Data privacy

Last updated: 27 May 2026

1. Controller and data protection contact

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States, as well as other data protection provisions, is:

Platform7 mediadesign Owner: Samuel Schmidt Postfach 20 01 10 34080 Kassel Germany

Represented by: Samuel Schmidt (Managing Director)

E-mail: dataprivacy@margheritaai.com

Tax office Marburg-Biedenkopf Tax No.: 031 866 03412 VAT ID No.: DE350097686

Data protection officer

Samuel Schmidt dataprivacy@margheritaai.com

2. Overview: what this policy covers

margheritaAI is a web platform that lets restaurants and delivery services design and export design templates (flyers, menus, vouchers, etc.). This privacy policy informs you about the nature, scope and purpose of the processing of personal data when you use our website at app.margheritaai.com (hereinafter "the platform") as well as the associated information pages, in particular www.margheritaai.com.

Personal data is any data that can be related to you personally, e.g. your name, e-mail address, IP address or the designs you create, insofar as these contain personal content.

3. Legal bases for processing

Insofar as we obtain consent for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.

For processing necessary for the performance of a contract with you or for the implementation of pre-contractual measures, Art. 6(1)(b) GDPR serves as the legal basis. This applies in particular to the provision of your user account and the paid Pro features.

Insofar as processing is necessary to comply with a legal obligation (e.g. retention under commercial and tax law), Art. 6(1)(c) GDPR serves as the legal basis.

In cases where the legitimate interests of us or a third party make processing necessary and your interests, fundamental rights and freedoms do not override them, Art. 6(1)(f) GDPR serves as the legal basis (e.g. IT security, fraud prevention, functionality of the platform).

4. Hosting and server log files

4.1 Hosting provider

We host the platform with Host Europe GmbH, Hansestraße 111, 51149 Cologne, Germany, in a data center located in Strasbourg (France) – thus within the EU. A data processing agreement pursuant to Art. 28 GDPR exists with the provider.

To provide the hosting and infrastructure services (including data center operation, network, security and DDoS defense), the provider in turn uses sub-processors. Some of these sub-processors process data – in particular connection and network metadata such as IP addresses – also in third countries outside the EU/EEA (in particular the USA and Switzerland). These transfers are safeguarded by appropriate guarantees within the meaning of Art. 44 et seq. GDPR (EU-U.S. Data Privacy Framework or standard contractual clauses, Art. 46 GDPR). The provider makes the current list of sub-processors available at https://www.hosteurope.de/fileadmin/user_upload/Subunternehmerliste__DE.pdf (see also section 13).

4.2 Server log files

When you access the platform, the web server automatically collects information and stores it in what are known as server log files, which your browser transmits automatically. In the standard scope of Apache these are in particular:

• the anonymized, truncated or full IP address of the accessing device,

• the date and time of access,

• the name and URL of the file accessed and the amount of data transferred,

• the website from which access was made (referrer URL),

• the browser used and, where applicable, your computer's operating system as well as the name of your access provider (user agent).

The processing of this data is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring trouble-free operation, the security of our information technology systems, and the investigation and prevention of attacks and abuse.

The log files are stored for a maximum of 30 days and then automatically deleted. We do not merge this data with other data sources to identify you; longer storage only takes place insofar as this is necessary to preserve evidence in the event of a specific security-relevant incident.

5. User account and registration

Creating and saving designs requires a user account. Visitors who are not logged in can view the platform but are prompted to register in order to create their own designs.

5.1 Data processed

When you register and use the account, we process:

• e-mail address (mandatory, also serves as login),

• password (stored exclusively as a cryptographic hash – the plain-text password is never known to us at any time),

• where applicable, your name / display name and details about your business (restaurant, delivery service), insofar as you provide them,

• account status / user tier (Free or Pro),

• timestamps of registration, last login and consents,

• the status of your consent to legal documents (see section 11).

5.2 Purpose and legal basis

Processing takes place to provide the user account and to perform the usage contract (Art. 6(1)(b) GDPR).

5.3 Storage period

We store the account data for as long as your account exists. After deletion of the account, the personal data is deleted, insofar as no statutory retention obligations (in particular under commercial and tax law, see section 7.3) prevent this.

6. Created designs and file uploads

6.1 Content

Designs created in the editor (flyers, menus, vouchers, etc.) and the files uploaded for them (e.g. images, logos) are stored on our servers to enable you to edit, save and export them.

Please note: if you incorporate personal data (e.g. photos of individuals, contact details) into your designs, you are responsible as an independent controller for the lawfulness of that processing.

6.2 Upload validation and access protection

Uploaded files are checked server-side for their actual file type (MIME validation). Uploads are access-protected and accessible only to the associated account; retrieval is only possible after authentication or via specially signed, time-limited sharing links.

6.3 Purpose and legal basis

Processing takes place for the performance of the contract (Art. 6(1)(b) GDPR). Storage takes place for as long as the respective design or account exists.

7. Payment processing (Pro subscription)

The paid Pro membership is processed via the payment service provider Stripe.

7.1 Service provider

Stripe Payments Europe, Ltd. The One Building, 1 Grand Canal Street Lower Dublin 2, Ireland

When you make a payment, the payment data (e.g. credit card or bank details) is processed directly by Stripe. We ourselves do not store any complete payment data (e.g. no complete credit card numbers). From Stripe we only receive the information necessary for processing the contract, such as a customer and transaction identifier, the subscription status, payment times, and the first/last digits and the card type for allocation.

7.2 Purpose, legal basis and third-country transfer

The processing of payment data takes place for the performance of the contract (Art. 6(1)(b) GDPR). Stripe may also transfer personal data to countries outside the EU/EEA (in particular the USA). Stripe is certified under the EU-U.S. Data Privacy Framework or bases transfers on standard contractual clauses pursuant to Art. 46 GDPR.

Further information on data processing by Stripe: https://stripe.com/privacy

7.3 Retention of invoicing and accounting data

We retain invoicing, accounting and payment records due to commercial and tax law obligations (Art. 6(1)(c) GDPR, Sections 147 AO, 257 HGB) for the statutory period of, as a rule, 6 or 10 years.

8. eCaupo integration (shop link)

margheritaAI is connected to the SaaS shop solution eCaupo (https://www.ecaupo.com). eCaupo customers can be provided with the Pro membership via a connected shop connection, without a separate Stripe payment taking place.

8.1 Operator of eCaupo

eCaupo is operated by the same controller as margheritaAI (see section 1). It is not a third-party company but another service of the same provider. A disclosure of your data to third parties or processing on behalf by another company therefore does not take place within the scope of this integration.

8.2 Data processed and purpose

When you link your margheritaAI account with an eCaupo shop connection, we process the data required for this from both services to check your entitlement to the Pro features, in particular:

• a unique identifier of your eCaupo shop or customer account,

• the status of the business relationship / entitlement claim,

• where applicable, the e-mail address required for allocation.

Since both services are operated by the same controller, this is an internal merging of data for the stated purpose; the data does not leave the controller in the process.

The purpose is the provision of the Pro features on the basis of your existing eCaupo business relationship. The legal basis is the performance of the contract or the implementation of pre-contractual measures (Art. 6(1)(b) GDPR) as well as our legitimate interest in linking the two services and in lead generation (Art. 6(1)(f) GDPR).

9. E-mail dispatch

We send transaction-related e-mails (e.g. registration confirmation, password reset, invoices, important notices about your account). Dispatch takes place exclusively via an authenticated SMTP server.

E-mail is sent via the Host Europe SMTP mail server, server location EU.

We process your e-mail address and the respective message content. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) or our legitimate interest in secure and reliable communication (Art. 6(1)(f) GDPR).

10. Cookies, sessions and local storage

10.1 Technically necessary cookies / session

To provide the login function and to secure forms (protection against cross-site request forgery, CSRF) we use technically necessary cookies or session identifiers. These are required so that you stay logged in and forms can be submitted securely.

The legal basis is Section 25(2)(2) TDDDG (technically strictly necessary storage) in conjunction with Art. 6(1)(b) and (f) GDPR. No consent is required for technically necessary cookies.

To speed up and manage sessions, a Redis cache may be used on the server side. This runs on our own infrastructure (see section 4) and does not pass on any data to third parties.

10.2 Local storage in the browser

For the function of the design editor, data may be temporarily stored in your browser's local storage, such as editor settings or interim states. This data remains in your browser and is not transmitted to us, unless this is expressly necessary for saving your design.

10.3 No tracking or marketing cookies

As things currently stand, we use no analytics, tracking or marketing cookies and no services for reach measurement (e.g. Google Analytics).

11. Legal documents and consent management

Certain legal documents (e.g. terms and conditions, this privacy policy in its respective applicable version) are managed with versioning. In the event of legally relevant revisions, you will be prompted to take note of or consent to them again upon login. For this purpose we store which version you consented to and when (Art. 6(1)(c) and (b) GDPR, demonstrability pursuant to Art. 7(1) GDPR).

12. Recipients and processors

Your data is transferred to third parties only in the cases described in this policy. Recipients or processors are in particular:

With our processors we have, where necessary, concluded data processing agreements pursuant to Art. 28 GDPR. In the case of Stripe, the data processing agreement is part of the Stripe terms of use and applies upon conclusion of the contract.

13. Data transfer to third countries

A transfer to countries outside the EU/EEA takes place in the following cases:

• in the context of payment processing via Stripe (see section 7.2),

• through sub-processors of our hosting provider (Host Europe GmbH), which, in order to provide the infrastructure and network services, operate in part in third countries – in particular the USA and Switzerland (see section 4.1).

All of these transfers are safeguarded by appropriate guarantees within the meaning of Art. 44 et seq. GDPR, namely by certification under the EU-U.S. Data Privacy Framework or by standard contractual clauses pursuant to Art. 46 GDPR. Otherwise, your data is processed within the EU/EEA.

14. Data security

We take technical and organizational measures to protect your data against loss, destruction, manipulation and unauthorized access. These include in particular:

• transmission encryption of the website via TLS/HTTPS,

• storage of passwords exclusively as an Argon2id hash,

• protection of forms by CSRF tokens and input validation,

• the use of parameterized database queries (protection against SQL injection),

• consistent output escaping to protect against cross-site scripting,

• server-side MIME validation of uploaded files,

• access-restricted, account-scoped storage of uploads.

Our security measures are continuously adapted in line with technological developments.

15. Your rights as a data subject

Under the GDPR you have in particular the following rights:

• Access (Art. 15 GDPR) to the data stored about you,

• Rectification (Art. 16 GDPR) of inaccurate data,

• Erasure (Art. 17 GDPR), insofar as no retention obligations prevent this,

• Restriction of processing (Art. 18 GDPR),

• Data portability (Art. 20 GDPR),

• Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),

• Withdrawal of consent given with effect for the future (Art. 7(3) GDPR).

To exercise these rights, an informal message to the contact details given in section 1 is sufficient.

Right to object (Art. 21 GDPR)

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(f) GDPR.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR). Competent authorities include, among others, the supervisory authority of your usual place of residence or the authority responsible for us:

Responsible for margheritaAI is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Friedrichstr. 219, 10969 Berlin, Germany.

16. Obligation to provide the data

The provision of certain data (e.g. e-mail address and password upon registration, payment data for the Pro subscription) is necessary for the conclusion of the contract or the use of the respective function. Without this data we cannot provide the corresponding service. Any provision of data beyond this is voluntary.

17. Automated decision-making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

18. Changes to this privacy policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services. The version available at the time of your visit applies. In the event of legally material changes, logged-in users will be informed separately (see section 11).