Privacy Policy

Ferrufino Tech Solutions ("we", "us", "our")
Email: privacy@ferrufino-tech-solutions.com

(Full registered address follows after UG incorporation — see Impressum.)

2.1 Account Data

When you register, we collect your name, email address, and password (managed by our authentication provider, Clerk). This data is necessary for contract performance (Art. 6(1)(b) GDPR).

2.2 Case Data

You create case cards containing observations, root causes, resolutions, and evidence files (images, documents). This is data you choose to store in the platform. Processing is based on contract performance.

2.3 Usage Data

We collect anonymized analytics and error reports (via Sentry) to improve the platform. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

• Clerk — Authentication (USA, EU Standard Contractual Clauses)
• Neon / PostgreSQL — Database hosting (EU region)
• Cloudflare R2 — File storage (EU region)
• Stripe — Payment processing (PCI DSS compliant)
• Sentry — Error tracking (EU data center)
• Resend — Transactional email
• Anthropic — AI features (data not used for training)
• Plausible Analytics — Privacy-friendly website analytics (EU-hosted, no cookies)
• Vercel — Hosting infrastructure

We retain account and case data for as long as your account is active. Upon account deletion, personal data is erased within 30 days. Cases may be anonymized and retained for platform improvement if permitted. Billing records are retained for 10 years per German tax law (§ 147 AO).

You have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Eraseyour data ("right to be forgotten", Art. 17)
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time (Art. 7(3))

To exercise these rights, contact privacy@ferrufino-tech-solutions.com or use the "Delete my account" option in your profile settings.

Where data is processed outside the EU/EEA, we ensure adequate safeguards via EU Standard Contractual Clauses (SCCs) or adequacy decisions.

We use only essential cookies required for authentication and session management. No tracking or advertising cookies are used.

We implement appropriate technical and organizational measures including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews.

You have the right to lodge a complaint with a supervisory authority. The competent authority for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany — www.lda.bayern.de.

We may update this policy from time to time. We will notify registered users of material changes via email.