Privacy Policy

This is a translation provided for convenience. Only the German version is legally binding.

This privacy policy covers the website (home page, demo, design partner inquiry, registration) and the Collid application that customers sign in to.

1. Controller

No data protection officer has been appointed, as the legal requirements for one (Section 38 BDSG, German Federal Data Protection Act) are not met. If you have questions about data protection, please contact us at the address above.

2. Summary

• We do not use analytics or tracking tools and do not show advertising.
• Fonts and scripts are served from our own server, so loading our pages does not send your IP address to third parties such as Google.
• We only use strictly necessary cookies, which is why there is no cookie banner.

3. Hosting

The website and the application are hosted by: Netcup GmbH, Hans-Böckler-Allee 7, 30173 Hannover, Deutschland. The host processes all data arising from visits and use on our behalf. We have concluded a data processing agreement with it under Art. 28 GDPR. The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR).

4. Server log files

With every request, the web server automatically logs: IP address, date and time, the requested address, HTTP status code, amount of data transferred, referrer URL and the user agent sent by your browser. We need this data to keep the service running and to detect and prevent attacks (Art. 6(1)(f) GDPR). The log files are deleted after 7 days.

In addition, for operating statistics and attack detection, the application records for each request the time, the request method, the path, the status code and the country of origin derived from the IP address. The IP address itself is not stored, only a hash of it computed with a secret key. The country is determined using a database stored locally on our server; no data is passed to third parties for this. For sign-in attempts we also store the email address entered and whether the attempt succeeded. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the security of the application and the customer data stored in it.

5. Protecting our forms against abuse

To prevent automated mass sign-ups, we count per IP address how often our forms are submitted. The counter is deleted automatically after no more than 24 hours (Art. 6(1)(f) GDPR).

6. Cookies and local storage

We only use the following strictly necessary storage:

• Website session cookie (website_session): protects our forms against forged requests (CSRF). It is deleted when you close your browser.
• Application session cookie: keeps you signed in after login. The session ends when you sign out or after one hour of inactivity.
• “Remember me”: only if you choose this option when signing in, we set a cookie that keeps you signed in until you sign out (at most one year).
• Trusted device: only if you choose “Trust this device for 30 days” during two-factor sign-in, a cookie remembers for 30 days that you do not need to enter a code on this device.
• Language choice (lang_override): only if a page is opened with the ?lang= parameter, a cookie remembers the chosen language until you close your browser. Otherwise the language follows your browser settings.
• Display mode (darkMode in your browser’s local storage): remembers whether you chose light or dark mode. The value never leaves your device.

This storage is strictly necessary to provide the service you requested and therefore does not require consent (Section 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act).

7. Design partner inquiries

When you use the “Become a design partner” form, we process your name, your company, your email address and your message in order to answer your inquiry and prepare a possible collaboration (Art. 6(1)(b) GDPR). The details are not stored in the application but forwarded to us by email. We delete them once the inquiry has been dealt with and no collaboration follows; statutory retention obligations remain unaffected.

The same applies if you email us directly.

8. Demo access

For a demo account we process your name, your email address and a password, which we only store as a hash. We may use the email address to contact you once and ask about your impressions. The legal basis is Art. 6(1)(b) GDPR. The demo account and all data created in it are deleted automatically every night at 03:00 (UTC). We are notified of new demo accounts by an email containing name and email address; we delete this message after three months at the latest.

9. Customer accounts and use of the application

When you register, we process your name, email address, the name of your organization, a password (stored only as a hash) and your browser language, so that we can send you emails in your language. If you set up two-factor sign-in, we store the secret required for it. We send you emails needed for your account, for example to confirm your address or to reset your password. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). The data is deleted when the account is deleted.

If you sign in with Microsoft or Google, the provider sends us your name and email address. Processing by Microsoft or Google is governed by their privacy policies.

10. Data that customers process in Collid

Customers connect Collid to their own services (e.g. Entra ID, Google Workspace, Slack, GitHub) and use it to manage their employees’ user accounts. The respective customer is the controller for this data; we process it solely on the customer’s behalf under a data processing agreement (Art. 28 GDPR). If you are an employee of a customer and have questions about your data, please contact your employer.

11. Email

We run our own mail server for sending and receiving email. It runs on a rented server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland. The provider processes the data on our behalf; we have concluded a data processing agreement with it under Art. 28 GDPR. No external email service provider is involved. The data processed comprises sender and recipient addresses, time, subject and content of messages, as well as technical log data of the mail server, such as the IP address of the delivering server.

We use the mail server to send you emails about your account (Art. 6(1)(b) GDPR) and to receive and answer your inquiries (Art. 6(1)(b) or (f) GDPR). How long we keep messages depends on their purpose and is described in the sections above. The mail server’s log data serves delivery and the prevention of spam and abuse (Art. 6(1)(f) GDPR) and is deleted after 7 days.

12. Your rights

You have the right at any time to

• access the data we hold about you (Art. 15 GDPR),
• have inaccurate data corrected (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR).

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence or place of work (Art. 77 GDPR).

13. Obligation to provide data, automated decisions

You are not obliged to provide us with data. Without the details marked as required, however, we cannot process your inquiry or create an account. No automated decision-making, including profiling, takes place.

Last updated: October 2026