Last updated: 30 August 2026
This notice explains how Schärpf handles personal data when you visit schaerpf.com, use Schärpf Account, use a Schärpf app that connects to the Account service, make a purchase, or contact support. An app-specific notice takes precedence where it expressly says so.
No advertising or behavioural tracking. Schärpf does not use your data for targeted advertising.
No sale of personal data. Schärpf does not sell or share personal data for cross-context behavioural advertising.
Necessary storage only. Schärpf Account uses a secure session cookie to keep you signed in. The public website does not set browser storage.
1. Personal data, purposes, and legal bases
| Context and data | Why it is used | GDPR basis |
|---|---|---|
| Public website. Requested page or file, time, referrer, browser, operating system, device type, and an anonymised IP address in IONOS hosting logs. | Deliver the website, maintain security and availability, and diagnose faults. | Legitimate interests in operating a secure, reliable website (Art. 6(1)(f) GDPR). |
| Identity and profile. WorkOS user ID, name, email, email-verification state, optional profile picture, authentication method, organisation memberships, roles, and team names. | Create and operate your account, authenticate you, show the correct personal or team context, and administer team access. | Contract performance and steps requested before entering a contract (Art. 6(1)(b)); security and account-integrity interests (Art. 6(1)(f)). |
| Sessions and security. Session identifiers, IP address, user agent, authentication method, creation, update, expiry and revocation times, and security events. | Keep you signed in, show and revoke sessions, prevent abuse, and investigate security incidents. | Contract performance (Art. 6(1)(b)) and legitimate interests in service security and fraud prevention (Art. 6(1)(f)). |
| Account and app access. Internal account IDs, team memberships, app products, entitlements, subscription status, licence pools, assignments, and related timestamps. | Provide purchased or free app capabilities, manage team licences, and keep access state consistent across apps. | Contract performance (Art. 6(1)(b)) and legitimate interests in preventing licensing abuse (Art. 6(1)(f)). |
| Purchases and billing. Billing email, Polar customer, order and subscription references, product, quantity, amount, currency, payment status, invoice or receipt availability, refund state, and billing webhook records. Schärpf does not receive full payment-card details. | Start checkout, fulfil purchases, provide billing history and app access, handle refunds and disputes, and meet accounting obligations. | Contract performance (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)), and fraud/dispute interests (Art. 6(1)(f)). |
| Account changes and privacy requests. Current and requested email, request status and timestamps; deletion or erasure request, contact email, optional notes, and review status. | Complete verified account changes, respond to rights requests, and preserve an audit trail of the request and outcome. | Contract performance (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)), and defence of legal claims (Art. 6(1)(f)). |
| Support and correspondence. Name if provided, email address, selected topic, message content, app, team, account or order details you provide, and the support response. | Answer your request, troubleshoot the service, and handle contractual or legal issues. | Contract performance (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)), and support/claim-handling interests (Art. 6(1)(f)). |
The data comes from you, your browser or app, a team administrator who manages your membership or licence, WorkOS, and Polar. Providing identity and account data is required to use Schärpf Account. Billing data is required only when you purchase or manage a paid product.
Please do not send health data, government identifiers, precise location, or other sensitive information in support or privacy-request notes. Schärpf does not use solely automated decisions that produce legal or similarly significant effects.
2. Cookies and browser storage
Schärpf Account stores one secure, HTTP-only session cookie after sign-in. It is strictly necessary to provide the account service you request, is unavailable to page scripts, and expires or is removed when the session ends. The public website does not set cookies, local storage, analytics identifiers, advertising identifiers, or tracking pixels. A consent banner is therefore not shown. If non-essential storage or tracking is introduced, it will be blocked until the required choice is obtained.
3. Recipients and service providers
- IONOS SE hosts schaerpf.com and the support mailbox, processes website access logs, and transports and stores contact correspondence.
- Render Services, Inc. hosts the Schärpf Account backend and frontend, handles contact-form submissions in transit, and processes service requests and runtime logs. Contact messages are not stored in the Schärpf Account database.
- WorkOS, Inc. provides authentication, user, organisation, session, and account-security services.
- Supabase, Inc. provides the managed database used for Schärpf-owned account, entitlement, billing-mirror, and request records.
- Polar Software, Inc. is the merchant of record and authorised reseller for purchases. Polar collects payment and billing information under its own privacy policy; Schärpf receives transaction and entitlement information needed to provide the product.
Personal data may also be disclosed to professional advisers, courts, public authorities, or law enforcement where necessary to establish or defend legal claims or comply with law. It is not disclosed for independent advertising.
4. International transfers
WorkOS, Render, Supabase, and Polar are US-based providers, so personal data may be processed in the United States and other countries where their authorised subprocessors operate. Where the GDPR requires a transfer safeguard, Schärpf relies on the applicable provider agreement, an adequacy decision such as the EU-US Data Privacy Framework where available, or the European Commission's Standard Contractual Clauses, together with supplementary measures where appropriate. You may request information about the safeguard relevant to your data by email.
5. Retention
- IONOS website logs: up to eight weeks.
- Render runtime logs: 7 to 30 days, depending on the active hosting plan.
- Session data: for the configured session lifetime and as long as needed to show or investigate active and recently ended sessions.
- Profile, membership, entitlement, and licence data: while the account, team, licence, or app access remains active, then until an account-deletion review confirms the data can be deleted or anonymised.
- Pending email-change records: until confirmed, replaced, cancelled, or expired; outcome records are then retained only as long as needed for security and dispute handling.
- Support and privacy requests: normally three years after the request is resolved, unless a shorter period is sufficient or a longer period is needed for a dispute or legal duty.
- Orders, invoices, refunds, billing mirrors, and related transaction evidence: up to ten years where required for German tax and accounting records, or otherwise for the applicable limitation, refund, fraud, or chargeback period.
Deletion can take additional time to propagate through provider backups. Data that must be retained is restricted to the relevant legal, security, accounting, or dispute purpose rather than used for ordinary account activity.
6. Your privacy rights
European Economic Area, United Kingdom, and Switzerland
Depending on the circumstances, you may request access, correction, deletion, restriction, or portability of your personal data. You may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it for the future. You may also lodge a complaint with a supervisory authority. The supervisory authority for Schärpf is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).
United States
Depending on your state and whether its law applies, you may have rights to know or access personal data, correct it, delete it, receive a portable copy, and appeal a denied request. You may also have rights to opt out of sale, sharing for cross-context behavioural advertising, targeted advertising, or qualifying profiling. Schärpf does none of those activities, does not offer financial incentives for personal data, and does not use sensitive personal data to infer characteristics. You will not be discriminated against for exercising a privacy right.
You or an authorised agent can submit a request to . State the right you want to exercise and the Schärpf Account email involved. Schärpf may ask for information needed to verify the request and protect the account. If a request is denied, reply to the decision and state that you want to appeal.
7. Children
The services are intended for adults and business users, not children. You must be at least 18 years old, or the age of legal majority where you live, to create an account or purchase a product. If you believe a child has provided personal data, contact Schärpf so it can be reviewed and removed where appropriate.
8. Security
Schärpf uses access controls, encryption in transit, secure session cookies, provider access restrictions, request scoping, logging redaction, and other technical and organisational measures appropriate to the service. No online service can guarantee absolute security.
9. Changes to this notice
This notice may change when the services, providers, or legal requirements change. The updated version will be posted here with a new date. Material changes will be called out in the Account service or by another appropriate channel when required.
10. Contact
Questions and privacy requests:
.
Legal identity, postal address, and other operator details:
Impressum.