Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

thinver GmbH
Jörg-Syrlin-Straße 6
73079 Süßen
Germany

Email: info@thinver.com
Phone: +49 160 8 33 88 27

2. Data collected and purposes of processing

2.1 Idea description and uploaded files

When you submit an idea, we process the description you enter and any files you upload (PDF, Word, Excel, PowerPoint, images). This data is used exclusively to create the AI analysis and the final report.

• Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
• Retention period: 90 days after creation, then automatic deletion

2.2 Email address (optional)

Providing your email address is voluntary and serves only to send you the report link. It is not used for marketing purposes without your express consent.

• Legal basis: Art. 6(1)(a) GDPR (consent)

2.3 Payment data

Payments are processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland). We do not store any credit card or bank account details ourselves. Stripe processes payment data in accordance with its own privacy policy (stripe.com/privacy). We only receive a confirmation of successful payment and tax-relevant invoice data.

• Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
• Retention period: 10 years in accordance with statutory tax retention obligations

2.4 Server logs and technical data

Each time our website is accessed, the IP address, date and time, requested URL, browser type and operating system are logged automatically. This data is necessary for technical operation and security and is not merged with other data sets.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
• Retention period: 30 days

3. Use of AI services

To create the idea analysis, we use the API of Anthropic, PBC (548 Market St, San Francisco, CA 94104, USA). The idea descriptions and document contents you enter are transmitted to the Anthropic API for processing. Anthropic processes this data in accordance with its privacy policy. We have concluded a data processing agreement (DPA) with Anthropic.

• Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
• Transfer to a third country: USA – Standard Contractual Clauses pursuant to Art. 46 GDPR

4. Data processing by third parties

To send emails, we use the Resend service provided by Plus Five Five, Inc. (2261 Market Street #5039, San Francisco, CA 94114, USA). Via Resend, we send the confirmation email and the issues of our newsletter, emails relating to non-disclosure agreements (NDAs) and internal notifications to our team, for example about newly submitted ideas, bookings and data protection requests. In doing so, the recipients' email addresses and the content of the respective email are transmitted to Resend; depending on the email, this includes in particular name and company, the signed NDA document or, in internal notifications, your email address and excerpts of your idea description and the analysis. A data processing agreement (DPA) is in place with Resend as part of Resend's terms of service.

• Legal basis: Art. 6(1)(a) GDPR (consent) for the newsletter; Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures) for emails relating to submitted ideas, bookings and non-disclosure agreements; Art. 6(1)(c) GDPR (legal obligation) for handling data protection requests
• Transfer to a third country: USA – Standard Contractual Clauses pursuant to Art. 46 GDPR; Plus Five Five, Inc. is also certified under the EU-U.S. Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR)

5. Storage and data security

All data is transmitted encrypted (TLS 1.3) and stored in the EU (Frankfurt). Uploaded files and generated reports are stored in a non-public storage area. Reports can only be accessed via time-limited, signed URLs (valid for 7 days).

6. Your rights

Under the GDPR, you have the following rights:

• ›Access (Art. 15): information about the data stored
• ›Rectification (Art. 16): correction of inaccurate data
• ›Erasure (Art. 17): deletion of your data
• ›Restriction (Art. 18): restriction of processing
• ›Data portability (Art. 20): receiving your data in a machine-readable format
• ›Objection (Art. 21): objecting to the processing

To exercise your rights, please contact: info@thinver.com

You also have the right to lodge a complaint with the competent supervisory authority. The competent authority is the State Commissioner for Data Protection of Baden-Württemberg (Landesbeauftragter für den Datenschutz Baden-Württemberg).

7. Cookies

We do not use tracking or marketing cookies. Technically necessary session cookies may be set for the website to function. No consent is required for this (§ 25(2) TTDSG).

8. Changes to this privacy policy

We reserve the right to update this privacy policy as needed. The current version is always available on this page. We will communicate significant changes by email if you have given us your email address.