Privacy information
Controller: Daniel Nemitz, Rheinstraße 68, 41749 Viersen, Germany. Contact: [email protected].
Website and hosting
The website is hosted by Cloudflare. Requests involve technical connection data, particularly IP address, time, URL and browser information. This data is required to provide and secure the website (Article 6(1)(f) GDPR). Cloudflare may also process data outside the EEA. Information on safeguards and retention: Cloudflare privacy policy.
Photos and exports
Image processing takes place entirely in your browser. We do not receive photos, filenames or EXIF data. They remain in memory until you clear the selection or close the page. You manage exported files yourself.
Sign-in and balance
You can select photos without an account. To export, sign in using an email code or Google. In Cloudflare D1, we store your verified email address, Google account identifier where applicable, account mapping, Stripe customer ID, purchase and export records, and subscription periods. Photos and file contents are not stored. The legal basis is the service you request under Article 6(1)(b) GDPR.
Essential Secure/HttpOnly session cookies last for 30 days; the sign-in cookie lasts for 10 minutes. Sign-in codes are stored as hashes incorporating a secret, are valid for 10 minutes and allow at most five verification attempts. Expired codes and sessions are removed during subsequent sign-ins. Essential access is based on Section 25(2) TDDDG. Accounts and purchase records are retained until deletion is requested, unless statutory retention requirements prevent deletion.
We use Resend for sign-in emails, sharing the recipient address and sign-in code, but no photo information. Google sign-in is loaded only at your request and sends technical connection data to Google. We verify the signed identity on the server. These functions remain disabled until the respective provider is configured. Information: Resend privacy policy and Google privacy policy. Providers may process data outside the EEA.
To prevent abuse, sign-in attempts use a hashed IP identifier incorporating a secret and the day, along with counters for limited time windows. No raw IP address is stored in D1 for this purpose. Expired counters are removed during subsequent API calls. The legal basis is our legitimate interest in secure sign-in under Article 6(1)(f) GDPR. No fingerprinting is used. A trial is available once per account; multiple accounts or copied program code cannot be fully prevented.
Optional usage counting
Only after you select ‘Allow usage statistics’ do we send the event types visit, import, export or checkout open to the same web host. The optional statistics store anonymous daily counts only, with no identifiers, IP addresses or file information. The separate essential balance management is described above. The host also receives technical connection data for these requests. The legal basis is consent (Article 6(1)(a) GDPR), which you can withdraw for future processing at any time through ‘Cookie settings’ or on the tool page. Your choice is stored in local browser storage until you withdraw it or delete it. Counts older than 90 days are removed when the next event arrives; without further traffic, they remain until cleanup. The tool remains fully functional without consent.
No advertising scripts are currently loaded and no advertising cookies are set. Consent to usage statistics is not consent to advertising.
Purchases and contact
For available purchases, NEUMEN uses Stripe Checkout with Managed Payments. We send Stripe your verified email address, a technical purchase reference and the selected offer. You enter payment information on Stripe; we do not receive full card details. The legal basis is Article 6(1)(b) GDPR. The terms shown at checkout and the following information also apply: Stripe privacy policy. Payment confirmations are used to manage balances and download access on the server.
If you contact us by email, we process your message to respond and delete it once the matter is resolved, unless statutory retention requirements apply. Photo attachments are not required. Subscription and invoice records may be subject to statutory retention requirements.
Email waitlist
With your express consent, we store your email address, signup time and consent version for the NEUMEN waitlist (Article 6(1)(a) GDPR). Data is stored in Cloudflare D1 in the EU. No emails are currently sent, and ownership of the address is not yet verified. Entries therefore remain marked as unconfirmed. Email confirmation will be set up before any future sending. To withdraw consent and request deletion of your address: [email protected]. Unconfirmed entries older than 180 days are removed at the next successful signup; if there are no further signups, cleanup takes place on request or during the next maintenance. Photos and file contents are not transmitted with the signup.
Waitlist security check
Cloudflare Turnstile loads only when you submit the form, to limit automated signups. Cloudflare processes technical connection and browser data in the process. We do not pass your email address to Turnstile. The check is limited to this form; no advertising or analytics functions are activated. The legal basis is our legitimate interest in protecting the form against abuse (Article 6(1)(f) GDPR). Further information: Cloudflare Turnstile privacy policy.
To limit signup attempts, we use the IP address provided by the Cloudflare host only to generate an identifier tied to a secret and the current day. The raw IP address is not stored in the waitlist database. The temporary identifier and technical time-window counters are removed after expiry when further API requests arrive. They are not linked to the stored email addresses. This is pseudonymous security data, not anonymous usage statistics. Cloudflare’s own technical hosting data is described in the Website and hosting section.
Your rights
You can request access, rectification, erasure, restriction and, where applicable, data portability, and object to processing based on legitimate interests. You can withdraw consent and lodge a complaint with a data protection supervisory authority. For North Rhine-Westphalia: LDI NRW. Anonymous counts cannot be attributed to any individual.
Last updated: 15 September 2026.