Privacy Policy

Philipp Rufinatscha ("we," "us," or "our") is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy provides a detailed explanation of how we collect, use, disclose, transfer, and safeguard your personal data when you access or use our services, including our SaaS products and apps such as Confirma.io, Proofolio, and PDFConfirm (collectively, the "Services"). As the umbrella brand for these offerings, Rufinatscha.me serves as the central entity overseeing data processing activities across our portfolio.

We process personal data in strict compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679, as well as other applicable data protection laws in the European Economic Area (EEA) and beyond. Our practices are designed to ensure transparency, accountability, and respect for your rights.

By registering for an account, subscribing to our Services, or otherwise using them, you acknowledge and consent to the data practices outlined here. If you do not agree with this Policy, please refrain from using our Services. We encourage you to review this Policy periodically, as it may be updated.

1. Data Controller

The data controller responsible for determining the purposes and means of processing your personal data is:

As the data controller, we are accountable for ensuring that all processing activities comply with GDPR principles, including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

2. Types of Personal Data We Collect

We collect only the personal data that is strictly necessary to deliver our Services effectively and improve user experience. Collection occurs through direct input (e.g., forms), automated means (e.g., logs), or third-party integrations. Below is a detailed breakdown:

• Account Data: Provided during registration or profile updates, including full name, email address, username, password (hashed), phone number (optional), and any custom profile fields (e.g., company details for billing purposes).
• Billing and Payment Data: Submitted for subscription management, such as billing address, VAT ID, payment method details (e.g., card type, last four digits), and transaction records. Full payment card details are not stored by us but tokenized by our processor.
• Content Uploaded by Users: User-generated or uploaded materials, such as documents, PDFs, images, or portfolios (e.g., certification files in Confirma.io or project assets in Proofolio). This may include metadata like file names, sizes, and timestamps.
• Usage Data: Automatically collected to monitor interactions, including IP address (anonymized where possible), browser type and version, operating system, device identifiers, referral sources, timestamps of actions, session duration, and feature-specific metrics (e.g., number of PDF uploads).
• Log Files: Server-generated records capturing access events, such as request URLs, HTTP status codes, user agent strings, error details, and timestamps, primarily for debugging and security.
• Cookies and Similar Technologies: Identifiers and preferences stored via cookies, pixels, or local storage (detailed in Section 8).

We do not collect special categories of personal data (e.g., data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) unless you voluntarily provide it in uploaded content and it is essential for a specific Service (in which case, we process it only with explicit consent and additional safeguards).

3. How We Use Your Personal Data (Purposes of Processing)

We process your personal data solely for specified, explicit, and legitimate purposes, limiting it to what is necessary. The table below details each purpose, description, and the applicable legal basis under GDPR Article 6:

Any new processing purpose will only occur if compatible with these bases or after obtaining your explicit consent. You can withdraw consent at any time via your account settings or by emailing us.

4. Sharing Your Personal Data

We do not sell, rent, or trade your personal data. Sharing is limited to what is essential for Service delivery, always under strict data processing agreements (DPAs) that enforce GDPR-compliant safeguards. Key third-party processors include:

• Stripe, Inc. (USA): For secure payment processing and fraud detection. We share billing details and transaction data as required for authorizations and settlements.
• Supabase, Inc. (EU servers in Germany): For database management and file storage. We store account, usage, and uploaded content data here, with all processing occurring within the EU.
• Resend, Inc. (USA): For transactional and marketing email delivery. We share email addresses and message content to send communications on our behalf.
• Hetzner Online GmbH (Germany): For web hosting and server infrastructure. Application logs, static files, and backups are hosted here, ensuring EU-based storage.

We may also disclose data to affiliates within the Rufinatscha.me group (all EU-based), professional advisors (e.g., lawyers for disputes), or public authorities in response to valid legal requests. In the event of a merger, acquisition, or asset sale, your data may be transferred as a business asset, with prior notice where possible.

5. International Data Transfers

Most of our processing occurs within the EEA (e.g., via Supabase and Hetzner in Germany), avoiding the need for transfers outside the region. However, for enhanced functionality, we may transfer data to third countries, always with appropriate safeguards under GDPR Chapter V.

• Transfers to the United States: For Stripe and Resend, data is transferred to the US. We rely on:
  • The EU-U.S. Data Privacy Framework (DPF), under which both providers are certified, ensuring adequacy-equivalent protections.
  • Standard Contractual Clauses (SCCs) as a supplementary mechanism, incorporated into our DPAs, with transfer impact assessments (TIAs) confirming additional measures like encryption and access controls.
• Other Transfers: None currently; all EU processors (Supabase, Hetzner) keep data intra-EEA.

You have the right to request details on ongoing transfers, including copies of SCCs (redacted for confidentiality). Transfers are logged, and we notify you of any risks identified in TIAs.

6. Data Retention Periods

Retention is governed by the principle of storage limitation: we hold data only as long as necessary for the stated purposes or legal requirements. Specific retention periods include:

• Account Data: Active during your subscription; retained 30 days post-deletion for recovery, or up to 6 years for tax/commercial disputes.
• Billing Data: 7 years minimum, per EU tax laws (e.g., VAT Directive 2006/112/EC), stored in Supabase.
• Uploaded Content: Indefinitely while your account is active; deleted within 90 days of account termination or upon your erasure request, unless legally retained.
• Usage and Log Data: 12 months for analytics (aggregated after 6 months); security logs retained 6 months.
• Email Data (via Resend): 30 days post-send, unless required for disputes.

7. Your Rights Under GDPR

As a data subject, you benefit from robust GDPR rights, which we facilitate through self-service tools or direct requests:

• Right of Access (Art. 15): Confirm processing and obtain a free copy of your data (e.g., in CSV/JSON format).
• Right to Rectification (Art. 16): Update inaccurate/incomplete data promptly.
• Right to Erasure (Art. 17): Delete data when no longer needed, subject to exceptions (e.g., legal obligations).
• Right to Restriction (Art. 18): Temporarily halt processing during accuracy disputes or while we verify objections.
• Right to Object (Art. 21): Challenge processing based on legitimate interests or direct marketing.
• Right to Portability (Art. 20): Receive/export your data in a structured, interoperable format.
• Right to Withdraw Consent (Art. 7): Revoke at any time, impacting future processing.

To exercise rights, email privacy@rufinatscha.me with verification. For complaints, contact your local supervisory authority or us first for resolution.

8. Cookies and Tracking

Cookies and tracking technologies help us maintain sessions, measure performance, and personalize your experience. We use a cookie consent banner on first visit, categorizing them for your control:

9. Security Measures

Protecting your data is paramount. We implement a multi-layered security program aligned with ISO 27001 principles and GDPR Art. 32, including:

• Technical Controls: End-to-end encryption (TLS 1.3 for transit; AES-256 at rest); regular key rotation; pseudonymization of usage data.
• Organizational Controls: Role-based access (least privilege); multi-factor authentication (MFA) for admin accounts; employee NDAs and annual GDPR training.
• Monitoring and Response: Intrusion detection systems; automated backups (daily, encrypted); vulnerability scanning; breach notification within 72 hours to authorities and affected users if high-risk.
• Third-Party Assurance: Processors (e.g., Stripe's PCI DSS compliance, Hetzner's ISO 27001 certification) are vetted annually.

We conduct Data Protection Impact Assessments (DPIAs) for high-risk processing and privacy-by-design in new features. Report suspected incidents to security@rufinatscha.me.

10. Children's Privacy

Our Services target professionals and are not intended for children under 16 (or higher age per national laws). We do not knowingly collect or process data from minors. If we become aware of such data (e.g., via an upload), we will delete it immediately. Parents/guardians: Contact us to request removal or verification.

11. Contact Us

For questions, rights exercises, or concerns about this Policy or our practices:

We verify requests (e.g., via email link) to prevent unauthorized access and log them for accountability. Expect confirmation within 48 hours and full resolution within 30 days.

12. Changes to This Privacy Policy

We review and may revise this Policy annually or upon material changes (e.g., new processors). Updates will be posted here with the new effective date; significant changes trigger email notifications to registered users. Your continued use post-update implies acceptance. For prior versions, contact us.

Last Updated: September 14, 2025