Privacy Policy

Note: This page is a summary of our data processing. The German version is more detailed.

Last updated: September 5, 2026

Controller

Mario Christ
c/o Impressumservice Dein-Impressum
Stettiner Str. 41, 35410 Hungen, Germany
Email: kontakt@unpii.me
Phone: +49 1551 0601763

What data we process

Account data: Email address, session tokens, hashed API keys, usage counters. No passwords are stored - authentication is via magic links or OAuth (Google, GitHub). Legal basis: performance of a contract (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Server logs: IP addresses (pseudonymized/hashed for rate limiting), access timestamps, browser type. Logs are retained for up to 30 days. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

Your text: Text submitted for anonymization is processed in memory only and immediately discarded. It is never stored, logged, or used for training. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for signed-in users; legitimate interests (Art. 6(1)(f) GDPR) for anonymous use. Where a submitted text names a third party, that person is also a data subject under Art. 14 GDPR whom we do not collect data from directly. Individual notice to that person is impossible: we have no way to identify or contact them, and the text exists only in memory and is discarded immediately after the request is answered. We therefore rely on the exemption in Art. 14(5)(b) GDPR and satisfy its safeguard requirement by making this information publicly available through this published privacy policy.

Service providers

  • Hetzner Online GmbH (Germany) - server hosting. Privacy policy. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
  • Resend Inc. (USA) - transactional email (magic link delivery). Privacy policy. Transfer basis: Standard Contractual Clauses. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Cloudflare Turnstile (USA) - CAPTCHA / bot protection. Privacy policy. Transfer basis: Data Privacy Framework (DPF). Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
  • Google (Ireland/USA) - optional OAuth login. Privacy policy. Transfer basis: DPF. Legal basis: performance of a contract (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).
  • GitHub (USA) - optional OAuth login. Privacy policy. Transfer basis: DPF. Legal basis: performance of a contract (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).
  • Sentry (EU region, Frankfurt) - application error tracking. Data is stored exclusively in the EU. IP addresses are dropped before storage; request bodies, cookies, and query strings are filtered out before transmission. Privacy policy. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
  • Payment processing (Merchant of Record) - no paid plans are currently available, so no payment processing takes place and no data is transferred to a processor for this purpose. Once paid plans become available, checkout, payment, invoicing, and refunds will be handled by an external payment processor acting as Merchant of Record (seller of record); the purchase contract for a paid plan is concluded with that provider. The provider is a recipient of the data required to process the order and processes buyers' data for the purchase as an independent controller within the meaning of Art. 4(7) GDPR, under its own privacy policy. Full payment details (e.g. card numbers) will be processed solely by that provider and never visible to us. The provider will be named here, with its address, country of establishment, and privacy policy, before paid plans go live.

Paid plans and payments

Paid plans are sold by an external payment processor acting as Merchant of Record (seller of record); the purchase contract is concluded with that provider, which processes buyers' data for the purchase as an independent controller under its own privacy policy. Full payment details (e.g. card numbers) are processed solely by that provider and are never visible to us. We transmit to the provider the details required to process the order (in particular the selected plan and a pseudonymous transaction identifier) and receive from it the information needed to manage your contract and account, in particular subscription and payment status and a pseudonymous customer/subscription identifier. Contract and subscription data we hold is deleted upon account cancellation; invoicing and tax-related retention obligations lie with the Merchant of Record. Legal basis for the transfer: performance of a contract (Art. 6(1)(b) GDPR).

Cookies

We use only strictly necessary cookies: session cookies for authentication, plus a short-lived cookie (up to 30 minutes) to remember a successful security check for anonymous users. No consent banner is required for these. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

Contact requests

When you contact us (for example by email), we process the information you provide to the extent necessary to answer your request. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

Your rights

Under GDPR you have the right to access, rectify, delete, restrict, or port your data, and to object to processing. You may also lodge a complaint with a supervisory authority.

Supervisory authority:
Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22, 20459 Hamburg
https://www.datenschutz-hamburg.de

Deletion

Account data is deleted upon account cancellation. Encrypted backups are retained for up to 7 days, after which data from deleted accounts is also permanently removed. No statutory retention obligation applies to user data.