Privacy at GreetGen

Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

In short

GreetGen creates greeting cards with AI. To do that I sign you in with your Google account, store your cards and send your input to an AI model from Google. Payments run through Stripe.

The site has no ads and no third-party analytics scripts. There is no profiling and no automated decision with legal effect. Fonts and libraries come from the same server as the page.

When you open the site

When you open the site, your browser sends details without which it cannot be delivered: IP address, date and time, the requested address, the page you came from (referrer) and the browser identifier.

The site is hosted at Netlify, with Cloudflare in front. Cloudflare encrypts the connection, blocks attacks, caches content and produces aggregated traffic statistics (Cloudflare Web Analytics, without cookies). When checking for automated access, Cloudflare may set a cookie called cf_clearance that marks the visit as harmless.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest: delivering the site securely and reliably and seeing how often it is opened. The cookie is strictly necessary for protection (section 25(2) no. 2 TDDDG). How long the providers keep their logs follows their own terms.

Netlify, Inc.

101 2nd Street, San Francisco, CA 94105, USA

Data may be transferred to the USA. Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Cloudflare, Inc.

101 Townsend St., San Francisco, CA 94107, USA

Data may be transferred to the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Storage in your browser

GreetGen keeps in your browser: the language you chose, your sign-in (session data from Supabase) and, if you adopt a demo card, its settings until you have signed in. This is needed for the site to work the way you use it (section 25(2) no. 2 TDDDG; Art. 6(1)(b) GDPR).

Language and session stay until you delete them or sign out; the demo settings disappear when you close the tab.

Sign-in and account

You sign in with your Google account. Through Supabase I receive your email address and an identifier; I never see your password. In your profile I store email address, identifier, credit balance and the number of your cards.

The legal basis is Art. 6(1)(b) GDPR (using the service). The data stays until you have your account deleted. Supabase (Singapore) runs sign-in, database and storage; the transfer relies on standard contractual clauses. The database also counts anonymously how many accounts and cards exist; these counters contain no personal data.

Supabase Pte. Ltd.

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, Singapore

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Your cards and the community

For each card I store recipient name, occasion, age, style, your text and the finished image. By default only you see it. If you explicitly publish a card to the community, other signed-in users can see, rate and report it. Such cards can contain names and details about the person receiving it; enter only what you may share.

I store reports and blocks together with your identifier to limit abuse. Reported cards are hidden once they reach a certain number of reports. The legal basis is Art. 6(1)(b) GDPR, for reports and blocks (f) (protecting the community). The data stays until you delete the card or your account.

Supabase Pte. Ltd.

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, Singapore

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

AI features

When you have text or images generated or changed, your input goes to Google's Gemini API: recipient name, occasion, age, style, your text wishes and, when editing a card, the existing card image. The call runs through my server; the key is not in your browser. You do not upload photos of yourself to GreetGen.

According to Google's terms, within the European Economic Area the rules of the paid tier also apply to the free tier: inputs are not used to train the models. Still, do not enter health data or other particularly sensitive details into the text fields.

The legal basis is Art. 6(1)(b) GDPR. Apart from being part of your card, I do not keep the input.

Google LLC

1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

Buying credits

You buy credits through Stripe. I send you to Stripe's payment page and pass on your identifier so the credits land on the right account. You enter payment details only at Stripe; I do not receive them. From Stripe I get the confirmation of the purchase.

The legal basis is Art. 6(1)(b) GDPR, for keeping invoice data Art. 6(1)(c) GDPR (statutory retention periods).

Stripe Payments Europe, Ltd.

1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

When you write to me

If you email me, I process your address, the content and the timestamps of the message to reply. Cloudflare (Email Routing) receives the contact address and forwards it to my mailbox at goneo.

The legal basis is Art. 6(1)(b) GDPR if your request concerns an account or a purchase, otherwise (f). I delete the message once your matter is settled, unless statutory retention duties require longer.

Cloudflare, Inc.

101 Townsend St., San Francisco, CA 94107, USA

Data may be transferred to the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; the legal basis is the European Commission’s adequacy decision (Art. 45 GDPR).

Provider’s privacy policy

goneo Internet GmbH

Dresdener Straße 18, 32423 Minden, Germany

Provider’s privacy policy

Deleting your account

The web app has no button for this. Write to me at the address above and I will delete your account and all related data: profile, cards with their images, ratings and purchase log. Invoice data I must keep stays for the statutory period.

Links to other sites

Links to GitHub, the App Store or Buy Me a Coffee are ordinary links. Your browser connects to the target only when you click one; the privacy policy of that provider applies there.

Your rights

You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests (Art. 21). An email to the address above is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live.