostHog to a server in Frankfurt, Germany and stored there.

We will only collect data through PostHog in line with your profile settings which you can change any time. You are free to consent to this processing or not and we will process your data based on your consent.

Further information on the processing of data by PostHog can be found in PostHog's privacy policy. According to its own information, PostHog uses these sub-processors.

10.1.2 Purpose of processing

The purpose of this processing is to improve the functionality of our app and provide a stable user experience.

10.1.3 Data rentention

The personal data in the form of session recordings are deleted or anonymized after 3 months. The user's activities are stored pseudonymously for as long as they are required to fulfill the purpose of processing, but for a maximum of one year.

10.1.4 Right to object

You have the right to object to the processing of your data. You can inform us of your objection at any time (e.g. by e-mail to kontakt@datapods.app).

10.2 AppsFlyer

AppsFlyer is operated by AppsFlyer Ltd., 14 Maskit St., Herzliya 4673304, Israel.

10.2.1 Description and scope of data processing

AppsFlyer is used as our mobile measurement partner to attribute app installs and in-app events to their respective marketing sources and to provide aggregated campaign performance reports. For this purpose, the AppsFlyer SDK integrated into the Stack App processes personal data, in particular the mobile advertising identifier (IDFA on iOS where consent has been granted under Apple's App Tracking Transparency framework, or the Google Advertising ID on Android), a pseudonymous AppsFlyer device identifier, the IP address, device and operating system information, app version, install and launch timestamps, and information about in-app events (e.g. registration, subscription) which we have configured for measurement. AppsFlyer also receives attribution-related signals from Apple's SKAdNetwork and Google Play Install Referrer.

AppsFlyer transfers and processes personal data on servers in Israel as well as on servers outside the European Economic Area, including the United States. For transfers to Israel, an adequacy decision of the European Commission pursuant to Art. 45 GDPR exists. For transfers to other third countries, a data processing agreement has been concluded with AppsFlyer that contains the standard contractual clauses of the European Commission, with which AppsFlyer undertakes to process personal data in compliance with the GDPR and to guarantee this for its sub-processors as well.

Further information on data processing by AppsFlyer can be found in AppsFlyer's Services Customer Data Processing Policy. According to its own information, AppsFlyer uses these sub-processors.

We will only collect data through AppsFlyer in line with your profile settings, which you can change at any time. You are free to consent to this processing or not, and we will process your data based on your consent.

10.2.2 Purpose of processing

The purpose of this processing is to attribute installs of the Stack App and subsequent in-app events to the marketing channels that drove them, to measure the effectiveness of our marketing activities, to detect ad fraud, and to provide aggregated performance reports to ourselves and our advertising partners.

10.2.3 Data retention

Personal data processed by AppsFlyer is retained for as long as it is necessary to fulfill the purpose of processing. Raw event-level data is retained by AppsFlyer for up to 24 months in line with their default retention policy; aggregated reports may be retained for longer. Once retention periods expire, the data is deleted or anonymized, provided there are no statutory retention obligations.

10.2.4 Right to object

You have the right to object to the processing of your data. You can inform us of your objection at any time (e.g. by e-mail to kontakt@datapods.app).

10.3 AppLovin (Axon)

Axon is operated by AppLovin Corporation, 1100 Page Mill Road, Palo Alto, CA 94304, USA.

10.3.1 Description and scope of data processing

We use AppLovin's advertising platform Axon to deliver advertisements promoting the Stack App and to measure the performance of these advertising campaigns. For this purpose, AppLovin processes personal data, in particular the mobile advertising identifier (IDFA on iOS where consent has been granted under Apple's App Tracking Transparency framework, or the Google Advertising ID on Android), the IP address, device and operating system information, ad impression and click data, as well as install and in-app event data which we forward to AppLovin via our mobile measurement partner (AppsFlyer) for the purpose of campaign attribution and optimization. On iOS, attribution may additionally take place via Apple's SKAdNetwork.

AppLovin transfers and processes personal data on servers outside the European Economic Area, including the United States. A data processing agreement has been concluded with AppLovin that contains the standard contractual clauses of the European Commission, with which AppLovin undertakes to process personal data in compliance with the GDPR and to guarantee this for its sub-processors as well. Where applicable, transfers may additionally be covered by AppLovin's certification under the EU-U.S. Data Privacy Framework.

Further information on data processing by AppLovin can be found in AppLovin's privacy policy.

We will only collect and forward data to AppLovin in line with your profile settings, which you can change at any time. You are free to consent to this processing or not, and we will process your data based on your consent.

10.3.2 Purpose of processing

The purpose of this processing is to deliver advertisements for the Stack App on AppLovin's advertising network, to measure the performance and attribution of these advertisements, to optimize ad delivery, and to detect ad fraud.

10.3.3 Data retention

Personal data is stored for as long as it is necessary to fulfill the purpose of processing. Once this is no longer necessary, the data is deleted, provided there are no statutory retention obligations.

10.3.4 Right to object

You have the right to object to the processing of your data. You can inform us of your objection at any time (e.g. by e-mail to kontakt@datapods.app).

11. What data is processed for Marketing Activities?

11.1 Raffles and comparable promotions

If you decide to participate in a raffle or a comparable promotion, we will process your data to the extent necessary to run the raffle and determine the winners. You will receive more detailed information in the respective raffle terms and we collect your consent if necessary.

Your participation in a raffle is voluntary and we process your data based on our contractual obligations with regard to running the raffle and, if collected, based on your consent.

11.2 Online Display Advertising and Social Network Advertising

11.2.1 Online Display Advertising

We use different display ad networks, including Google Display Network offered by Google, AppLovin's Axon advertising platform and affiliate networks when showing you ads online outside of Social Networks. Based on the ad network features, we might segment viewers based on data and characteristics provided by the respective ad network.

Additionally and in line with your in app profile settings or based on your consent with regard to cookies and similar technologies, we might also use usage data to show you personalized ads online. In case you reject such personalization based on our data, this will not necessarily have an effect on the amount of advertisements you see from us and this will also not have an effect on ads which are personalized based on data controlled by the respective ad network.

11.2.2 Social Network Advertising

When advertising on Social Networks (for example, YouTube, Facebook, Instagram), advertisers have the option to target specific user groups based on data collected by the respective Social Network or the option to forward encrypted information regarding the advertisers’ customers like email addresses or advertising IDs. The Social Network will then - either on the advertiser’s behalf as a data processor or as data controller with the consent of the relevant user - match the encrypted data with its own data and enable the advertiser to display or also not display ads to the matched Social Network users. Non-matched data will be deleted after a short period of time. We use such features provided by Social Networks to market our Services.

We also use other features provided by Social Network to analyze our campaign efficiency or ad attribution. This is done by sharing limited user information with the respective Social Network which usually includes identifiers provided by the Social Network and relating to its specific users.

In so far your app usage data is used for these purposes, it will be collected by us and will adhere to your profile settings. This means that if you did not consent to tracking for marketing purposes or opted out of it, we will not transfer or use your data for the abovementioned purposes.

Additionally, you can contact us at any time to opt out of personalized advertising on Social Networks based on data we collected on you.

In case you do reject such personalization based on our data, this will not necessarily have an effect on the amount of advertisements you see from us and this will also not have an effect on ads which are personalized based on data controlled by the respective Social Network.

We currently use the following Social Networks for showing you advertisements and to collect information on our campaign performances. To clarify, your data may not necessarily have been processed in connection with even one or all of the following Social Network; this depends on your own use of the respective Social Network as well as on our own different campaigns.

• TikTok

• Facebook

• Instagram

• Youtube

• Snapchat

• LinkedIn

• Reddit

11.3 Conversion Tracking

We process your data (in-app usage data and account information) to better understand the performance of our marketing activities and to provide aggregated statistics and reports to our advertising partners. Additionally, Social Networks also process your data to provide us with information regarding our marketing activities on their platforms.

We process your in-app usage data to create conversion tracking reports based on your consent and you are free to withdraw your consent in your profile settings at any time.

We process your account information to create conversion tracking reports based on our legitimate interest in efficient and cost-saving advertising.

11.4 Marketing Communication

We also process your data to send you marketing communication. For this purpose, we use the information provided by you during your registration, your transaction history and to which of our services and products you have signed up to and how you use them as well as data collected during your use of our app (in so far you consented to our use of in-app usage data). You can object to this processing at any time by contacting us or closing your account.

Additionally, we may also show you personalized commercial in-app notifications based on the personal data mentioned above.

If you use our Services, we may send you product recommendations, surveys or product review requests via email based on the fact that you are an existing customer. If you no longer wish to receive these emails from us, you may opt-out at any time, free of charge, by clicking on the unsubscribe link available in each email, by changing your settings or by reaching out to us.

With regard to push notifications, you can change your preferences any time in your device settings.

The processing of your data for marketing communications, is based on our legitimate interest in direct advertising (especially to existing customers), unless consent is legally required which will then be our legal basis.

12. For how long will my data be stored?

We only process personal data for as long as is necessary to fulfill our contractual and legal obligations or in the relevant context.

12.1 Contractual obligations:

In general, your personal data will only be processed for as long as you have an ongoing contractual relationship with us. To terminate the current User Agreement for the Stack App, you can irrevocably delete your user account or instruct us to do so using the contact details in the Legal Notice. We will then revoke any permissions for APIs to request your data. In addition, we will delete your personal master data and anonymize other user data.

In order to ensure smooth contract execution and processing, prevent misuse of the Stack App, and enable the defense and enforcement of civil law claims within the relevant limitation periods, we pseudonymize certain master data (e.g. primary email address and mobile phone number) using a hash function and retain this data for at least the duration of the statutory limitation periods. The limitation periods can be up to thirty years due to §§ 195 ff. of the German Civil Code; the regular limitation period is three years. Due to the hash function, we can only reconstruct the clear data if it is stored with us again, e.g., to create a new account with an email address that has already been used.

12.2 Legal obligations

In addition, tax, commercial, fiscal, and other statutory retention obligations must be observed. The retention/documentation periods specified therein are six to ten years, plus a further four years for the statute of limitations.

In order not to violate legal regulations or lose the possibility of enforcing a claim or defending ourselves against such a claim, we reserve the right to delete selected data, e.g. about the exercise of data subject rights, only after the expiry of the last period that legitimises data storage.

13. Can I object to the processing of my personal data?

If we process your data for legitimate interests, you can object to this processing on grounds relating to your particular situation. You have the right to object to the processing of your personal data for direct marketing purposes without giving reasons; this also applies to profiling insofar as it is associated with such direct marketing. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the establishment, exercise or defense of legal claims.

To object to the processing of your data, you can permanently and irrevocably delete your account within the Stack App at any time. You can also contact us by email using the contact details provided above to revoke your consent.

14. Where can I lodge a complaint?

If you are of the opinion that the processing of your personal data by us is unlawful or that we are violating data protection law for other reasons, you can complain to the supervisory authority responsible for us:

North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information

P.O. Box 20 04 44, 40102 Düsseldorf, Germany

Telephone: 0211/38424-0

Fax: 0211/38424-10

E-mail: poststelle@ldi.nrw.de

15. Am I obliged to provide my data?

We do not make the conclusion of contracts with us dependent on you providing us with personal data beforehand. As a customer, you are under no legal or contractual obligation to provide us with your personal data; however, we may only be able to provide certain services to a limited extent or not at all if you do not provide the necessary data. If this is the case for the products we offer, you will be informed of this separately.

16. What are my rights as a data subject?

You have the right to:

• to request information as to whether and, if so, which personal data concerning you is being processed, Art. 15 GDPR;

• to request the rectification of inaccurate personal data or the completion of incomplete personal data, Art. 16 GDPR;

• to obtain from us the erasure of personal data concerning you without undue delay, provided that the conditions set out in Art. 17 GDPR are met;

• to demand the restriction of the processing of your personal data, insofar as Art. 18 GDPR provides for this;

• to receive the personal data concerning you in a format that meets the requirements of Art. 20 para. 1 GDPR;

• to data portability under the conditions set out in Art. 20 para. 1 lit. a, b GDPR;

• not to be subject to a decision based solely on automated processing – including profiling – if a decision has only been made in an automated process and this decision significantly affects you. In the event of a rejection, the decision will be reviewed manually by us after you have informed us of your considerations and objections to the decision made in the automated process and requested the manual review, Art. 22 para. 1, 3 GDPR. In addition, you are entitled to view the criteria for the decision.

For requests of this kind, please contact kontakt@datapods.app. Please note that we must ensure that we are actually dealing with the data subject for such requests.

Automated decision-making does not take place in our app.