Privacy Policy

1. An overview of data protection

General

The following gives a simple overview of what happens to your personal information when you visit this website. Personal information is any data with which you could be personally identified. Detailed information on the subject of data protection can be found in this privacy policy below.

Data collection on this website

Who is responsible for the data collection on this website?

The data collected on this website is processed by the website operator. The operator’s contact details can be found in the section “Notice concerning the party responsible for this website” below.

How do we collect your data?

Some data is collected when you provide it to us. This could, for example, be data you enter on a contact form or when registering for our newsletter.

Other data is collected automatically or after your consent by our IT systems when you visit the website. This is primarily technical data such as the browser and operating system you are using or when you accessed the page. This data is collected automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to ensure the proper functioning of the website. Other data can be used to analyse how visitors use the site.

What rights do you have regarding your data?

You always have the right to request information about your stored data, its origin, its recipients, and the purpose of its collection at no charge. You also have the right to request that it be corrected or deleted. If you have given your consent to data processing, you can revoke this consent at any time. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data, as well as the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time using the address given in the legal notice if you have further questions about the issue of privacy and data protection.

2. Hosting

External hosting

This website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit this website, STRATO’s servers automatically collect and store technical information in server log files. Details can be found in the “Server log files” section.

The use of STRATO is based on Art. 6 (1) (f) GDPR. We have a legitimate interest in the reliable presentation of our website. A data processing agreement (DPA) has been concluded with STRATO to ensure compliance with data protection requirements.

3. General information and mandatory information

Data protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data as confidential and in accordance with the statutory data protection regulations and this privacy policy.

If you use this website, various pieces of personal data will be collected. Personal information is any data with which you could be personally identified. This privacy policy explains what information we collect and what we use it for.

Please note that data transmitted via the internet (e.g. via email communication) may be subject to security breaches. Complete protection of your data from third-party access is not possible.

Notice concerning the party responsible for this website

The party responsible for processing data on this website is:

TBIT DESIGN
Thomas Breher
Pappelallee 7
26122 Oldenburg
Germany

Phone: +49 441 30421914
Email: info@tbitdesign.com

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (names, email addresses, etc.).

Storage duration

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for which it was collected no longer applies. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g. tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.

General information on the legal basis for data processing

If you have consented to data processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR if special categories of data are processed pursuant to Art. 9 (1) GDPR. If processing is necessary for the performance of a contract or for pre-contractual measures, the data processing is based on Art. 6 (1) (b) GDPR. Furthermore, we process your data if this is necessary to fulfil a legal obligation on the basis of Art. 6 (1) (c) GDPR. Data processing may also be carried out on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR.

Revocation of your consent to the processing of your data

Many data processing operations are only possible with your express consent. You may revoke your consent at any time. The legality of the data processing carried out before the revocation remains unaffected by the revocation. An informal email making this request is sufficient.

Right to object to data collection in special cases (Art. 21 GDPR)

If data processing is carried out on the basis of Art. 6 (1) (f) GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.

Right to file complaints with regulatory authorities

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority. The competent supervisory authority is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover, Germany
Phone: +49 511 120-4500
Email: poststelle@lfd.niedersachsen.de
Website: https://www.lfd.niedersachsen.de

Right to data portability

You have the right to have data which we process based on your consent or in fulfilment of a contract automatically delivered to yourself or to a third party in a standard, machine-readable format. If you require the direct transfer of data to another responsible party, this will only be done to the extent technically feasible.

Information, correction and deletion

Within the framework of the applicable legal provisions, you have the right to free information about your stored personal data, its origin, recipients and the purpose of data processing at any time, and, if applicable, a right to correction or deletion of this data. You can contact us at any time at the address given in the legal notice if you have further questions on the subject of personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time at the address given in the legal notice. The right to restriction of processing exists in the following cases:

If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the review, you have the right to request the restriction of the processing of your personal data.
If the processing of your personal data was/is carried out unlawfully, you can request the restriction of data processing instead of deletion.
If we no longer need your personal data, but you need it for the exercise, defence or assertion of legal claims, you have the right to request restriction of the processing of your personal data instead of deletion.
If you have lodged an objection pursuant to Art. 21 (1) GDPR, a balancing of your and our interests must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, such data may – apart from being stored – only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or a Member State.

SSL or TLS encryption

This site uses SSL or TLS encryption for security reasons and for the protection of the transmission of confidential content, such as the inquiries you send to us as the site operator. You can recognise an encrypted connection in your browser’s address line when it changes from “http://” to “https://” and the lock icon is displayed in your browser’s address bar.

If SSL or TLS encryption is activated, the data you transfer to us cannot be read by third parties.

Payments

Payments are not taken on this website. Paid licences are sold and invoiced by Freemius, Inc. as our merchant of record, and your payment details are entered at their checkout, over an encrypted connection, and processed by them. See section 8 for details.

Opposition to promotional emails

We hereby expressly prohibit the use of contact data published in the context of website legal notice requirements with regard to sending promotional and informational materials not expressly requested. The website operator reserves the right to take specific legal action if unsolicited advertising material, such as email spam, is received.

4. Data collection on this website

Cookies

This website uses cookies. Cookies are small text files that are stored on your device and saved by your browser. They do not harm your device and do not contain viruses.

Cookies which are necessary to allow electronic communications or to provide certain functions you wish to use are stored pursuant to Art. 6 (1) (f) GDPR and § 25 (2) TDDDG (German Telecommunications Digital Services Data Protection Act). The website operator has a legitimate interest in the storage of technically necessary cookies to ensure an optimised service provided free of technical errors.

Other cookies (such as those used to analyse your surfing behaviour) are only stored with your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can revoke this consent at any time.

You can configure your browser to inform you about the use of cookies so that you can decide on a case-by-case basis whether to accept or reject a cookie. Alternatively, your browser can be configured to automatically accept cookies under certain conditions or to always reject them, or to automatically delete cookies when closing your browser. Disabling cookies may limit the functionality of this website.

Server log files

The hosting provider of this website (STRATO) automatically collects and stores information that your browser automatically transmits in “server log files”. These are:

Browser type and browser version
Operating system used
Referrer URL
Host name of the accessing computer
Time of the server request
IP address

These data will not be combined with data from other sources.

The collection of this data is based on Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website – the server log files must be collected for this purpose.

Contact form

Should you send us questions via a contact form on this website, we will collect the data entered on the form, including the contact details you provide, to answer your question and any follow-up questions. We do not share this information without your permission.

The processing of this data is based on Art. 6 (1) (b) GDPR if your request is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR), if this has been requested.

We will retain the data you provide on the contact form until you request its deletion, revoke your consent for its storage, or the purpose for its storage no longer pertains (e.g. after fulfilling your request). Any mandatory statutory provisions, especially those regarding mandatory data retention periods, remain unaffected.

Enquiry by email

If you contact us by email, your enquiry including all resulting personal data (name, enquiry) will be stored and processed by us for the purpose of handling your request. We will not share this data without your permission.

The data sent by you to us via email will remain with us until you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies. Mandatory statutory provisions – in particular retention periods – remain unaffected.

Leaving comments on this website

If you use the comment function on this site, the time at which you created the comment and your email address will be stored along with your comment, as well as your username, unless you are posting anonymously.

Storage of the IP address

Our comment function stores the IP addresses of those users who post comments. Since we do not check comments on this site before they go live, we need this information to be able to pursue action for illegal or slanderous content.

Subscribing to the comment feed

As a user of this site, you can sign up to receive the comment feed. Your email address will be checked with a confirmation email. You can unsubscribe from this function at any time by clicking the link in the emails. The data provided when you subscribed to the comments feed will then be deleted, but if you have submitted this data to us for other purposes or elsewhere (such as subscribing to a newsletter), it will be retained.

How long comments are stored

The comments and the associated data (e.g. IP address) are stored and remain on this website until the content commented upon has been completely deleted or the comments are required to be removed for legal reasons.

Legal basis

The comments are stored based on your consent per Art. 6 (1) (a) GDPR. You may revoke your consent at any time with future effect. An informal email making this request is sufficient. The data processed before we receive your request may still be legally processed.

Processing of data (customer and contract data)

We collect, process and use personal data only insofar as it is necessary to establish, or modify legal relationships with us (master data). This is done based on Art. 6 (1) (b) GDPR, which allows the processing of data to fulfil a contract or for measures preliminary to a contract. We collect, process and use your personal data when accessing our website (usage data) only to the extent required to enable you to access our service or to bill you for the same.

Collected customer data shall be deleted after completion of the order or termination of the business relationship. Legal retention periods remain unaffected.

Data transferred when signing up for services and digital content

We transmit personally identifiable data to third parties only to the extent required to fulfil the terms of your contract with us, for example, to Freemius, Inc., which sells and invoices paid licences as our merchant of record (see section 8).

Your data will not be transmitted for any other purpose unless you have given your express permission to do so. Your data will not be disclosed to third parties for advertising purposes without your express consent.

The basis for data processing is Art. 6 (1) (b) GDPR, which allows the processing of data to fulfil a contract or for measures preliminary to a contract.

5. Social media

Social share buttons (Elementor)

This website uses social share buttons provided by the Elementor page builder. These buttons allow you to share content from this website on social networks such as Facebook, X (formerly Twitter), LinkedIn and others.

These share buttons are implemented as simple links. They do not establish a direct connection between the social networks and visitors to this website when the page is loaded. No data is transmitted to the social network operators until you actively click on one of the share buttons. When you click a share button, you will be redirected to the respective social network, which may then collect data in accordance with its own privacy policy.

We have no influence on the nature and scope of data collected by the social network operators. For information about the purpose and scope of data collection and its processing by the social network operators, please refer to the privacy policies of the respective networks.

6. Newsletter

Newsletter data

If you would like to receive our newsletter, we require a valid email address as well as information that allows us to verify that you are the owner of the specified email address and that you agree to receive this newsletter. No additional data is collected or is only collected on a voluntary basis. We use this data to send the requested information and for nothing else.

You are added to the list only after you have confirmed your subscription by clicking the link in a confirmation email. The times of your registration and of that confirmation are recorded together with the IP addresses used, so that we can demonstrate the subscription if we are ever asked to.

Sending (MailPoet)

The newsletter is managed with the MailPoet plugin inside this WordPress installation. Your address is stored in the database of this website. The emails themselves are delivered through the MailPoet Sending Service, operated by Automattic, Inc., 60 29th Street #343, San Francisco, CA 94110, USA. To send a message, your email address and the content of that message are transmitted to this service. Automattic is therefore a processor acting on our instructions, and the transfer to the USA is part of that. How Automattic handles the data, and on what basis it transfers it, is set out in its own privacy policy at automattic.com/privacy.

What we do not measure in a newsletter

Our newsletters carry no tracking pixel and no rewritten links. We do not record whether a message was opened or which link was clicked, and nothing is stored on your device if you visit this website afterwards. What we do keep is what sending itself produces: whether an address could not be delivered to, and whether someone unsubscribed.

We process the data you enter only with your consent per Art. 6 (1) (a) GDPR. You can revoke it at any time with future effect, for example through the “unsubscribe” link in every newsletter. The data processed before we receive your request may still be legally processed.

The data provided when registering for the newsletter will be used to distribute the newsletter until you cancel your subscription, at which point it will be deleted. Data we have stored for other purposes remains unaffected.

7. Plugins and tools

Fonts

The fonts used on this website are delivered from our own server. No connection to Google Fonts or to any other external font service is established when you open a page, and no font provider learns your IP address.

Icons (Font Awesome)

The icons on this website come from the Font Awesome icon set, provided by Fonticons, Inc. They are not loaded from the Font Awesome servers: they are part of this installation and are delivered from our own server as inline graphics. Your browser therefore makes no request to Fonticons, and no data reaches them when you visit this website.

YouTube

We embed YouTube videos on the pages that describe our tools and extensions. YouTube is operated by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Nothing is loaded from Google while the page is loading. The preview image you see is served from our own server, and the player is fetched only when you start a video. Until you do, YouTube learns nothing about your visit.

When you start a video, a connection to the YouTube servers is established and YouTube is informed which of our pages you are on. We use the extended data protection mode, so no cookie is stored on your device until playback begins. If you are logged into your YouTube account, YouTube can associate your viewing behaviour directly with your personal profile; you can prevent this by logging out of your YouTube account.

The use of YouTube serves the appealing presentation of our offering and constitutes a legitimate interest pursuant to Art. 6 (1) (f) GDPR. If a corresponding consent has been requested, the processing takes place exclusively on the basis of Art. 6 (1) (a) GDPR.

Further information about handling user data can be found in the data protection declaration of YouTube under https://policies.google.com/privacy.

Content delivery network (bunny.net)

Images and other static files on this website are delivered through the content delivery network of BunnyWay d.o.o. (“bunny.net”), Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia. Instead of coming from our own server, those files are served from a server close to you, which is what makes the pages load quickly.

When your browser fetches such a file, bunny.net receives your IP address, the address of the file requested, the referring page and your browser identification. It keeps that in a log for a short period in order to deliver the file, to recognise attacks and to bill us for the traffic. No cookie is set for this, and the content of the files is not evaluated.

The provider is established in the European Union, so this involves no transfer to a third country. The use of a content delivery network is based on Art. 6 (1) (f) GDPR: we have a legitimate interest in a website that is fast and reliably reachable. A data processing agreement is in place with bunny.net.

Firewall and security tools

This website uses firewall and security measures to protect the site itself and its visitors from malware, viruses, hacking attempts and other threats. These may store IP addresses in a local database on our own servers. This is necessary to block malicious hosts and IP addresses from accessing the website. No data is transmitted to third parties.

The use of firewall and security measures is based on Art. 6 (1) (f) GDPR. We have a legitimate interest in protecting our website and its visitors from security threats.

Reach measurement (Independent Analytics)

We measure how this website is used with Independent Analytics. The plugin runs inside this WordPress installation, so there is no external analytics service involved and nothing is handed to a third party.

When a page is opened, this is recorded: which page it was, which page you came from, the type of device, the browser and the operating system, the country and region your IP address points to, and the time. Your IP address itself is not stored. So that a second page view within one visit can be told apart from a new visitor, a short value is calculated from your IP address, your browser identification and a secret that this website changes regularly. That value is stored in place of the address and cannot be turned back into it.

No cookie is used for this and nothing is written to your device, so you are not recognised from one day to the next and you are not followed to any other website. We use the result to see which pages are read and which are not. We build no profiles, we run no advertising, and this data is not combined with anything else we hold.

The legal basis is Art. 6 (1) (f) GDPR: we have a legitimate interest in knowing how our website is used so that we can improve it. Because no information is stored on or read from your device, consent under § 25 TDDDG is not required. You may object to this processing at any time using the contact details in the legal notice.

Reach measurement in the editor at wunderpaint.com

WunderPaint can also be used directly in the browser at wunderpaint.com, without installing anything. That editor is ours, it runs on our own server, and this privacy policy covers it as well.

To find out whether the editor is used at all, it counts a small number of events: that the editor finished starting, that a file was exported, that one of the studios was opened and which one, which interface language was in use, and whether it was started from an installed app icon rather than a browser tab. Nothing else is recorded, and what you create never leaves your browser.

Only daily totals are kept, for example fourteen starts and four exported files on a given day. No cookie is used for this, nothing is written to or read from your device, and no identifier is assigned to you. Two visits by the same person therefore cannot be told apart: we can count starts, not people, and we do not try to.

Your IP address is used once, in memory, so that a single connection cannot write these counters without limit. It is hashed immediately and never stored. The legal basis is Art. 6 (1) (f) GDPR: we have a legitimate interest in knowing whether the service is used and in protecting it from abuse. Because nothing is stored on or read from your device, consent under § 25 TDDDG is not required.

What this website does not use

For the sake of clarity: apart from the reach measurement described above, which runs on our own server, this website uses no external analytics and no advertising network. There is no Google Analytics, no Google Ads or AdSense, no Meta pixel, no heat mapping and no A/B testing service. We do not profile our visitors, and no advertising cookie is set. Apart from the content delivery network described above, everything a page loads on its own comes from our own domain, the fonts, the icons and the video preview images included. Until you click something, no request leaves for anyone else.

8. Purchases and licences (Freemius)

Merchant of record

Paid licences for WunderPaint Pro and for paid extensions are not sold by us directly. They are sold through Freemius, Inc., acting as our authorised reseller and merchant of record. Freemius operates the checkout, issues your invoice, collects and remits VAT where applicable, and manages your subscription and its renewal.

At the Freemius checkout you enter your name, your email address, your billing address, where applicable your VAT identification number, and your payment details. Your payment details are processed by Freemius and its payment providers; we never receive them. We receive the order data we need in order to identify you as a customer, to provide support and to meet our own bookkeeping obligations.

The legal basis is Art. 6 (1) (b) GDPR, processing for the performance of a contract. Freemius is based in the USA; how it processes your data, including that transfer, is set out in its own privacy policy at freemius.com/privacy.

Licence activation from your own website

WunderPaint Pro runs on your own server. To unlock the paid features it activates its licence against the Freemius service (api.freemius.com). What is transmitted is the licence key, the address of the website the licence is being used on, and the version of the plugin and of WordPress. After activation the plugin checks about once a day whether the licence is still valid and whether an update is available.

No image, no design and no content from your website is transmitted in the process. The free plugin contains no licensing code at all and contacts neither us nor Freemius.

What the plugin itself contacts

Some features call an external service from your own installation, or from the browser of the person using the editor: the extension catalog on our delivery server; the stock photo services Pexels, Pixabay and Unsplash; the AI providers Google Gemini, OpenAI, Anthropic and Meshy, each only once you have entered an API key of your own; OpenStreetMap for address and map lookups; Hugging Face for the one-time download of the local AI models; Google Fonts if you download additional families; and any feed or data source you point a dynamic layer at. Those calls happen on your installation and not on this website, so for them you are the controller, not us. Every one of them is documented, with the exact data it transmits and what triggers it, in the external services reference and in the “External Services” section of the plugin readme.

9. Contact

If you have questions regarding this privacy policy, please contact us:

TBIT DESIGN
Thomas Breher
Pappelallee 7
26122 Oldenburg
Germany

Email: info@tbitdesign.com