Privacy

Draft: to be completed and reviewed before launch.

Last updated: date of publication. This is a translation; the German version applies.

1. Controller

The controller for personal data on this website and in the OkonomiDAM application is Okonomi GmbH, Redentiner Landstr. 29A, 23974 Krusenhagen, Germany, email: andre.lahs@okonomi.gmbh (see legal notice). No data protection officer has been appointed, as none is required.

2. Overview: two roles

For the data we need to run the website and your account (account, contract, billing and log data), we are the controller. This policy describes that processing.

Content that our customers keep in OkonomiDAM (assets, files, descriptions, notes, lists) we process on behalf of the respective customer as a processor (Art. 28 GDPR). The customer is the controller for it; the data processing agreement sets out the details. Please direct questions about such content to the customer whose workspace holds it.

3. Visiting this website

When you visit the website, our server processes technically necessary data: IP address, date and time, requested address, status code, amount of data transferred and your browser's identifier. We need it to deliver the pages and to protect the service against abuse and attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and stable service.

These logs are rotated by size and deleted after 14 days at the latest, unless a specific security incident requires keeping them longer.

The website sets no cookies, uses no analytics, tracking or advertising services and loads nothing from third-party servers. Fonts are served from our own server.

4. Your OkonomiDAM account

When you create an account, we process your name, your email address and your password, which we store only as a hash (Argon2id). In addition, we process the workspaces you belong to and your roles, access tokens you create (stored only as a hash) and the apps and agents you have connected via OAuth. Your name appears with content that you or an agent you connected create, such as editing notes.

The legal basis is Art. 6(1)(b) GDPR (contract). To prevent abuse, we limit sign-in and sign-up attempts per IP address (Art. 6(1)(f) GDPR).

For sign-in, the application sets a session cookie that is valid for at most 30 days and is deleted when you sign out. It is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG). Your chosen language is kept in your browser's storage and not sent to us.

5. Connected AI agents

You can connect AI agents (for example Claude by Anthropic) to OkonomiDAM through the Model Context Protocol or the API. An agent acts with your permissions and receives the data it retrieves. What the agent's provider does with that data is governed by your contract with that provider; it is not our processor. You can see and disconnect connected apps in your account at any time.

6. Plans and billing

For paid plans we process billing data (company, address, contact person, VAT ID, booked plan and storage, invoices and payments) and the usage of your workspace (number of members, storage used on Okonomi Storage). The legal bases are Art. 6(1)(b) and (c) GDPR. Retention obligations under tax and commercial law are up to ten years.

7. Contact and support

When you write to us, we process your details to answer your request (Art. 6(1)(b) or (f) GDPR) and delete them when they are no longer needed.

8. Recipients and processors

We use the following service providers, with whom data processing agreements are in place:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: servers and database in data centers in the EU, currently in Falkenstein (Germany).
• DigitalOcean, LLC, 105 Edgeview Drive, Suite 425, Broomfield, CO 80021, USA: storage for Okonomi Storage and encrypted backups, region Frankfurt am Main. As it is a US company, access from the USA cannot be ruled out; transfers are safeguarded by EU Standard Contractual Clauses and certification under the EU-U.S. Data Privacy Framework (verify).

Where a workspace keeps its files in an S3 bucket the customer connected themselves, that provider's terms apply. We pass data to other third parties only where the law requires us to.

9. Retention

We keep account data as long as your account exists. After an account is deleted or the contract ends, we delete account and workspace data within 30 days, unless statutory retention obligations apply. Encrypted backups are overwritten in a rolling cycle and contain deleted data for at most 7 more days.

10. Security

All connections are encrypted with TLS. Credentials for storage buckets and backups are stored encrypted (AES-256). Passwords and access tokens exist only as hashes.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to andre.lahs@okonomi.gmbh.

You may lodge a complaint with a data protection authority, for example the one responsible for us: Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern, Werderstraße 74a, 19055 Schwerin, Germany.

There is no automated decision-making, including profiling. Name, email address and password are required for an account; without them we cannot provide the service.

12. Changes

We update this policy when the service or the law changes. The version published here applies.