Privacy Policy

How editkraft.com and the Editkraft studio process personal data under the EU General Data Protection Regulation (GDPR).

1. Controller

Nolte Nußbaum Digital GbR
Panoramastr. 82, 73207 Plochingen, Germany
Partners: Daniel Nolte, Felix Nussbaum
Email: hi@editkraft.com

We are not required to appoint a data protection officer under § 38 BDSG (German Federal Data Protection Act).

2. Scope

This policy applies to editkraft.com including its subdomains, in particular studio.editkraft.com (the Editkraft studio). Externally linked websites are governed by their own privacy policies.

3. Hosting & server logs

When you visit the website, our hosting provider automatically processes: IP address, date and time, requested URL, referrer, user agent and HTTP status code. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).

Hosting provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Transfers to the USA are based on Standard Contractual Clauses and Vercel's certification under the EU-U.S. Data Privacy Framework. Server logs are deleted or anonymized after 30 days at the latest, unless a security incident requires longer retention.

4. Cookies

The Editkraft studio only sets technically necessary login and session cookies (Supabase Auth), without which signing in is not possible. Legal basis: § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6(1)(b) GDPR.

The marketing site editkraft.com sets the following cookies:

You can change or withdraw your choice at any time via "Cookie settings" in the footer. No tracking, marketing or profiling cookies are used, and no cookie data is shared with third parties.

5. Contact form

If you contact us via the form at editkraft.com/contact, we process your name, email address and the content of your message in order to handle your inquiry and, where applicable, to prepare a contract. The legal basis is Art. 6(1)(b) and (f) GDPR. The data is deleted once your inquiry has been fully handled, unless statutory retention obligations (6–10 years under the German Commercial Code (HGB) and Fiscal Code (AO)) require otherwise.

6. Email delivery (Resend)

We use Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA as a processor to deliver form messages. Processed data: email address, message content and delivery metadata (status, timestamps). The legal basis is Art. 6(1)(b) and (f) GDPR; transfers to the USA are based on Standard Contractual Clauses, and a data processing agreement pursuant to Art. 28 GDPR is in place.

7. Studio account (registration)

When you register for the Editkraft studio, we process your email address and authentication data (magic link or Google OAuth) as well as the organization and website metadata you create. The purpose is providing the service; the legal basis is Art. 6(1)(b) GDPR (performance of a contract). Our processor for database and authentication is Supabase, Inc. (San Francisco, USA); transfers are based on Standard Contractual Clauses. The content of websites edited with Editkraft is stored in the customer's own Supabase instance and is not stored by us.

8. Payment processing (Stripe)

Paid subscriptions are processed via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). Stripe processes your name, email address, billing address, VAT ID (if provided) and payment details; full payment details never reach our systems. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR for retention obligations under commercial and tax law (6–10 years under HGB/AO).

9. Fonts

Fonts are self-hosted (next/font). No requests are made to external font services at runtime; no IP address is transmitted to third parties for font delivery.

10. Web analytics

We do not use any web analytics services, tracking pixels, advertising networks or social media plugins.

11. Recipients & third-country transfers

Data is shared only with the processors named above (Vercel, Supabase, Stripe, Resend), which are contractually bound pursuant to Art. 28 GDPR. Transfers to the USA are based on Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Data is never shared for advertising purposes.

12. Your rights

To exercise any of these rights, an informal email to hi@editkraft.com is sufficient. We respond within one month (Art. 12(3) GDPR).

13. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, baden-wuerttemberg.datenschutz.de.

14. Right to object

You may object at any time to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation. We will stop the processing unless compelling legitimate grounds or the exercise of legal claims prevail.

15. Automated decision-making

We do not use decision-making based solely on automated processing, including profiling (Art. 22 GDPR).

16. Technical and organizational measures

We protect data against loss, unauthorized modification and unauthorized access through measures including TLS encryption, certified data centers, restrictive access controls and regular software updates. Connection credentials for customer databases are additionally stored encrypted (AES-256-GCM).

17. Changes to this policy

We update this policy when the legal situation or our services change. The current version is always available on this page.

Last updated: July 2026