Privacy policy
Controller
The operator below is the controller. No data protection officer is appointed; one is not legally required at our current size.
- Legal name
- 200 Digital UG (haftungsbeschränkt)
- Postal address
- Admiral-Spee-Str. 7A, 79100 Freiburg im Breisgau, Germany
- Authorized representative
- Maximilian Patzner (Managing Director)
- Register court and registration number
- Amtsgericht Freiburg, HRB 735404
- VAT identification number
- DE463220089
- [email protected]
Data and purposes
We process account identifiers, subscription data and support correspondence to provide access, answer requests and manage billing. Stripe Checkout processes your email, payment and billing information. The application stores customer, subscription and Checkout identifiers, not card details or an account-email field. Free signup creates a local customer identity without Stripe or a payment card.
API keys, claim tokens, OAuth access and refresh tokens, authorization codes and confidential-client secrets are stored only as SHA-256 hashes. The raw API key is delivered once. Client registration metadata, callback URLs and grant relationships are also stored. Business status and Terms acceptance are required for Free signup and paid Checkout; proof of acceptance consists of the timestamp and terms version. Free signup also stores a hashed client address to enforce one key per address per 24 hours and a global daily cap.
Usage records contain the tool, timestamps, success or failure status, returned-record counts, duration and account/plan association. Quotas and billing use these records. Search query parameters are forwarded to the query execution provider; no account data is forwarded. Returned public data can include business contact details and Reddit usernames and text. The application does not persist query text or returned records in its usage database.
Legal bases
Article 6(1)(b) GDPR applies to contract performance and requested pre-contract steps. Article 6(1)(c) applies to statutory retention under commercial and tax law. Article 6(1)(f) applies to our legitimate interests in security, abuse prevention, rate limiting and reliable service delivery.
Recipients and transfers
Stripe Payments Europe, Ltd. (Ireland) processes payments and invoices. Stripe acts as an independent controller for its own compliance purposes.
Cloudflare, Inc. (USA) provides CDN, security proxy and email forwarding services. Transfers rely on the EU-US Data Privacy Framework and standard contractual clauses.
Hetzner Online GmbH provides hosting in its data center in Nuremberg, Germany.
Apify Technologies s.r.o., Prague, Czech Republic, executes search queries, receiving query parameters only and no account data. The operator's business email provider handles support mail.
Bot protection, cookies and logs
Cloudflare Turnstile runs only on the Free signup page. It processes IP addresses and browser signals to distinguish humans from bots under Article 6(1)(f), for our legitimate interest in abuse prevention. It is the only third-party script. The website uses no analytics, external fonts or CDNs other than this verification service and sets no cookies on its public pages.
The separate OAuth consent flow uses an essential, HTTP-only security cookie for up to five minutes to bind the browser to consent and prevent unauthorized requests. The cookie is scoped to the authorization endpoint and deleted after consent.
No application or nginx access logs are kept. Nginx error logs are kept for 14 days. Cloudflare security logs are retained according to Cloudflare's policies. Usage accounting remains active.
Retention and deletion policy
The operator's deletion policy is to keep account and key records for the contract duration and delete them within 30 days after termination unless statutory retention applies. Usage records are kept for 12 months. Invoices and accounting records are kept for 10 years under section 147 AO and section 257 HGB. Support emails are kept for up to 3 years. Backups are overwritten within 30 days. Signup address hashes are deleted after 24 hours; acceptance timestamps and terms versions follow the associated account or contract retention policy.
The application does not enforce scheduled deletion of account, key, usage, billing, signup, client-registration, grant, code or token records. The operator carries out these deletions and backup overwrites manually under this policy, including expired credential records.
OAuth consent requests expire after five minutes and expired request rows are removed when a new authorization begins. Authorization codes are valid for 60 seconds, access tokens for at most one hour and grants/refresh access for 30 days. Credential expiry is not database deletion.
Your rights
Subject to applicable requirements, you have rights of access, rectification, erasure, restriction, portability and objection. Where consent is used, you may withdraw it without affecting prior lawful processing. Contact [email protected].
You may complain to a supervisory authority, including the competent Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg. There is no automated decision-making or profiling within Article 22 GDPR.