Eigenlaut
Open the app
Privacy policy
Last updated: 14.10.2026
This is a translation. The German Datenschutzerklärung is the binding version and prevails.
This policy covers eigenlaut.app, with our public pages and the customer area at /app/, as well as our social media profiles and the applications we publish there with. We process the Google Workspace data that Eigenlaut uses for a customer's signatures on that customer's behalf; the customer is the controller for it (Processing on behalf of our customers).
1. Controller
Justus-Constantin Weidhaus
Hauptstraße 52
96191 Viereth-Trunnstadt
Deutschland
E-mail for data protection requests: contact@eigenlaut.app
We have not appointed a data protection officer because the law does not require one.
2. Summary
- You can use our public pages without signing in. We set no cookies there.
- In the customer area you sign in with your Google Workspace account. For this we set two strictly necessary cookies and no others (Customer area and Sign in with Google).
- Eigenlaut does not read e-mails. From Google Workspace we read only the directory details the signature templates need, and in Gmail we change only the signature (Processing on behalf of our customers).
- We do not store names, job titles or phone numbers from the directory permanently. We store IP addresses nowhere.
- Fonts and scripts come from our own server.
- We do not sell data.
3. Hosting and delivery through Cloudflare
The website and the customer area run on Cloudflare Workers. Cloudflare delivers the pages, protects them against attacks, runs our server code and provides our database (Cloudflare D1) and our queue for transfer jobs (Cloudflare Queues). The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.
Data processed: with every request Cloudflare processes technically necessary connection data: IP address, date and time, the address requested, the amount of data transferred, referrer, browser and operating system details, and details derived from them such as the country.
Purpose: delivering the website and the customer area, stability, defence against attacks and abuse, error analysis.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure, fast and working service.
Abuse protection: we limit requests that write data to our server, and sign-in attempts, to 30 per minute per IP address, submissions of forms that send an e-mail to 3 per minute, and requests in the customer area to 600 per minute. The IP address serves only as a short-lived counter key for a 60-second window. We do not store it.
Location: we created our database and our queue in Cloudflare's EU jurisdiction. According to Cloudflare, it then stores and processes this data only in the EU. The server code itself runs on Cloudflare's global network, usually in a data centre close to the requester; data may also be processed outside the EU there.
Cookies: we set no cookies on the public pages; the customer area's cookies are described under Customer area and Sign in with Google. Cloudflare may set technically necessary security cookies (for example __cf_bm or cf_clearance) to protect against attacks and automated access, for instance when bot protection checks a request or when we temporarily switch on a security check during an attack.
Processing on our behalf and third countries: Cloudflare processes the data as our processor under Art. 28 GDPR on the basis of the Cloudflare Data Processing Addendum. Data may be transferred to the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework, so the transfer relies on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). The contract also contains the EU standard contractual clauses (Art. 46(2)(c) GDPR) in case the decision lapses. Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/
4. Server logs and backups
Server logs: our server code writes logs for troubleshooting. They contain no IP addresses. Cloudflare keeps them for at most 7 days and then deletes them automatically. We do not use them to identify people.
Backups and restore: our database at Cloudflare (Cloudflare D1) keeps a continuous version history that can reset the data to an earlier point in time ("Time Travel"). This is part of the service and cannot be switched off; the window is at most 30 days. The database holds:
- the customer accounts, members, sessions and audit logs of the customer area (Customer area and Sign in with Google),
- our customers' templates, rules, campaigns and transfer results (Processing on behalf of our customers),
- requests sent through the contact form,
- our usage counters, as daily totals without any personal reference.
When we delete an entry (automatically through the daily deletion job, at your request, or because a customer deletes its organisation), it is gone from the database at once; it may remain in this version history for up to 30 days until the window has passed. We access the history only to restore operation after a technical fault, never to reuse deleted data. If we actually have to reset the data, we repeat the deletions made in the meantime immediately afterwards.
E-mail logs: Cloudflare also logs our e-mail traffic: the sending of our e-mails (Cloudflare Email Service) and the forwarding of e-mails you write to an address at @eigenlaut.app (Cloudflare Email Routing, Contact). These logs necessarily contain the e-mail addresses involved. We can view them in the Cloudflare dashboard for the last 30 days; Cloudflare publishes no retention period for these logs.
5. Fonts and external content
We use no Google Fonts and no other external font network. All fonts are on our own server. We embed no maps, videos, social media plugins or captchas from third parties.
Data goes to third parties only when you click a link to another website yourself, sign in with Google in the customer area (Customer area and Sign in with Google) or take out a subscription (Payment through Stripe).
Images in a signature template, such as a company logo, are loaded in the customer area's preview from the address the customer entered in the template. The customer chooses this address, not us.
6. Storage in your browser (local storage)
Our pages store a few items in your browser's local storage (local storage or session storage). These are not cookies. The items stay on your device and are not sent to us automatically.
| Entry | Content and purpose | Retention |
|---|---|---|
eigenlaut:theme | your choice between the light and dark design | until you clear the browser storage |
eigenlaut:consent | your choice in the cookie settings (time of the choice and, where offered, statistics on or off), without a user ID. Stored only once you make a choice | until you change your choice or clear the browser storage |
eigenlaut:locale | only in the customer area: your choice of language (German or English) | until you clear the browser storage |
eigenlaut:admin:token | only in the operator's administration: access key, in session storage | until the tab is closed |
Legal basis: Section 25(2) no. 2 TDDDG. This storage is strictly necessary for the website to provide the functions you explicitly use: respecting your display settings and your choice in the cookie settings. No consent is needed for it.
Deleting: you can clear the site storage for eigenlaut.app in your browser's settings.
7. Customer area and Sign in with Google
Employees of our customers use the customer area (/app/) to manage signatures. Signing in is only possible with an account of a Google Workspace organisation, not with a personal Google account.
Sign in with Google: when you click "Sign in with Google", your browser takes you to Google. The sign-in itself happens at Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); your organisation's agreements with Google and Google's privacy policy apply to it: https://policies.google.com/privacy. Our server then receives a signed sign-in token ("ID token") from Google. We request only the scopes openid and email. From the token we use:
- your e-mail address and the confirmation that Google has verified it,
- the domain of your Google Workspace organisation, to find your organisation in our records,
- technical details with which we check that the token is genuine, meant for us and still valid.
If your address belongs to an organisation that has already connected Eigenlaut, at every sign-in we use that organisation's connection to ask Google's directory whether your address still belongs to that organisation and whether you are a super administrator there. If you are not yet on its member list, you join only as a super administrator, and then as an administrator.
If the organisation has withdrawn our access in the Google Admin console, or the person in whose name we read the directory no longer exists, Google cannot answer these questions. Then only people already on the member list can sign in, with their stored role; nobody can join until the access is restored.
What we store: on your organisation's member list, your e-mail address, your role (administrator, editor or viewer), who added you and when, and the time of your last sign-in. We record each sign-in in your organisation's audit log (Audit log).
Cookies: for signing in we set two cookies, both only for our own address, only over HTTPS and not readable by scripts:
| Cookie | Content and purpose | Retention |
|---|---|---|
__Host-login | a random value that binds the sign-in to your browser, so nobody can slip you someone else's sign-in | 10 minutes |
__Host-session | a random value as the session key; we keep only a check value (hash) of it | 12 hours, or until you sign out |
During sign-in we also store technical check values (state, verifier, one-time value and the page you return to afterwards), but nothing about you as a person; they are valid for at most 10 minutes and are deleted at once when sign-in completes, otherwise by the daily deletion job. A session is valid for at most 12 hours; after that the daily deletion job removes the entry. When you sign out, we delete the session at once. If your member entry is removed, we delete your sessions as well.
Legal basis for the cookies: Section 25(2) no. 2 TDDDG. Both cookies are strictly necessary for us to provide the customer area you explicitly use: secure sign-in and staying signed in. No consent is needed for them.
Purpose and legal basis of the processing: we process these details to give you secure access to your organisation's account, to enforce the rights of your role and to detect abuse. If you are our contracting party yourself, the legal basis is Art. 6(1)(b) GDPR. If you use the customer area for your employer, who is our customer, it is Art. 6(1)(f) GDPR; our legitimate interest is to perform the contract with your employer securely and to give access only to authorised people.
Retention: your member entry remains until an administrator of your organisation removes you or the organisation is deleted. We delete an organisation that was never connected to Google automatically 30 days after registration.
Acceptance of the terms and the data processing agreement: at setup we store who accepted the terms and the data processing agreement (e-mail address), when, and which version. This lets us prove that, and on which terms, the contract was concluded. We keep the record for the term of the contract and after that, even if the organisation is deleted earlier, until the longer of two periods has passed:
- 6 years from the end of the calendar year of the acceptance: the acceptance is the declaration by which the contract was concluded and, as a business letter received, must be kept that long (Section 257(1) no. 2, (4) and (5) HGB, Section 147(1) no. 2, (3) and (4) AO); legal basis Art. 6(1)(c) GDPR.
- 3 years from the end of the calendar year in which the contract ended: as a rule, claims under the contract can be brought for that long (Sections 195 and 199(1) BGB), and for that long we must be able to show which terms applied; legal basis Art. 6(1)(f) GDPR, our legitimate interest in this proof.
During the contract the legal basis is Art. 6(1)(f) GDPR, our legitimate interest in this proof; if you are our contracting party yourself, Art. 6(1)(b) GDPR.
Deletion after the end of the contract: if no subscription is running when the trial ends, or the subscription ends, we delete the organisation with all its data 30 days later with the daily deletion job, the member entries included, unless a subscription starts by then (terms). The only exceptions are the record of the contract's acceptance and the trial record. Until then the members can still sign in; Eigenlaut no longer transfers signatures.
One trial only: each Google Workspace organisation gets the free trial once. For this, at setup we store a check value (SHA-256 hash) of the organisation's customer number at Google and the end of its trial, with no link to any person or to our customer account. The entry remains after the organisation is deleted and is deleted automatically 365 days after the trial ended. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is preventing misuse of the free trial by signing up again.
Audit log
Every change in the customer area, every sign-in and every transfer run is recorded in the organisation's audit log: the time, who acted (an e-mail address, "system", "schedule" or "Stripe"), what happened, to what (such as a template's ID or a member's address) and a short technical detail. It contains no signature content and no directory details beyond the address concerned. The organisation's administrators can view and download the log.
Purpose and legal basis: accountability and security: who changed what and when? Art. 6(1)(f) GDPR; our legitimate interest, and our customers', is to be able to prove changes to the signatures of a whole organisation and to investigate abuse.
Retention: 400 days, then the daily deletion job removes the entry; earlier when the organisation is deleted.
8. Payment through Stripe
Customers take out paid subscriptions through Stripe. When an administrator clicks "Continue to payment" or "Open the customer portal" in the customer area, we forward them to a Stripe page. You enter the billing address, the e-mail address for invoices, the VAT ID and the payment method directly at Stripe; we receive no card or account details.
What we send to Stripe: your organisation's internal ID, the billing interval chosen (monthly or yearly), the number of managed mailboxes and, after the first purchase, the customer number at Stripe.
What we receive from Stripe and store: the customer number and the subscription number at Stripe and the status of the subscription (such as active, trial, payment overdue, cancelled). Stripe notifies us of changes with signed messages; we keep their IDs for 30 days so that no message is processed twice.
Purpose and legal basis: concluding and billing the contract, Art. 6(1)(b) GDPR, and meeting our tax and commercial-law obligations, Art. 6(1)(c) GDPR.
Provider: Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland. Stripe processes the data for payment processing as our processor and, for its own purposes such as fraud prevention and legal obligations to check payments, as a controller in its own right. Data may be transferred to Stripe, Inc. in the USA. Stripe's privacy policy: https://stripe.com/privacy
Retention: the customer and subscription numbers remain stored as long as the organisation exists. We keep invoices and accounting records for the statutory periods, currently 8 years for invoices (Section 147 AO, Section 257 HGB).
9. Processing on behalf of our customers
Eigenlaut sets consistent Gmail signatures for companies that use Google Workspace. For this we process data of people who belong to a customer's Google Workspace organisation on that customer's behalf (Art. 28 GDPR). The customer is the controller for this processing; our duties are set out in the data processing agreement.
How we get access: a super administrator of the customer allows our service account access in the Google Admin console ("domain-wide delegation"), for these three scopes only:
- read users in the directory (
admin.directory.user.readonly), - read group memberships (
admin.directory.group.member.readonly), only for rules and campaigns that refer to groups, - read and change a mailbox's Gmail settings (
gmail.settings.basic); we use it to change the signature and nothing else.
We have no access to e-mail content, calendars or files, and no write access to the directory. The customer can withdraw the access in the Admin console at any time.
Data processed: from the directory, the details the customer's templates use: first and last name, e-mail address and other sending addresses, job title, department, phone and mobile number, work location, custom fields the customer created, organisational unit, group memberships and the account's status (suspended, archived, administrator); from Gmail, the current signature of each sending address.
What we store of it: we do not store names, job titles, phone numbers or signature content permanently. We read them from Google afresh in every transfer run. Until a run has processed them, they sit in our queue at Cloudflare, where Cloudflare deletes unprocessed jobs after 4 days at the latest. We store permanently only:
- per run and address, the result (updated, unchanged, skipped, failed with a reason): 90 days,
- the runs themselves, with time, type and who started them: 400 days,
- per sending address, a check value (hash) of the signature last written and of the one found in Gmail, so we do not rewrite unchanged signatures: as long as the customer account exists,
- the names of organisational units, departments and e-mail domains from the directory, as a choice list for rules: as long as the customer account exists.
Your rights as an employee of a customer: please contact your employer, who is the controller for this processing. If your request reaches us, we pass it on to your employer and help them answer it.
Google is not our sub-processor here: the data sits in the customer's Google Workspace, which the customer has agreed with Google itself. We read and write it through Google's interfaces on the customer's behalf. Details: data processing agreement.
10. Contact by e-mail and form
Form: if you write to us through the contact form, we process what you enter: name, e-mail address, optionally a phone number and your message, plus the time of the request and your confirmation of the privacy notice. We do not store your IP address. We store the request in a database at Cloudflare (Cloudflare D1) and deliver it to our own mailbox by e-mail through Cloudflare, with your e-mail address as the reply-to address.
Purpose and legal basis: handling your request and, where applicable, preparing a contract, Art. 6(1)(b) GDPR. Otherwise, for example for general questions or when you write for a company without becoming a contracting party yourself: Art. 6(1)(f) GDPR. Our legitimate interest is answering requests.
Retention: the request is deleted from the database automatically after 180 days (daily deletion job). We keep e-mails while the request is being handled. If a contract is concluded, the statutory retention periods apply, in particular those under tax law.
E-mail: if you send us an e-mail, we process your address and the content to reply, on the same legal bases. Cloudflare Email Routing forwards e-mails to addresses at @eigenlaut.app to our mailbox. Cloudflare states that it neither stores the forwarded e-mails nor accesses their content. Our mailbox is hosted by Gmail. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (DPF); the transfer relies on the European Commission's adequacy decision for the DPF. More information: https://policies.google.com/privacy
Providing these details is voluntary. Without an e-mail address or phone number, however, we cannot reply to you.
11. Anonymous usage counters
In the customer area our server counts how often certain events occur, such as visits, as a daily total per event. The customer area sends a counting request to our server that contains only the event's name; it recognises a visit without storing anything on your device. We set no cookies for this, create no user ID and store no IP addresses.
Only daily totals that cannot be linked to a person are stored. Where connection data arises briefly during transmission, Hosting applies (Art. 6(1)(f) GDPR).
12. Our social media profiles
We have profiles on:
- LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland), privacy policy: https://www.linkedin.com/legal/privacy-policy
When you visit or interact with our profiles, the operator processes your data under its own privacy terms and usually sets cookies; we have no influence on this.
Statistics: some operators give us aggregated statistics about our profiles (page insights). We see no personal data of individual visitors. We are joint controllers with the operator for these statistics (Art. 26 GDPR). The agreements:
Under them, the operator takes primary responsibility and handles your rights; you can also contact us.
Messages and comments: if you write to us through a profile, we process your name, your profile and your message to reply.
Legal basis is our legitimate interest in presenting ourselves and communicating with interested people (Art. 6(1)(f) GDPR). The operators may transfer data to the USA; according to them, they rely on the EU-U.S. Data Privacy Framework or EU standard contractual clauses.
Publishing through our own applications
We plan and publish our posts with Postiz, software we run ourselves (access through Cloudflare, Hosting), and with our own developer applications on the networks named above. These applications are connected only to our own profiles. Only data of these profiles is processed: access keys, our posts and images, and aggregated statistics. We do not retrieve data of visitors, followers or commenters through them.
Removing access and deleting data: anyone who gave one of our applications access can remove it in the network's settings. Please send questions and deletion requests to contact@eigenlaut.app (Your rights).
13. Recipients
Personal data is received only by:
- Cloudflare as hosting provider and processor (Hosting),
- Google, when you sign in with Google (Customer area and Sign in with Google), and as the provider of Google Workspace when we write signatures into a customer's Workspace on the customer's behalf (Processing on behalf of our customers),
- Stripe for subscriptions and payments (Payment through Stripe),
- the provider of our e-mail mailbox, for e-mails to us (Contact),
- the operators of the social networks, when you use our profiles (Social media profiles),
- authorities, where we are legally obliged.
We do not sell data.
14. Retention
We store personal data only as long as we need it for the purpose. Overview:
| Data | Retention |
|---|---|
| Server logs | at most 7 days (Server logs and backups) |
| Deleted entries in the database's version history | up to 30 days after deletion (Server logs and backups) |
| E-mail logs at Cloudflare | no published period; we can view them for 30 days (Server logs and backups) |
Sign-in (__Host-login) | cookie 10 minutes; the technical check values are valid for 10 minutes and are deleted at once when sign-in completes, otherwise by the next daily deletion job (Customer area and Sign in with Google) |
Session (__Host-session) | valid for at most 12 hours, then deleted by the next daily deletion job; at once on sign-out (Customer area and Sign in with Google) |
| Member entry | until an administrator removes it or the organisation is deleted (Customer area and Sign in with Google) |
| Organisation never connected to Google | 30 days after registration (Customer area and Sign in with Google) |
| Organisation after the trial or the subscription ended, without a new subscription | 30 days, then deleted with all its data (Customer area and Sign in with Google) |
| Record of the acceptance of the terms and the data processing agreement (who, when, which version) | term of the contract, then 6 years from the end of the year of the acceptance or, if later, 3 years from the end of the year in which the contract ended (Customer area and Sign in with Google) |
| Trial record (hash of the Google customer number, end of the trial) | 365 days after the trial ended, also after the organisation is deleted (Customer area and Sign in with Google) |
| Audit log | 400 days (Audit log) |
| Results per address and transfer run | 90 days (Processing on behalf of our customers) |
| Transfer runs | 400 days (Processing on behalf of our customers) |
| Directory details in the queue | until processed, at most 4 days (Processing on behalf of our customers) |
| Signature check values, templates, rules, campaigns | as long as the organisation exists (Processing on behalf of our customers) |
| IDs of Stripe notifications | 30 days (Payment through Stripe) |
| Invoices and accounting records | statutory period, currently 8 years (Payment through Stripe) |
| Contact form requests | 180 days in the database, then deleted automatically (Contact) |
| E-mails to us | while we handle the request; for a contract, the statutory retention periods (Contact) |
| Entries in your browser's local storage | until you change or delete them (Storage in your browser) |
When a customer deletes its organisation in the customer area, we delete all of the organisation's data from the database at once, including the members, the audit log and the transfer results; only the record of the contract's acceptance and the trial record stay until their periods end. When the trial ends without a subscription or a subscription ends and the customer does not delete its organisation itself, we delete it 30 days after the end of the contract with the daily deletion job, unless a subscription starts by then (data processing agreement).
15. Your rights
You have the right to:
- access (Art. 15 GDPR),
- rectification (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- withdraw consent with effect for the future (Art. 7(3) GDPR).
Right to object (Art. 21(1) GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation.
An informal message to contact@eigenlaut.app is enough. For data we process on a customer's behalf, please contact the customer (Processing on behalf of our customers).
16. Complaints to a supervisory authority
You can complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, your place of work or the alleged infringement. The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
Postal address: Postfach 1349, 91504 Ansbach, Germany
Phone: +49 981 180093-0
E-mail: poststelle@lda.bayern.de
Online complaint: https://www.lda.bayern.de/de/beschwerde.html
17. No automated decisions
We make no automated decisions within the meaning of Art. 22 GDPR and create no profiles. Which signature a person receives is decided by the rules the customer sets.
18. Changes
If our service or the law changes, we update this policy. The version published here applies.