The following information will provide you with an easy to navigate overview of what will happen with your personal data when you visit this website. The term “personal data” comprises all data that can be used to personally identify you. For detailed information about the subject matter of data protection, please consult our Data Protection Declaration, which we have included beneath this copy.
The data on this website is processed by the operator of the website, whose contact information is available under section “Information about the responsible party” in this Privacy Policy.
We collect your data as a result of your sharing of your data with us. This may, for instance, be information you enter when you create an account or when you send us an email.
Other data shall be recorded by our IT systems automatically during your website visit. This data comprises primarily technical information (e.g., web browser, operating system, or time the site was accessed).
A portion of the information is generated to guarantee the error free provision of the website. Other data may be used to analyze how our website is used in aggregate. If contracts can be concluded or initiated via the website, the transmitted data will also be processed for contract offers, orders or other order enquiries.
You have the right to receive information about the source, recipients, and purposes of your archived personal data at any time without having to pay a fee for such disclosures. You also have the right to demand that your data are rectified or eradicated. If you have consented to data processing, you have the option to revoke this consent at any time, which shall affect all future data processing. Moreover, you have the right to demand that the processing of your data be restricted under certain circumstances. Furthermore, you have the right to log a complaint with the competent supervising agency.
Please do not hesitate to contact us at any time if you have questions about this or any other data protection related issues.
We measure how our website is used with self-hosted analytics software running on our own server. No analytics data is shared with any third party, no cookies are used for this purpose, and the measurement does not extend to the signed-in application. Details are set out in section 8.
We are hosting the content of our website at the following provider:
The provider is the Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter referred to as Hetzner).
The server on which this website runs is located in Nuremberg, Germany (network zone eu-central). The address given above is Hetzner’s registered office, which is not the same thing as the data centre location.
For details, please view the data privacy policy of Hetzner: https://www.hetzner.com/de/legal/privacy-policy/.
We use Hetzner on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable depiction of our website possible. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. This consent can be revoked at any time.
We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.
The operators of this website and its pages take the protection of your personal data very seriously. Hence, we handle your personal data as confidential information and in compliance with the statutory data protection regulations and this Data Protection Declaration.
Whenever you use this website, a variety of personal information will be collected. Personal data comprises data that can be used to personally identify you. This Data Protection Declaration explains which data we collect as well as the purposes we use this data for. It also explains how, and for which purpose the information is collected.
We herewith advise you that the transmission of data via the Internet (i.e., through e-mail communications) may be prone to security gaps. It is not possible to completely protect data against third-party access.
The data processing controller on this website is:
Tommy Hummel-Nguyen
ChartBuilder
Lindenring 21B
16761 Hennigsdorf
Germany
Phone: 015561379435
E-mail: chartbuilderstudio@gmail.com
The controller is the natural person or legal entity that single-handedly or jointly with others makes decisions as to the purposes of and resources for the processing of personal data (e.g., names, e-mail addresses, etc.).
Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for which it was collected no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.
If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9 (2)(a) GDPR, if special categories of data are processed according to Art. 9 (1) GDPR. In the case of explicit consent to the transfer of personal data to third countries, the data processing is also based on Art. 49 (1)(a) GDPR. If you have consented to the storage of cookies or to the access to information in your end device (e.g., via device fingerprinting), the data processing is additionally based on § 25 (1) TDDDG. The consent can be revoked at any time. If your data is required for the fulfillment of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, if your data is required for the fulfillment of a legal obligation, we process it on the basis of Art. 6(1)(c) GDPR. Furthermore, the data processing may be carried out on the basis of our legitimate interest according to Art. 6(1)(f) GDPR. Information on the relevant legal basis in each individual case is provided in the following paragraphs of this privacy policy.
In the scope of our business activities, we cooperate with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only disclose personal data to external parties if this is required as part of the fulfillment of a contract, if we are legally obligated to do so (e.g., disclosure of data to tax authorities), if we have a legitimate interest in the disclosure pursuant to Art. 6 (1)(f) GDPR, or if another legal basis permits the disclosure of this data. When using processors, we only disclose personal data of our customers on the basis of a valid contract on data processing. In the case of joint processing, a joint processing agreement is concluded.
A wide range of data processing transactions are possible only subject to your express consent. You can also revoke at any time any consent you have already given us. This shall be without prejudice to the lawfulness of any data collection that occurred prior to your revocation.
IN THE EVENT THAT DATA ARE PROCESSED ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO AT ANY TIME OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA BASED ON GROUNDS ARISING FROM YOUR UNIQUE SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. TO DETERMINE THE LEGAL BASIS, ON WHICH ANY PROCESSING OF DATA IS BASED, PLEASE CONSULT THIS DATA PROTECTION DECLARATION. IF YOU LOG AN OBJECTION, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA, UNLESS WE ARE IN A POSITION TO PRESENT COMPELLING PROTECTION WORTHY GROUNDS FOR THE PROCESSING OF YOUR DATA, THAT OUTWEIGH YOUR INTERESTS, RIGHTS AND FREEDOMS OR IF THE PURPOSE OF THE PROCESSING IS THE CLAIMING, EXERCISING OR DEFENCE OF LEGAL ENTITLEMENTS (OBJECTION PURSUANT TO ART. 21(1) GDPR).
IF YOUR PERSONAL DATA IS BEING PROCESSED IN ORDER TO ENGAGE IN DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR AFFECTED PERSONAL DATA FOR THE PURPOSES OF SUCH ADVERTISING AT ANY TIME. THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS AFFILIATED WITH SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT ADVERTISING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR).
In the event of violations of the GDPR, data subjects are entitled to log a complaint with a supervisory agency, in particular in the member state where they usually maintain their domicile, place of work or at the place where the alleged violation occurred. The right to log a complaint is in effect regardless of any other administrative or court proceedings available as legal recourses.
You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you should demand the direct transfer of the data to another controller, this will be done only if it is technically feasible.
Within the scope of the applicable statutory provisions, you have the right to demand information about your archived personal data, their source and recipients as well as the purpose of the processing of your data at any time. You may also have a right to have your data rectified or eradicated. If you have questions about this subject matter or any other questions about personal data, please do not hesitate to contact us at any time.
You have the right to demand the imposition of restrictions as far as the processing of your personal data is concerned. To do so, you may contact us at any time. The right to demand restriction of processing applies in the following cases:
If you have restricted the processing of your personal data, these data – with the exception of their archiving – may be processed only subject to your consent or to claim, exercise or defend legal entitlements or to protect the rights of other natural persons or legal entities or for important public interest reasons cited by the European Union or a member state of the EU.
We use cookies only where they are technically necessary to operate this website — in practice, to keep you signed in to your account. We do not use cookies for analytics, for advertising or for profiling, and no third party sets cookies through this website.
Cookies are small data packages that do not cause any damage to your device. They are either stored temporarily for the duration of a session (session cookies) or they are permanently archived on your device (permanent cookies). Session cookies are automatically deleted once you terminate your visit.
Cookies that are required for the performance of electronic communication transactions or for the provision of functions you have asked for are stored on the basis of Art. 6(1)(f) GDPR. The operator of the website has a legitimate interest in the technically error-free provision of its services. Where consent is required for the storage of cookies or similar technologies, processing takes place exclusively on the basis of that consent (Art. 6(1)(a) GDPR and § 25 (1) TDDDG), which may be revoked at any time.
You have the option to set up your browser in such a manner that you will be notified any time cookies are placed, to permit the acceptance of cookies only in specific cases, or to exclude them in general. If cookies are deactivated, you will not be able to sign in.
The provider of this website and its pages automatically collects and stores information in so-called server log files, which your browser communicates to us automatically. The information comprises:
This data is not merged with other data sources.
This data is recorded on the basis of Art. 6(1)(f) GDPR. The operator of the website has a legitimate interest in the technically error free depiction and the optimization of the operator’s website. In order to achieve this, server log files must be recorded.
If you contact us by e-mail or telephone, your request, including all resulting personal data (name, request) will be stored and processed by us for the purpose of processing your request. We do not pass these data on without your consent.
These data are processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the fulfillment of a contract or is required for the performance of pre-contractual measures. In all other cases, the data are processed on the basis of our legitimate interest in the effective handling of inquiries submitted to us (Art. 6(1)(f) GDPR) or on the basis of your consent (Art. 6(1)(a) GDPR) if it has been obtained; the consent can be revoked at any time.
The data sent by you to us via contact requests remain with us until you request us to delete them, revoke your consent to their storage, or the purpose for the data storage lapses. Mandatory statutory provisions — in particular statutory retention periods — remain unaffected.
The waiting list has been discontinued. ChartBuilder is open to everyone, there is no longer any way to join a waiting list, and no further emails are sent from it.
Entries made while the waiting list existed are still stored, which is why this section remains. For each entry we hold the email address, optionally the name and the context provided, together with the exact consent wording agreed to, the IP address used at sign-up and at confirmation, and the confirmation timestamp. The IP address and the consent wording were stored solely as proof of consent pursuant to Art. 7 (1) GDPR. Entry was by double opt-in: an entry only became active once confirmed via a link sent by email.
Legal basis: Art. 6(1)(a) GDPR — your consent. You may withdraw your consent at any time, with effect for the future, using the unsubscribe link in the email you received from us; the link remains functional. This does not affect the lawfulness of processing carried out before the withdrawal. You may also ask us to delete your entry at any time using the contact details in section 1.
After a withdrawal we retain the email address as a suppression record for the sole purpose of preventing further mailings; this data is not merged with any other data.
Waiting-list emails were delivered through Resend, Inc., San Francisco, California, USA, under a data processing agreement and safeguarded by the standard contractual clauses of the European Commission. No further data is transmitted to Resend. Emails concerning your account (registration confirmation, password reset) are sent by Supabase, see section 2.
You can register on this website in order to use the application. We use the data you enter for this purpose only in order to provide the service you have registered for.
The data we process comprises: your email address, your password (stored only as a cryptographic hash, never in plain text), your first and last name, and the status of your plan and subscription.
Legal basis: Art. 6(1)(b) GDPR — the processing is necessary for the performance of our contract with you. The data is stored for as long as you maintain an account with us. You can delete your account and the data associated with it at any time from within the application; statutory retention periods remain unaffected.
Our application database and the authentication of your account are operated using Supabase, provided by Supabase, Inc. The account data described above is stored there on our behalf.
Your account data is stored on servers in Frankfurt am Main, Germany (AWS region eu-central-1) and does not leave the European Union in the ordinary course of operating the service.
Supabase, Inc. is based in the United States. Insofar as access from a third country occurs in individual cases — for instance in the course of technical support — this is safeguarded by the standard contractual clauses of the European Commission, which form part of the data processing agreement we have concluded with Supabase.
Legal basis: Art. 6(1)(b) GDPR.
Instead of a password you may choose to sign in with your Google account. If you do, you are redirected to Google, where you authenticate and confirm which data you release to us. Google receives the information that you are signing in to our service; the content of the redirect is determined by Google.
From Google we receive only your email address, your name and your profile picture URL, insofar as your Google account holds them. We do not receive your Google password and we have no access to any other data in your Google account. The data received is stored in your account with us in the same way as data you would otherwise have entered yourself.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Insofar as data is transferred to Google LLC in the United States, Google LLC is certified under the EU-US Data Privacy Framework, so the transfer takes place on the basis of an adequacy decision of the European Commission pursuant to Art. 45 GDPR.
Legal basis: Art. 6(1)(b) GDPR — using this sign-in method is a way of performing our contract with you. Using it is voluntary; registration with an email address and password remains available. Further information can be found in Google’s own privacy policy.
We process customer and contract data for the purpose of establishing, structuring the content of, and changing our contractual relationships. Data on the use of this website is processed only to the extent that this is necessary to enable you to use the service or to bill you. Legal basis: Art. 6(1)(b) GDPR.
The customer data collected shall be eradicated upon completion of the order or the termination of the business relationship and upon expiration of any existing statutory archiving periods.
Payments for our paid plans are processed by Polar Software, Inc., USA, acting as the merchant of record. This means that the purchase contract for the paid plan is concluded with Polar, and that Polar is responsible for payment processing, invoicing and applicable sales taxes.
Your payment details (such as card data and billing address) are entered directly with Polar and are not transmitted to or stored by us. We receive from Polar only the information required to grant you access to the plan you purchased: an identifier for your account, the product purchased, and the status of your subscription.
Legal basis: Art. 6(1)(b) GDPR. Please also consult Polar’s own privacy policy for the processing carried out under their responsibility.
We use Umami, an open-source analytics tool, to measure how our website is used. Umami runs exclusively on our own server. No data is transmitted to any third party.
We record: the page visited, the referring page, browser, operating system, device type, screen size, language and country. No cookies are set and no information is stored on or read from your device. IP addresses are not stored; they are used only as part of a daily-rotating, non-reversible hash that allows us to tell one visit from another. Query strings are discarded before a page address is stored.
Analytics is active on our public marketing pages only. It is not active inside the signed-in application, and no measurement is ever linked to your user account or to your identity.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in understanding and improving how our website performs. You may object at any time pursuant to Art. 21 GDPR. Your browser’s “Do Not Track” setting is respected.
Retention: 12 months, after which the records are deleted automatically.
Our application offers two optional voice features. If you generate a voice-over, the text you have written is transmitted to ElevenLabs and returned as spoken audio in one of a fixed set of synthetic stock voices; no voice cloning takes place and no voice model of yours is created. If you use automatic subtitles, the audio you have recorded is transmitted to ElevenLabs for transcription. These transfers only take place when you actively trigger the respective feature.
Neither the text nor the audio is stored by us. The generated result is returned to your browser and stored there, on your own device.
Provider: ElevenLabs, Inc., USA. ElevenLabs is certified under the EU-US Data Privacy Framework, so the transfer takes place on the basis of an adequacy decision of the European Commission pursuant to Art. 45 GDPR. In addition, the data processing agreement we have concluded with ElevenLabs incorporates the standard contractual clauses of the European Commission, which apply insofar as the adequacy decision does not cover a transfer.
Legal basis: Art. 6(1)(b) GDPR — performance of our contract with you.
When you submit feedback from inside the application, we store your message and rating together with your email address, your plan, the page you were on, your browser identification and — only if you choose to attach one — a screenshot. We use this to reproduce and fix problems.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in identifying and correcting faults in our product.
The charts and animations you create in the editor are stored locally in your browser and are not transmitted to us. Video and image exports are rendered in your browser as well. The only exceptions are items you explicitly save to your account, such as brand kits and view preferences.