Privacy Policy

1. Data Controller

The data controller responsible for processing personal data on this platform is the operator identified in our Legal Notice.

2. Information We Collect & Legal Basis

We process your personal data strictly in accordance with Art. 6 GDPR based on the following legal grounds:

• Server Log Files (Art. 6 (1) lit. f GDPR): To deliver the website to your browser, our web server must briefly process your full IP address. However, to ensure maximum data minimization, your IP address is masked (anonymized) at the server level before it is stored in the so-called server log files. Consequently, the log files only contain the anonymized IP address, along with your browser type and version, operating system, referrer URL, hostname of the accessing computer, and the time of the request. This serves IT security and the flawless delivery of the website (Legitimate Interest).
• Account Registration (Art. 6 (1) lit. b GDPR): To create an account, track ChartPoints (CP), and process bounties, we collect your email, username, and password (Contract Performance).
• Single Sign-On / Social Login (Art. 6 (1) lit. a & b GDPR): If you choose to register or log in using a third-party provider (e.g., Google), we receive necessary profile data (such as your email address and an authentication token) from that provider. We process this data strictly to create and authenticate your account (Contract Performance). You can revoke this connection at any time in your provider's security settings.
• AI-Assisted Text Generation (Art. 6 (1) lit. b GDPR): When you use the auto-generate feature for titles and descriptions, your entered prompt text is transmitted at your request to an external AI model provider and processed there by a Large Language Model (LLM). This is done exclusively to provide the assistance feature you actively requested (Contract Performance).
• Notifications, Email Communication & Support (Art. 6 (1) lit. b & f GDPR): We inform you about system events (e.g., new comments, changes to ChartPoints) via the dashboard and, in the case of important system events (e.g., deadlines for bounties), also via email. You can disable email notifications for system events at any time in your dashboard settings. Sending system-relevant messages (such as account activation and password resets) serves to fulfill our contract with you. If you contact our support (e.g., via our email addresses), we process your request to resolve your issue (Contract Performance or Legitimate Interest). To provide these services, your data is processed by our contracted email service providers (Data Processors).
• Audit Trails & Legal Declarations (Art. 6 (1) lit. c & f GDPR): To comply with our accountability obligations and to defend against potential legal claims, we log legally significant actions and declarations (e.g., agreement to our Terms, email verification, confirmations of authorship, password changes, account deletion). For this purpose, we securely store the specific action, the exact timestamp, your IP address, and your browser's User-Agent (Legal Obligation and Legitimate Interest).
• User Profiles (Art. 6 (1) lit. a GDPR): You may optionally provide additional information on your public profile, such as your resume, skills, or social media links. By actively saving this information, you consent to its public display. You can remove this data and withdraw your consent at any time in your account settings.
• User-Generated Content, Comments & Contributor Feature (Art. 6 (1) lit. b GDPR): When you publish prompts, bounties, or comments, save private bookmarks, or suggest changes to other users' prompts (which is only possible for logged-in users), we store the content, your chosen username, and the timestamp of publication. If your suggestions are accepted, your username will be linked as a contributor on the respective prompt page. This serves to provide the platform and community functions (Contract Performance).

3. Cookies and Local Storage

We exclusively use essential cookies (e.g., session cookies) and Local Storage items that are strictly necessary to keep you logged in and enable core platform functions. According to applicable law, these strictly necessary technical trackers do not require prior consent.

4. Embedded Prompts (Widgets) on External Sites

If you interact with our embedded prompt widgets on third-party websites, data (including your IP address) is only transmitted to our servers after you actively consent to load the contents (Two-Click Solution). We process this data to provide the requested technical service (Art. 6 (1) lit. b GDPR). To remember your choice for future visits, a strictly necessary Local Storage entry ("pc_c") is saved in your browser. You can withdraw your consent by unchecking the auto-load option within the active widget. Doing so will delete the Local Storage entry and reset all active widgets on the page back to their initial state.

5. Sharing & Transfer of Data

We treat your data confidentially. We only share data with third parties if:

• It is required to provide our infrastructure. This includes categories of recipients such as hosting providers, transactional email service providers, AI API providers (LLMs), and email mailbox providers (Data Processors bound by Art. 28 GDPR).
• We are legally obligated to do so (Art. 6 (1) lit. c GDPR).

Note: If we use service providers outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as EU Standard Contractual Clauses (SCCs).

6. Data Retention & Archiving

We keep your personal information only as long as your account is active or as needed to provide our services. Upon account deletion, your profile data is erased. Exceptions: Public contributions (such as published prompts) will be moved to our public archive and permanently anonymized to preserve the community ecosystem. Additionally, we retain audit trails of your given consents and Terms of Service acceptances for up to three years after account deletion to defend against potential legal claims (Art. 17 (3) lit. e GDPR).

7. Your Data Protection Rights

Under the GDPR, you have the following extensive rights regarding your data:

• Right of Access & Rectification: You can request a copy of your data and ask us to correct inaccuracies.
• Right to Erasure ("Right to be Forgotten"): You can request the deletion of your personal data.
• Right to Restriction of Processing: You have the right to request the restriction of processing of your personal data, for example, if the accuracy of the data is disputed or the processing is unlawful.
• Right to Withdraw Consent: Where you have provided consent, you may withdraw it at any time with effect for the future.
• Right to Object: You have the right to object at any time to the processing of your personal data which is based on legitimate interests (Art. 6 (1) lit. f GDPR).
• Right to Lodge a Complaint: You have the right to lodge a complaint with a competent data protection supervisory authority if you believe your data is processed unlawfully.

8. Social Media Buttons

On our website, we use privacy-friendly social media buttons. When you simply visit our website, no personal data is transmitted to the operators of the social media platforms. Only when you actively click on one of the buttons do you consent to the data transfer (including your IP address) to the respective platform operator (Art. 6 (1) lit. a GDPR). From that moment on, the privacy policy of the respective social media provider applies.

9. SSL and TLS Encryption

For security reasons and to protect the transmission of confidential content, such as support requests or login credentials you send to us as the site operator, this website uses SSL or TLS encryption. You can recognize an encrypted connection in your browser's address line when it changes from "http://" to "https://" and the lock icon is displayed in your browser's address bar. If SSL or TLS encryption is activated, the data you transfer to us cannot be read by third parties during transmission.