LazyLEED

Privacy policy (Datenschutzerklärung)

Draft. This text is a starting point written for this service; it is not legal advice. Please review it (and replace all [[…]] placeholders) before inviting users.

1. Controller

[[FULL NAME]], [[ADDRESS]], e-mail: [[E-MAIL ADDRESS]] (see the imprint).

2. What data is processed

  • Account data: e-mail address, password (stored only as a salted hash), optional institution, time of registration and last login, the invitation used to register, two-factor authentication secrets if you enable them.
  • Your projects: the diffraction / STM images and analysis results you upload or create. They are only used to provide the service to you and are not shared with anyone (there is no sharing feature).
  • Technical data: IP address, time, requested URL and browser identification in the server logs of the reverse proxy and the application, for operation and security (e.g. against password guessing).
  • Cookies: a session cookie (login) and a CSRF cookie (protection against forged requests). Both are technically necessary; there are no tracking or analytics cookies and no third-party content.
  • Providing the service you registered for – Art. 6 (1) (b) GDPR.
  • Security of the service and abuse prevention (logs, rate limiting) – Art. 6 (1) (f) GDPR.

4. Hosting and processors

The service runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a German data centre, under a data processing agreement (Art. 28 GDPR). E-mails (verification, password reset) are sent via the mail server of STRATO GmbH, Otto-Ostrowski-Str. 7, 10249 Berlin, Germany. No data is transferred to countries outside the EU.

5. Storage period

  • Account data and projects: until you delete them or your account. Deleted projects are kept in a trash for 30 days, then removed.
  • Server logs: [[14]] days. Backups: [[30]] days (encrypted).

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). On the Account page you can download all your projects and delete your account yourself. You also have the right to lodge a complaint with a supervisory authority, e.g. the authority of your federal state.

Last updated: [[DATE]]