Privacy policy

1. Controller

GOLLE Digital Solutions GmbH, Berger Straße 125, 60385 Frankfurt am Main, Germany, represented by Fabian Golle. Email: datenschutz@golle-it.de, phone: +49 69 348 789 10-0. We have not appointed a data protection officer, as the statutory conditions for doing so do not apply to us.

2. Hosting and access logs

The website and the product run on our own infrastructure at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. A data processing agreement is in place with Hetzner.

The ingress component of this infrastructure logs every request with IP address, time, requested address, HTTP status code, amount of data transferred, browser identifier and referring page. Headers that may carry credentials are discarded before the entry is even created. We use these logs solely for secure operation, detecting and investigating attacks and abuse, and troubleshooting, and delete them automatically after 180 days; they are not used to analyse usage behaviour, measure reach or train AI models. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and uninterrupted operation. Where the logs concern requests by end customers in the product, we process them as a processor under the data processing agreement.

3. No cookies and no tracking on the website

The website www.stitchomat.de sets no cookies, stores nothing on your device and uses no analytics or marketing services. We serve fonts, images and videos from our own server; there is no connection to Google Fonts or any other external provider. That is why there is no cookie banner.

4. Contact by email

When you write to us by email, we process your details – usually name, email address, business and the content of your message – to answer your request. The legal basis is Art. 6(1)(b) GDPR where it concerns a pilot, a trial or a contract, otherwise our legitimate interest in handling your request (Art. 6(1)(f) GDPR). We use our own systems and communication services for this. We delete the data once your request has been dealt with and no contractual relationship arises, at the latest twelve months after the last contact; statutory retention obligations remain unaffected.

5. Businesses: staff area, customer account, billing

For businesses using Stitchomat we process, as controller, company and contact data, access to the staff area, settings (e.g. machines and needle setup), usage data for billing and invoice data. The legal basis is Art. 6(1)(b) GDPR (contract), Art. 6(1)(f) GDPR for securing access and Art. 6(1)(c) GDPR for invoices (retention under German tax and commercial law). We keep account and billing data after the end of the contract for the statutory retention periods.

To protect the staff area we count failed logins per IP address; for this we store the IP address only as a hash value and delete the counter after 2 days.

Payment processing (planned): Once we bill plans online, payments will be processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe will then process name, email address, billing address, VAT ID where applicable and the details of the chosen payment method; you enter full card details directly with Stripe. The legal basis is Art. 6(1)(b) GDPR. Stripe processes the data in the EU; where data is transferred to Stripe, Inc. in the USA, we rely on the European Commission’s standard contractual clauses. Stripe receives no end-customer data. Until then we bill by invoice.

6. End customers: designing on behalf of the business

When end customers design a motif via Stitchomat (QR code, link or kiosk), the respective business is the controller; we process the data on its behalf under the data processing agreement. End customers with questions about their data should contact the business where they designed their motif.

We process the design input (wish text, names and text to be embroidered, uploaded logos), the drafts and embroidery files created from it, order codes and technical data (IP address, browser identifier, time).

Every deletion is logged without personal content. We record error reports with a self-hosted service on our infrastructure, without IP addresses, cookies or request content.

Cookies in the product

The product only sets technically necessary cookies: a session identifier for the limits per design session (30 minutes), access via the stand QR code (2 hours) and the login to the staff area (12 hours). The browser keeps the chosen language in local storage. These are required for the service requested (Section 25(2) no. 2 TDDDG).

7. Use of artificial intelligence and transfers to third countries

For motif wishes we call AI models via OpenRouter, Inc. (USA). A language model receives the wish text entered in order to separate the picture from the text to be embroidered; the image model only receives the image description derived from it. Names from the name field and logo uploads go to no AI model. The models are operated – depending on OpenRouter’s routing – by Google, Anthropic, Amazon Web Services or Microsoft, in the USA or worldwide. Our AI data use page describes which data goes to which model; all providers are listed under Subprocessors.

Transfers to OpenRouter are covered by the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) as part of the data processing addendum that OpenRouter incorporates into its terms of service; OpenRouter engages the model providers as its own sub-processors. OpenRouter does not use transmitted content for training. Whether a model provider stores content or may use it for training is governed by that provider’s terms; we have not yet excluded this contractually. That is why we only send what the draft requires.

8. Recipients

A complete and current list of all service providers that process personal data on our behalf is available under Subprocessors. It states the purpose, the place of processing and the basis for any transfer to a third country for each provider. We have concluded agreements under Art. 28 GDPR with all processors.

9. Storage period

We store personal data only as long as necessary for the respective purpose or as required by statutory retention periods – in particular the six- and ten-year periods under German commercial and tax law. The data is then deleted. The specific periods are set out in the sections above.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). You may object under Art. 21 GDPR to processing we base on a legitimate interest. Any consent given can be withdrawn at any time with effect for the future. Please contact datenschutz@golle-it.de.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany.

12. No automated individual decision-making

There is no automated decision-making, including profiling, under Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. A person at the business approves every embroidery file.

13. Changes to this policy

We adapt this privacy policy when our processing or the legal situation changes. The version published on this page at the time applies.