This policy explains which personal data Clipline processes, why, and what rights you have under the General Data Protection Regulation (GDPR).
Clipline is run by Philippe Rödlach, Münchner Straße 134, 6100 Seefeld in Tirol, Austria, as a sole trader. E-mail: [email protected]. A data protection officer is not required and has not been appointed.
When you open a page, the server processes your IP address, the requested address, date and time, and your browser's user agent to deliver the page and protect the service against abuse (Art. 6(1)(f) GDPR). The web server keeps no access logs. Error messages, which can contain your IP address, are kept in a log of limited size that newer messages overwrite and that is emptied with every update of the service. The application's error log is deleted after 14 days.
The website loads no fonts, scripts or images from third parties and uses no analytics or advertising. It sets only cookies that are strictly necessary: a session cookie and a CSRF protection cookie, and after sign-in a cookie that keeps you signed in. These do not require consent (§ 165(3) TKG 2021).
If you send the form on the start page, I store your name, e-mail address, and the company, plan, number of users and message you entered, and when you agreed, to answer your request and set up a trial (Art. 6(1)(a) and (b) GDPR). I receive the request by e-mail; if that e-mail can't be delivered, it reaches me as a push notification through my own ntfy server (ntfy.roedlach.tirol) instead. The request is deleted after 180 days at the latest. You can withdraw your consent at any time by e-mail; this does not affect processing that took place before.
Account. Name, e-mail address, password hash, optional profile photo, team memberships and, if enabled, two-factor authentication secrets, to provide the service (Art. 6(1)(b) GDPR). Deleted when you delete your account; deleting the account also ends your running sessions.
Clipboard entries and files. Text you add is kept in a cache (Redis), not in the database, for 15 minutes and then deleted; uploaded files are deleted from disk after 60 minutes. Their content is not looked at. For teams, the customer is the controller for this content and Clipline processes it on their behalf (Art. 28 GDPR); a data processing agreement is available.
Sessions. Starting a session stores the session code, its owner and its expiry time.
Billing. For paid plans: name, billing address, VAT ID if any, and invoices, kept for seven years as required by § 132 BAO (Art. 6(1)(c) GDPR).
Clipline runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in the EU. Hetzner processes data on my behalf under a data processing agreement (Art. 28 GDPR).
E-mails (for example password resets, team invitations and answers to contact requests) are sent through Mailgun Technologies, Inc., a Sinch company based in the USA, using its EU region, so the messages are processed and stored in data centres in the EU. Mailgun processes data on my behalf under a data processing agreement. Because Mailgun is a US company, access from the USA cannot be ruled out; such transfers are covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Apart from this, no data is transferred to countries outside the EU/EEA.
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). Write to [email protected]. You can also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, https://www.dsb.gv.at) or the authority in your EU country.