Privacy Policy

The controller within the meaning of the GDPR is:

Tristan Eberhardt
Dietrich-Bonhoeffer-Str. 15
73732 Esslingen am Neckar, Germany
Email: info@kamire.de

For data protection requests, please use the same email address.

We respond to requests regarding your rights (Art. 15–22 GDPR) within 30 days.

• Account data (email, display name, password hash): for authentication and providing the app. Legal basis: Art. 6 (1) b GDPR (performance of contract). Storage: until account deletion.
• Content data (materials, batches, formulations, productions, community posts, comments, reactions): to provide core features. Legal basis: Art. 6 (1) b. Storage: until you delete it or your account.
• Payment data (subscription status, Stripe customer ID): to process the Premium subscription. Legal basis: Art. 6 (1) b. Storage: statutory retention periods (typically 10 years for invoice data).
• Server logs (IP address, user agent, timestamp): for security and error analysis. Legal basis: Art. 6 (1) f (legitimate interest). Storage: max. 30 days.
• Email contact (email address, message content): to handle your request. Legal basis: Art. 6 (1) b or f GDPR. Storage: until the request is resolved and any statutory retention periods expire.
• Community content (posts, comments, reactions, display name): visible to all other users of the platform after publishing. Legal basis: Art. 6 (1) b GDPR. You can delete your own posts at any time.
• OAuth login (Google / Apple ID, email, optionally name): when you sign in via Google or Apple, the provider transmits the required profile data to us to create the account. Legal basis: Art. 6 (1) b GDPR.
• Internal usage evaluation (signup date, last login, number of materials/formulations/productions created, time of last activity, setup steps reached such as tutorial started/finished or first material): used internally only and without cookies, to understand which features are used and improve the app. The content of your formulations is not evaluated for this purpose and no data is shared with third parties. Legal basis: Art. 6 (1) f GDPR (legitimate interest in product improvement); you may object at any time. Storage: until account deletion.
• Feedback (category, message text, link to your account): when you use the in-app feedback form. Legal basis: Art. 6 (1) f GDPR (improving the app). Storage: until resolved, at the latest until account deletion.
• Service and reminder emails (email address, display name, send log): a one-time onboarding email after signup and notices before your trial month ends. These are only sent while the "Receive email notifications" setting in your profile is enabled (Art. 6 (1) a GDPR, consent; account-related notices additionally Art. 6 (1) b GDPR). We send no marketing emails and use no tracking pixels; opens and clicks are not measured. You can object at any time in your profile or via the unsubscribe link in every email. Send log storage: until account deletion.

Providing account data is required to use the app (Art. 13 (2) (e) GDPR). Without it, no account can be created. All other information is voluntary.

Strictly necessary storage (login session, language preference) is used without consent under § 25 (2) No. 2 TDDDG (formerly TTDSG). Analytics and marketing tools are loaded only after your active consent via our cookie banner (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). Consent is voluntary and may be withdrawn at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal:

We use the following service providers, with whom data processing agreements (DPAs) are in place:

• Lovable Cloud (Supabase) hosting, database, authentication. Servers in the EU. Legal basis: Art. 6 (1) b / f.
• Cloudflare, Inc. (USA) edge hosting / CDN for the app. Transfer to the US safeguarded by Standard Contractual Clauses (SCCs). Legal basis: Art. 6 (1) f GDPR (secure and performant delivery).
• Google Ireland Ltd. ("Continue with Google" sign-in) if you choose OAuth sign-in, authentication data is exchanged with Google. Legal basis: Art. 6 (1) b GDPR. Third-country transfers to the US may occur (SCCs, EU-US Data Privacy Framework).
• Apple Distribution International Ltd., Ireland ("Sign in with Apple") same as above. Legal basis: Art. 6 (1) b GDPR.
• Stripe Payments Europe Ltd., Dublin, Ireland payment processing for the Premium subscription. Processing may involve transfer to the US, safeguarded by Standard Contractual Clauses (SCCs). Details: stripe.com/privacy.
• Plausible Analytics (Plausible Insights OÜ, Estonia) cookieless, anonymized reach measurement. EU servers. Loaded only with consent. Legal basis: Art. 6 (1) (a) GDPR.
• Google Ireland Ltd. (Google Ads conversion tracking) measuring ad conversions. Transfer to Google LLC (USA), safeguarded by SCCs and EU-US Data Privacy Framework. Loaded only with consent. Legal basis: Art. 6 (1) (a) GDPR. Details: policies.google.com/privacy.
• Lovable AI Gateway / Firecrawl when you trigger the IFRA limit check, the entered CAS number is sent to Firecrawl (research on ifrafragrance.org) and an LLM provider (Google/OpenAI) for structuring. No personal data is transmitted, but third-country transfers to the US may occur (SCCs). Legal basis: Art. 6 (1) b GDPR.

You have the following rights:

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure / "right to be forgotten" (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection (Art. 21)
• Complaint to a supervisory authority (Art. 77) competent: State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, baden-wuerttemberg.datenschutz.de

In the Account area you can at any time:

• export your data as a ZIP (Art. 20)
• schedule your account for deletion (30-day grace period, Art. 17)

Transmission is encrypted via TLS. Passwords are stored only as hashes. Database access is isolated per user account through Row-Level Security.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

We may adjust this privacy policy when features or the legal situation change. The current version is always available on this page.