Privacy Policy

Last updated: 15 July 2026

1. Controller

Oliver Marquardt – Business Consultant
Kleine Witschgasse 8, 50676 Cologne, Germany
hello@metadancer.de

2. Data we process

• Account and contact data: email address, password hash, verification status and role.
• Optional profile and billing data: name, company and postal address.
• Content data: uploaded images, embedded metadata, batch notes, release files, generated metadata and saved workspaces.
• Contract and payment data: selected bundle, credits, transaction status, PayPal order/reference data and invoices. We do not receive your full payment-card credentials.
• Technical data: authentication session identifiers and ordinary server/security log data such as request time, requested resource, IP address and browser information where recorded by the hosting infrastructure.
• Communication data: messages and delivery records for verification, password, account and invoice emails.

3. Purposes and legal bases

• Providing accounts, image analysis, saved workspaces, credit purchases and support: Article 6(1)(b) GDPR.
• Invoices, accounting and tax retention: Article 6(1)(c) GDPR.
• Security, fraud prevention, service stability and assertion or defence of claims: Article 6(1)(f) GDPR; our legitimate interests are operating a secure and reliable service and protecting legal rights.
• Website traffic measurement with Google Analytics: your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be refused or withdrawn prospectively at any time through the Privacy settings control without affecting the lawfulness of earlier processing.

4. Image analysis and service providers

When you request analysis, the relevant image, embedded metadata and instructions are transmitted to OpenAI for automated processing. We also use hosting/infrastructure providers, Resend for transactional email and PayPal for checkout and payment processing. These recipients process data only as necessary for their respective function and may act as processors or independent controllers. When PayPal is used, PayPal may receive checkout and transaction data as well as technical information such as your IP address, browser and device information, identifiers and interactions with the checkout component. PayPal provides further information in its Privacy Statement.

5. International transfers

Some providers may process data outside the European Economic Area, particularly in the United States. Where required, transfers are based on an adequacy decision (including an applicable EU–US Data Privacy Framework certification) or appropriate safeguards such as the European Commission's Standard Contractual Clauses. Details or copies of relevant safeguards may be requested from us.

6. Cookies and similar technologies

Metadancer uses a strictly necessary authentication cookie named metadancer_session. It is HttpOnly, SameSite=Lax, expires after up to 30 days and is marked Secure when the service is accessed over HTTPS. It keeps you signed in and is necessary to provide your account. Your analytics choice is stored locally in your browser so that we can respect it on later visits.

Google Analytics

With your consent, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how visitors find and use Metadancer and to improve the service. Our measurement ID is G-YCNBMMRFZW. Google Analytics is not loaded and no analytics information is sent to Google unless you select “Accept analytics”. We have disabled Google signals and advertising-personalisation signals.

If accepted, Google Analytics may process visited pages, approximate location derived from the IP address, browser and device information, referrer, timestamps, interactions and identifiers stored in cookies such as _ga. We do not intentionally send names, email addresses, uploaded content or other account form data to Google Analytics. Google may process data in the United States. Where required, transfers rely on an applicable adequacy decision, including the EU–US Data Privacy Framework, or appropriate safeguards such as Standard Contractual Clauses. For more information, see Google’s Privacy Policy.

You can reject analytics without any disadvantage. Use the “Privacy settings” button available on each page to grant or withdraw consent. Withdrawal stops future analytics loading and removes accessible Google Analytics cookies from this site.

PayPal

The PayPal checkout component is loaded only after you select a credit bundle and choose to continue to checkout. When it loads, PayPal may use cookies or similar technologies and process technical identifiers to provide the payment interface, recognize PayPal users, prevent fraud and complete the transaction. PayPal is responsible for its own processing as described in its Privacy Statement.

7. Storage periods

Account, workspace and uploaded-content data are stored while the account or relevant workspace is active and are deleted when no longer needed, subject to backups, open claims and legal obligations. Individual images can be removed from a workspace. Authentication sessions expire after 30 days. Verification links generally expire after 24 hours and password-change links after one hour. Invoice, payment and accounting records are retained for the periods required by German commercial and tax law. Security logs are retained only as long as reasonably necessary for security and troubleshooting. Google Analytics user-level and event-level data are configured for a retention period of 14 months; aggregated reports may remain available for longer. Your browser retains the analytics consent choice until you change it or clear local site data.

8. Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction, data portability and objection. Where processing relies on legitimate interests, you may object on grounds relating to your situation. You may withdraw consent prospectively. Contact hello@metadancer.de to exercise these rights.

9. Complaints

You may lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, workplace or the alleged infringement. The supervisory authority responsible for our Cologne establishment is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).

10. Required data and automated decisions

Account and transaction fields marked as required are necessary to provide the relevant service or complete a purchase. Without them, we may be unable to create an account or contract. Automated image analysis produces content suggestions but does not make decisions that have legal or similarly significant effects on you.

11. Changes

We may update this notice when the service, providers or law changes. The current version is published here with its revision date.