Privacy policy

Controller

The controller within the meaning of the GDPR is:
[Firma] GmbH
[Adresse]
Email: legal@delishy.ai

For content that customers bring into delishy (in particular source code, screenshots and brand material), we act as the customer’s processor; the data processing agreement applies to this.

You can find the data processing agreement here: Data processing agreement.

Privacy contact

Please send questions about data protection and requests to exercise your rights to privacy@delishy.ai.

[to check: Is a data protection officer required? If so, add name and contact details.]

Summary

• We process account, organisation and brand data, sources you provide (repositories, zip files, URLs, screenshots, brand kit files), generated assets, and usage, billing and server data.
• Source code is cleaned of secrets before analysis and is not used to train AI models.
• We use Anthropic (USA) for AI processing; all other service providers mostly process data in the EU.
• We only use strictly necessary cookies, no analytics or advertising cookies.

Visiting the website and server logs

When you open our website and the app, the hosting services we use process technically required data, in particular IP address, date and time, requested address, referrer, browser type and operating system, and the status of the request (server logs).

The purpose is secure and stable operation, error analysis and protection against abuse. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure operation). Logs are deleted or anonymised after [to check: period, e.g. 30 days].

Account and organisation

For sign-in and use we process your email address, name (if provided), profile settings, membership of organisations and your assigned role (owner, admin, member, viewer), as well as invitations and access records.

The purpose is to provide the account and organisation management. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract). The data is stored until the account is deleted, and afterwards only where statutory retention obligations apply.

Organisation and brand data

Customers create brands and store brand material such as logos, colours, fonts, tone of voice and brand kit files. This data usually contains no personal data but may in individual cases contain names or images of people.

The legal basis is Art. 6 (1) (b) GDPR. The data is stored until the brand or organisation is deleted or the contract ends.

Uploaded sources and screenshots

Customers connect sources of their application: repositories, zip files or URLs, and screenshots. These sources may contain personal data, for example names in test data or people shown in screenshots. The customer is responsible for this content; we process it on the customer’s behalf to provide the service (see the data processing agreement).

We ask customers not to bring real personal data of end customers into sources and screenshots unless necessary.

Source code processing

We create a snapshot (archive, “tarball”) of connected sources. Before analysis, the snapshot is cleaned of secrets, in particular .env files, keys and tokens. Only the cleaned version is analysed and passed on to AI processing.

By default, snapshot archives are deleted 7 days after the UI kit is approved [adjustable; to check: settings and maximum period]. Source code is not used to train our own or third-party AI models.

The legal basis is Art. 6 (1) (b) GDPR; where we act on behalf of the customer, the data processing agreement applies.

AI processing through Anthropic

To analyse sources, rebuild the interface as a UI kit and write copy, we use Anthropic’s Claude models through the application programming interface (API). Cleaned source content, screenshots, brand details and instructions are transmitted to Anthropic in the USA.

According to Anthropic, data sent through the API is not used to train its models. [to check: agreement on zero data retention and its scope.]

The transfer to the USA relies on the adequacy decision for the EU-US Data Privacy Framework where Anthropic is certified, and otherwise on the EU Commission’s standard contractual clauses [to check: Anthropic’s certification and contractual basis]. The legal basis for the processing is Art. 6 (1) (b) GDPR.

AI results may contain errors. We do not make decisions that significantly affect you legally or in a similar way solely on the basis of automated processing.

Generated assets

Videos and still images in various formats and languages are rendered from the UI kit. The generated assets as well as related kit artefacts and fonts are stored and delivered through signed, short-lived URLs.

The legal basis is Art. 6 (1) (b) GDPR. Storage ends when the customer deletes them, or at the latest [30 days, to check] after the contract ends.

Usage and billing data

We process usage data (for example started jobs, credit consumption, timestamps) and billing data (invoice details, subscription, payment status). Payments are handled by Stripe; payment data such as card numbers does not reach us.

The legal bases are Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (c) GDPR (commercial and tax retention obligations, currently usually 6 or 10 years [to check]). We delete usage data without billing relevance after [to check: period].

Emails and communication

We send emails that are necessary for operation, such as sign-in links, invitations to organisations, invoices and security notices. We use Resend to send them. If you write to us, we process your message and contact details to handle it.

The legal basis is Art. 6 (1) (b) GDPR, and for general enquiries Art. 6 (1) (f) GDPR. We send marketing newsletters only with separate consent.

Error reports

To detect and fix errors we use Sentry in its EU region. Error reports contain technical details (error message, stack trace, browser and system information). Standard personal data such as IP addresses is not collected or is removed [to check: Sentry configuration].

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in stable operation).

Cookies and local storage

We only use strictly necessary cookies and comparable technologies:

• Session cookies for sign-in (Supabase Auth), so that you stay signed in.
• Notice cookies that remember the organisation and brand you opened last and notices you dismissed.

Your appearance setting (light or dark) is stored only in your browser’s local storage (localStorage); it is not sent to us.

There are no analytics or advertising cookies. A consent banner is therefore not required; storage is permitted under Section 25 (2) no. 2 TDDDG. Subsequent processing relies on Art. 6 (1) (b) and (f) GDPR. Session cookies end when you sign out or after [to check: duration]; notice cookies last up to [to check: duration, e.g. 12 months]. You can delete cookies in your browser settings; you will then have to sign in again.

Retention and deletion

We store personal data only as long as necessary for the respective purpose or as long as statutory retention obligations apply. After the contract ends, customers can export their data; deletion follows within [30 days, to check]. Backups are overwritten in the regular cycle [to check: backup period].

Processors

We use the following service providers as processors under Art. 28 GDPR. A data processing agreement (DPA) is in place with each of them; for transfers to third countries we rely on the adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses.

• Supabase – database, authentication and file storage; Frankfurt region (EU).
• Vercel – hosting of the web app; functions in Frankfurt (fra1). The edge network operates worldwide, so requests may also be processed outside the EU. Transfer: Data Privacy Framework or standard contractual clauses.
• Cloudflare R2 – storage and delivery of kit artefacts and fonts; EU jurisdiction [to check]. Transfer: Data Privacy Framework or standard contractual clauses.
• Anthropic – AI models (Claude API); USA; API data is not used for training. Transfer: Data Privacy Framework or standard contractual clauses [to check].
• Stripe – payment processing and subscriptions; Ireland and USA. Stripe processes some payment data under its own responsibility. Transfer: Data Privacy Framework or standard contractual clauses.
• Resend – sending emails such as sign-in links and invitations; USA or EU [to check]. Transfer: standard contractual clauses or Data Privacy Framework.
• Sentry – error reports; EU region. Transfer: standard contractual clauses where required.
• Fly.io – render and agent workers; Frankfurt region (EU). Transfer: standard contractual clauses where required.

[to check: completeness of the list and the respective contractual bases before publication.]

Other recipients

We otherwise disclose data only where required by law, necessary to enforce legal claims, or where you have consented, for example to tax advisers, payment providers or authorities. Within organisations, other members see the data that is shared according to their role.

Transfers to third countries

Data is transferred to countries outside the European Economic Area in particular to Anthropic (USA) and in part to other providers named in the list. The transfer relies on an adequacy decision by the EU Commission (EU-US Data Privacy Framework) or on standard contractual clauses with supplementary measures. You can obtain a copy of the safeguards on request at privacy@delishy.ai.

Rights of data subjects

You have the following rights against us:

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

To exercise them, a message to privacy@delishy.ai is enough. Where we act on behalf of a customer, we forward requests to the customer.

Right to object

Where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the one where you live, where you work or where the alleged infringement took place. The authority responsible for us is [to check: supervisory authority according to the company’s seat].

Obligation to provide data

Using delishy requires your email address and the details of the organisation. Without this data we cannot perform the contract. Any other details are voluntary.

No automated decision-making

There is no solely automated decision-making, including profiling, that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR.

Customers as controllers of their content

Customers are the controllers of personal data in the sources, screenshots and brand material they bring in. We process this data as a processor under our data processing agreement. If you want to exercise your rights as a data subject with regard to such content, please contact the relevant customer first.

Changes to this policy

We update this policy when our processing or the law changes. You can always find the current version on this page; we will inform customers appropriately of material changes.