Privacy Policy

Last updated: 14 July 2026

1. Controller

Oliver Marquardt – Business Consultant
Kleine Witschgasse 8, 50676 Cologne, Germany
hello@metadancer.de

2. Data we process

• Account and contact data: email address, password hash, verification status and role.
• Optional profile and billing data: name, company and postal address.
• Content data: uploaded images, embedded metadata, batch notes, release files, generated metadata and saved workspaces.
• Contract and payment data: selected bundle, credits, transaction status, PayPal order/reference data and invoices. We do not receive your full payment-card credentials.
• Technical data: authentication session identifiers and ordinary server/security log data such as request time, requested resource, IP address and browser information where recorded by the hosting infrastructure.
• Communication data: messages and delivery records for verification, password, account and invoice emails.

3. Purposes and legal bases

• Providing accounts, image analysis, saved workspaces, credit purchases and support: Article 6(1)(b) GDPR.
• Invoices, accounting and tax retention: Article 6(1)(c) GDPR.
• Security, fraud prevention, service stability and assertion or defence of claims: Article 6(1)(f) GDPR; our legitimate interests are operating a secure and reliable service and protecting legal rights.
• Optional processing based on consent, if introduced: Article 6(1)(a) GDPR. Consent may be withdrawn prospectively at any time.

4. Image analysis and service providers

When you request analysis, the relevant image, embedded metadata and instructions are transmitted to OpenAI for automated processing. We also use hosting/infrastructure providers, Resend for transactional email and PayPal for checkout and payment processing. These recipients process data only as necessary for their respective function and may act as processors or independent controllers. PayPal provides its own privacy information during checkout.

5. International transfers

Some providers may process data outside the European Economic Area, particularly in the United States. Where required, transfers are based on an adequacy decision (including an applicable EU–US Data Privacy Framework certification) or appropriate safeguards such as the European Commission's Standard Contractual Clauses. Details or copies of relevant safeguards may be requested from us.

6. Cookies

Metadancer uses a strictly necessary authentication cookie named metadancer_session. It is HttpOnly, SameSite=Lax, expires after up to 30 days and is marked Secure when the service is accessed over HTTPS. It keeps you signed in and is necessary to provide your account. We currently do not use analytics or advertising cookies.

7. Storage periods

Account, workspace and uploaded-content data are stored while the account or relevant workspace is active and are deleted when no longer needed, subject to backups, open claims and legal obligations. Individual images can be removed from a workspace. Authentication sessions expire after 30 days. Verification links generally expire after 24 hours and password-change links after one hour. Invoice, payment and accounting records are retained for the periods required by German commercial and tax law. Security logs are retained only as long as reasonably necessary for security and troubleshooting.

8. Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction, data portability and objection. Where processing relies on legitimate interests, you may object on grounds relating to your situation. You may withdraw consent prospectively. Contact hello@metadancer.de to exercise these rights.

9. Complaints

You may lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, workplace or the alleged infringement. The supervisory authority responsible for our Cologne establishment is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).

10. Required data and automated decisions

Account and transaction fields marked as required are necessary to provide the relevant service or complete a purchase. Without them, we may be unable to create an account or contract. Automated image analysis produces content suggestions but does not make decisions that have legal or similarly significant effects on you.

11. Changes

We may update this notice when the service, providers or law changes. The current version is published here with its revision date.

Important: Before launch, confirm the production host, exact processor contracts, transfer mechanisms and retention periods, then have this notice reviewed for the final data flow.