Privacy Notice for the website, app and game

Last updated: 11 September 2026 • Applies to www.satify.tech, app.satify.tech and game.satify.tech

Data controller

Peter Arlinghaus, Max-Planck Straße 2, 21502 Geesthacht, Germany. Email: info@satify.tech.

Server logs for the app and game

We process technical connection and request data to operate and secure our services. Logs may include IP addresses, request dates and times, requested URLs and query parameters, HTTP methods, response codes and response times. Error logs may also include browser information, referring pages and other request headers. Our legitimate interest is a secure, functioning service (Article 6(1)(f) GDPR). These server logs are automatically deleted within 30 days; storage limits may cause earlier deletion. This period does not apply to accounts, projects, leaderboard entries or usage insights, which are described below.

SATIFY app: Accounts and projects

We process your email address, account identifier, access permissions and authentication data to provide your account. We also store uploaded imagery, labels and project metadata linked to your account so you can use and manage your projects. The legal basis is Article 6(1)(b) GDPR. These data are needed for the requested account and project functions; without them, those functions cannot be provided.

Owned projects remain stored until deleted. Disposable conversion source files are scheduled for deletion after one day and checked hourly; storage pressure may remove them earlier.

You can request closure of your account and deletion of your associated personal data by emailing info@satify.tech. We may request information necessary to verify your identity. We process requests without undue delay and normally respond within one month. Where we must retain particular records because of a legal obligation or another applicable exception, we will explain the reason and retention period.

SATIFY app: Usage insights

We collect pseudonymised tool and display actions, mask selections and settings, user and project identifiers, session identifiers and timestamps to understand and improve the editor. This does not include image or label content, free text, pointer traces or session recordings. Only administrators can access the insights. Events are scheduled for deletion after 180 days during the daily cleanup, or earlier if deleted by an administrator.

We process usage insights on the basis of our legitimate interest in understanding how SATIFY is used and improving its functionality and usability (Article 6(1)(f) GDPR). You may object to this processing on grounds relating to your particular situation by emailing info@satify.tech. We will then stop processing your data for this purpose unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

Contact and feedback

If you contact us by email or through a feedback form on our website, app or game, we process the name, email address and message you provide, together with any attachments, to handle your enquiry and improve our services. Providing an email address in the game’s feedback form is optional; without it, we cannot reply by email. Our legitimate interest is handling enquiries and feedback (Article 6(1)(f) GDPR). For enquiries about entering into or performing a contract with us, the legal basis is Article 6(1)(b) GDPR.

We retain correspondence and attachments while handling the matter and, where needed for related follow-up, for up to 12 months after it is resolved. We then delete them from the mailboxes under our control, unless a legal obligation requires longer retention.

SATIFY -The Game: Leaderboard

If you choose to appear on the leaderboard, we store and publicly display your chosen username and score. We may add a number suffix to distinguish matching usernames. Please choose a nickname rather than your real name. Email is not required for the leaderboard. The legal basis is our legitimate interest in running a game leaderboard and enabling players to compare scores (Article 6(1)(f) GDPR). You can play without appearing on the leaderboard.

We delete leaderboard entries 12 months after submission, or earlier if you request removal by emailing info@satify.tech. You may also object to this processing on grounds relating to your particular situation.

If you optionally provide your email address, we use it to send your final game results with your consent. We send SATIFY news and promotional offers only if you separately select the marketing checkbox. Both email purposes rely on Article 6(1)(a) GDPR. Your email address is not published, and declining either email purpose does not affect participation in the game or leaderboard.

We remove an address used only for results from the active results contact list once final results have been sent, and in any event within 12 months of collection. If you opt into marketing, we keep your address on the active marketing list for up to 12 months after consent, unless you withdraw sooner. You can withdraw either consent at any time by emailing info@satify.tech; marketing emails also contain an unsubscribe link. Withdrawal does not affect the lawfulness of earlier processing. Limited evidence of consent and withdrawal is retained separately as described below.

SATIFY -The Game: contributions

We use the labels created in the game for only calculating the score for the leaderboard. It will immediately be deleted after the score has been computed.

SATIFY app: Cookies and browser storage

We use the satify_sid cookie to maintain your application session and remember your active project. It expires seven days after it is set or renewed. You can remove it through your browser’s site-data settings.

We use local storage to maintain your sign-in and remember interface and editor settings, including your theme, band assignments and label definitions.

Sign-in data is refreshed while your authentication session remains valid. It is removed following successful sign-out, when the application detects an invalid session, or when you clear the app’s browser data.

Stored preferences have no automatic expiry. They remain until overwritten, removed by your browser, or deleted through its site-data settings. Signing out does not remove these preferences.

Clearing browser data may sign you out and reset saved preferences. It does not delete your account or projects stored on our servers.

Service providers

IONOS provides website hosting and email, Hetzner hosts the app and game, and Supabase provides app authentication. Each receives the data needed for its services.

IONOS — main website: IONOS SE, Germany, hosts our MyWebsite/Website Builder website. It processes IP addresses, requested pages, access times, browser and device information and referrers. Our legitimate interests are providing, securing and improving the website (Article 6(1)(f) GDPR). Hosting logs are kept for up to seven days under IONOS’s processing terms. Hosting terms

Built-in IONOS WebAnalytics uses log files or a pixel for statistics and technical optimisation. IONOS states that it anonymises IP addresses immediately after transmission, uses no analytics cookies and retains anonymised Website Builder visitor data for 21 days. We use no additional visitor analytics. IONOS WebAnalytics

Technically necessary Website Builder cookies expire at the end of the browser session. You can also remove them in your browser settings. Website Builder information

Hetzner — app and game: We use Hetzner Online GmbH, Germany, to host our services in Falkenstein, Germany. Server logs are retained for up to 30 days. No Hetzner backups or snapshots are configured. Data processing agreement.

IONOS — email for all services: We use IONOS SE, Germany, for email services, involving email addresses, message contents, attachments and delivery information. IONOS’s email-service terms specify deletion within seven days after we delete the data or the contract ends, and a maximum retention of 28 days for email-service logs. Our own correspondence retention periods are described elsewhere in this notice. Processing terms.

Supabase — app only: We use Supabase Pte. Ltd., Singapore, for account authentication. Our production database and authentication service are hosted in Ireland. Account retention is described in the account section; Supabase’s published API and database log retention for our Free plan is one day. We have not configured additional backups, although Supabase documents maintaining up to seven daily recovery copies for Free projects. Writing authentication audit logs to our project database is disabled.

Supabase and its subprocessors may process personal data outside the European Economic Area. Applicable transfers are covered by the European Commission’s Standard Contractual Clauses incorporated into its data processing agreement. Further information: subprocessors, log retention and backup arrangements.

For privacy requests or a copy of the applicable transfer safeguards, contact info@satify.tech.

Consent and administrative records

Usage-insights exclusions: We keep your account identifier to prevent collection when your account is excluded from usage insights. We delete this exclusion record when the exclusion is lifted or the account is permanently closed. Our legitimate interest is to apply and maintain tracking choices (Article 6(1)(f) GDPR).

Deletion audits and privacy requests: We keep administrative deletion dates, cut-off dates, record counts and a pseudonymised administrator identifier for up to 12 months after the audit entry is created. Our legitimate interest is to verify deletion and investigate errors (Article 6(1)(f) GDPR). We keep the minimum information needed to document a privacy request and our response for up to 12 months after completion, to demonstrate compliance with our duties under Articles 12–22 GDPR (Article 6(1)(c) GDPR). These records do not include copies of the data deleted.

Consent evidence: We keep your email address, the consent wording or version, the purposes selected, consent and withdrawal dates, and the dates of relevant mailings. We retain this limited evidence while relying on that consent and until the end of the third calendar year after the year in which it was last used, withdrawn or expired, whichever occurred last. This demonstrates consent under Articles 5(2) and 7(1) GDPR (Article 6(1)(c)) and supports our legitimate interest in defending legal claims (Article 6(1)(f)). It does not authorise further emails after withdrawal or expiry.

These records have restricted access. Marketing is sent only where current consent exists; we do not keep a separate permanent marketing blacklist. Longer retention of specific records is limited to an applicable legal obligation or an ongoing legal claim, with access restricted to that purpose. You may object to processing based on legitimate interests on grounds relating to your particular situation.

Your rights

Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. To exercise your rights, contact info@satify.tech.

You may lodge a complaint with a data protection supervisory authority, in particular the Independent Centre for Data Protection Schleswig-Holstein (Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein): www.datenschutzzentrum.de, email: mail@datenschutzzentrum.de. We do not make automated decisions that produce legal or similarly significant effects on you.