Privacy Policy.

1. Controller

The controller for data processing on this website within the meaning of Art. 4(7) GDPR is Deam Software GmbH. You can find our address and contact details in our Imprint.

2. Hosting and server logs

This website is hosted on Cloudflare Pages (Cloudflare, Inc., USA), which acts as our processor (Art. 28 GDPR). When you access the website, Cloudflare processes technical access data, including your IP address, requested URL, browser information, and the timestamp of the request. Referring URL data is processed to the extent transmitted by your browser. Cloudflare processes these server log data to deliver the page and defend against attacks, and retains them only as long as necessary for these purposes. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in operating a secure and available website. For data transfers to the USA, Cloudflare relies on the EU-U.S. Data Privacy Framework as well as supplementary EU standard contractual clauses.

For operating our server applications (such as the waitlist) and for sending and receiving email, we also use service providers who process data on our behalf and according to our instructions (Art. 28 GDPR). Where personal data is transferred to the USA in the process, this is based on the EU-U.S. Data Privacy Framework or EU standard contractual clauses.

Our website also instructs your browser to send us a technical report whenever it blocks content under our security policy (Content Security Policy). The report goes to our server at api.deam.com and contains the address of the page, the blocked address, browser information and, for technical reasons, your IP address. We use these reports only to find errors and attacks and delete them as soon as they are no longer needed for that. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure website.

3. Waitlist registration

If you sign up for the waitlist, we process the email address you enter, the plan you opened the form for, the page you submitted it from and the time of signup. To detect typos and misuse, we check whether the domain of your email address can receive email and store that result together with the result of the Turnstile check (see below). Signing up puts you on the waitlist straight away. We then send you a one-time email confirming this, and we let you know as soon as your access is ready. We also use the data to understand which plans and pages generate interest. Legal basis: Art. 6(1)(b) GDPR for the access notification you requested, and Art. 6(1)(f) GDPR for preventing misuse and for demand-oriented product planning. We do not send you advertising on this basis.

The confirmation email also lets you choose to receive launch news and product updates from us by email. We only send these if you open the link in that email and confirm on the page it leads to (double opt-in). We store the time of your confirmation and the version of the wording you agreed to, as proof of your consent. Legal basis: Art. 6(1)(a) GDPR. You can withdraw this consent at any time with effect for the future, for example by replying to one of our emails; your place on the waitlist is not affected. Without this confirmation, we only email you about your place on the waitlist.

You can withdraw your signup at any time, for example by replying to one of our emails or by writing to the email address given in the imprint. We delete the data stored for the waitlist as soon as you unsubscribe or it is no longer required for organizing and notifying you about access; the proof of a withdrawn consent is kept only as long as we may need it to demonstrate that consent. No data is passed to third parties for advertising.

When you open the waitlist form, we use Cloudflare Turnstile in invisible mode to distinguish people from automated submissions. To secure our website, Cloudflare processes browser-side security signals (such as IP address, user agent, TLS characteristics, site key, and page origin) on our behalf. To improve its bot detection, Cloudflare also processes these signals under its own responsibility. We do not transmit email addresses or other form entries to the Turnstile service. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse and protecting our communication channels) and section 25(2) no. 2 TDDDG for the necessary access to the terminal equipment. Further information is available in the Turnstile Privacy Addendum.

4. Demo booking

You can book a product demo on our demo page. The available times and the bookings are managed for us by Cal.com, Inc., USA, as our processor (Art. 28 GDPR). When you open the demo page, your browser requests the available times directly from Cal.com, which transmits technical connection data (in particular your IP address and browser information) and the time zone shown; when you pick a time, Cal.com holds it for you for a few minutes. No cookies are set for this. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in user-friendly appointment booking.

When you book a meeting, Cal.com processes on our behalf your name, your business email address, the number of users you select, any notes, the email addresses of any guests you add, your time zone and the language of the page, and sends the invitation and any reminders or changes by email. We use this data to prepare and conduct the product demonstration. Legal basis: Art. 6(1)(b) GDPR; for the guests you add, Art. 6(1)(f) GDPR, our legitimate interest in including the people you invite. Name, email address and number of users are needed to book; without them we cannot schedule the meeting. Please only add guests who know about it. To a limited extent, such as for security, Cal.com also processes this data for its own purposes as an independent controller; details are in the Cal.com privacy policy at cal.com/privacy.

The demonstration itself takes place as a video call via Zoom, provided by Zoom Communications, Inc., USA, on our behalf (Art. 28 GDPR). Zoom processes the data needed for the call, such as the name you display, connection and device data and, if you turn them on, your audio and video. Legal basis: Art. 6(1)(b) GDPR.

Cal.com and Zoom may process data in the USA; the transfer is based on the EU-U.S. Data Privacy Framework or EU standard contractual clauses. We delete booking data as soon as it is no longer needed for the demonstration and any follow-up, unless statutory retention obligations apply. You can also book an appointment by email.

5. Currency detection

On the pricing page we call Cloudflare's /cdn-cgi/trace endpoint to read the country Cloudflare has already derived from your IP address, so we can suggest a currency for the price display. The request stays on our own domain, the country code is used only in your browser. For this currency detection, we do not store any additional identifier. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in displaying appropriate prices.

6. Cookies and local storage

We set a technically necessary cookie that stores your cookie choice and the version of the notice displayed, and mirror this information in your browser's localStorage. The cookie expires after 180 days. The entry in localStorage likewise contains an expiry date after 180 days. An expired entry is no longer considered on the next visit and is deleted from localStorage.

Some features also keep a setting or your work in your browser's storage so that they work the way you set them: the 12h or 24h time format you choose in the demo booking, the plan and billing period you select on the pricing page, the export format you choose in the notes extractor, the diagram you are editing in the Sankey chart tool (so it survives a reload), and, for the current browser session only, the country code used for the currency display and whether the navigation bar is hidden. These entries stay on your device, are not sent to us and contain no identifier. You can delete them at any time in your browser settings.

This storage is strictly necessary to provide the functions you use; legal basis: section 25(2) no. 2 TDDDG. Only after you enable Analytics may Microsoft Clarity set the cookies, and PostHog the browser storage entries, listed in the cookie settings. Their storage is based on your consent under section 25(1) TDDDG. Analytics stays off unless you accept it; you can refuse it under Customize in the cookie notice and change your choice at any time through Cookies in the footer. We use no advertising or marketing cookies; Clarity sets no advertising cookie on our site either.

7. Web analytics with Microsoft Clarity

With your consent, we use Microsoft Clarity, provided by Microsoft Ireland Operations Limited, to understand how visitors use this website through usage statistics, heatmaps, and session recordings. Microsoft receives this data as an independent controller and, under its terms, also uses it for its own purposes, such as improving its services and for Microsoft Advertising. On our site, advertising storage (ad_storage) is always denied in Clarity, so Microsoft's MUID advertising cookie is not set. Clarity processes technical and interaction data including IP address, browser and device information, timestamps, referring and visited URLs, clicks, scrolling, and pointer movements. Text in form fields is masked and not transmitted; the demo booking is masked in full; on our free tool pages, the tool area that displays the contents of your files is masked in your browser before any transmission, so these contents never reach Microsoft. Clarity is initialized only after you enable Analytics in the cookie settings. Legal basis: section 25(1) TDDDG for access to your device and Art. 6(1)(a) GDPR for subsequent processing. You can withdraw consent at any time through Cookies in the footer. Microsoft may process data in the USA; the transfer to Microsoft Corporation is based on the EU-U.S. Data Privacy Framework and, in addition, EU standard contractual clauses. Most session recordings are stored for 30 days; a limited sample of session recordings and any labeled or favorited sessions for up to 9 months; click and heatmap data for 9 months. Further information is available in the Microsoft Privacy Statement.

8. Product analytics with PostHog

With your consent, we also use PostHog, a service of PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. It shows us which pages are visited and how they are used, where waitlist sign-ups and demo bookings stop, how fast the pages load, and where technical errors occur. For this, PostHog records page views, clicks on links and buttons with their labels, click and scroll heatmaps, repeated and ineffective clicks, the names of individual steps (such as “waitlist submitted” or “demo booked”, never their content), page load times (Web Vitals), technical error messages and session recordings (page layout, clicks, scrolling, pointer movements, technical console messages, and the address and duration of network requests without their content), as well as browser and device information, the time, and visited and referring addresses without the part after “#”. Input fields and the text of the demo booking and the waitlist are masked in your browser, and clicks in them are not captured; our free tools are not recorded at all, nor are their console messages. PostHog receives your IP address for technical reasons, derives only the country from it and does not store the address itself; we create no personal profiles. To recognize your browser, PostHog keeps a random identifier in your browser's local storage (ph_…_posthog) and further entries in its session storage, which are deleted when you close the tab.

The data is stored in PostHog's EU region in Frankfurt am Main (Amazon Web Services). PostHog processes it as our processor under Art. 28 GDPR. Where PostHog Inc. accesses data from the USA, this is based on the EU-U.S. Data Privacy Framework and, in addition, EU standard contractual clauses. Events are kept for up to 1 year, session recordings for up to 30 days.

The legal basis is section 25(1) TDDDG for access to your device and Art. 6(1)(a) GDPR for the subsequent processing. You can withdraw your consent at any time through Cookies in the footer; PostHog then stops at once and its storage in your browser is deleted. Further information is available in the PostHog Privacy Policy.

9. Free browser tools

The file tools on this website process the files you select locally in your browser using WebAssembly. For this processing, the files are not uploaded to our servers. Technical access data when opening the tool pages and any activated web analytics are distinct from this processing. Information on this can be found in sections 2 and 7.

10. Data security

We implement technical and organizational measures tailored to the risks of the respective processing. They serve in particular to protect personal data against unauthorized access, loss, alteration, and unlawful disclosure.

11. Your rights

Subject to statutory requirements, you have the right to access your personal data, rectification, erasure, restriction of processing, and data portability under Art. 15 to 18 and Art. 20 GDPR.

You can withdraw any consent granted at any time with effect for the future. The lawfulness of processing carried out prior to withdrawal remains unaffected.

Right to object under Art. 21 GDPR: Where your data is processed based on legitimate interests, you can object at any time for reasons arising from your particular situation. You can object to processing for direct marketing at any time without giving reasons.

To exercise your rights, you can reach us via the contact options listed below. We will inform you without undue delay, generally within one month, of the actions taken on your request. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. If statutory conditions for extending the deadline apply, we will notify you of the extension and reasons within that month.

12. Right to lodge a complaint with a supervisory authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law. You can exercise this right in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement.

13. Contact and privacy questions

If you have questions about data protection, support inquiries, or wish to exercise your rights, you can reach us by email or post. We process your details to handle and respond to your request based on Art. 6(1)(b) GDPR (for contractual and pre-contractual requests), Art. 6(1)(c) GDPR (for fulfilling statutory data subject rights), or Art. 6(1)(f) GDPR (for handling general requests). We delete your details once your request has been fully dealt with, unless statutory retention obligations apply. You can find our address and contact options in our Imprint.