Privacy policy

1. Controller

The controller for data processing on this website is the provider named in the Impressum ("we"). Contact for all privacy questions: contact@tinnkeoshop.com. No data protection officer is appointed because there is no legal obligation.

2. Overview

We only process data needed for Appora. We use no advertising or analytics trackers, never sell data and make no automated decisions with legal effect (Art. 22 GDPR).

3. Hosting and server logs

The website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you visit, technically necessary data is processed (IP address, date/time, page requested, browser information) to deliver the site and defend against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation). Vercel deletes logs automatically after a short time.

4. Account, login and database

For an account we store your email address, an encrypted password (hash), language, display name (optional), your projects, AI requests and credit balance. Legal basis: Art. 6(1)(b) GDPR (contract).

Database and login run on Supabase Inc. (970 Toa Payoh North #07-04, Singapore 318992); the data is stored in a data centre in Frankfurt am Main, Germany (AWS region eu-central-1). Confirmation and password emails are sent by Supabase or – once set up – by Resend Inc. (2261 Market Street #5039, San Francisco, CA 94114, USA).

5. AI features

When you use the AI Builder or the AI analysis in the Niche Finder, we send your text (prompt), the existing code of your project where relevant, and the language to xAI LLC (1450 Page Mill Road, Palo Alto, CA 94304, USA) to generate the answer. Please don't enter sensitive personal data there. We store request metadata (type, model, tokens, cost, status) to bill credits. Legal basis: Art. 6(1)(b) GDPR.

Video Ads: when you create a video, we send the script, language, format and the chosen stock presenter/voice ID to HeyGen, Inc. (USA) and – for cinematic clips – the scene description to xAI LLC (USA). No images or voices of you are uploaded. We store finished videos in private storage at Supabase and delete them automatically after 7 days; we keep metadata (type, cost, status) for billing. Transfers to the USA are based on the EU-US Data Privacy Framework or EU standard contractual clauses. Legal basis: Art. 6(1)(b) GDPR.

6. Payments

Payments are handled by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland). You enter payment details (e.g. card data) directly with Stripe; we never receive them. We receive customer ID, plan, payment status and billing country from Stripe. Legal basis: Art. 6(1)(b) and (c) GDPR (contract, tax obligations). Stripe may also process data in the USA and is partly an independent controller for fraud prevention; see stripe.com/privacy.

7. Published apps

If you publish an app, it is reachable via a public link. Published apps may load fonts or libraries from third-party servers (e.g. fonts.googleapis.com, cdn.jsdelivr.net, unpkg.com), which transfers visitors' IP addresses to those providers. You are responsible for the content of your published app.

8. Email contact and waitlist

If you write to contact@tinnkeoshop.com or join the waitlist, we process your details to reply or to keep you informed. Legal basis: Art. 6(1)(b) or (a) GDPR (consent, which you can withdraw at any time).

9. Cookies and local storage

We only use strictly necessary cookies and storage entries (§ 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act); no consent is required for them:

• sb-…-auth-token (Supabase): keeps you logged in; until logout or session expiry.

• NEXT_LOCALE: remembers your language; up to 1 year.

• appora_consent: stores your cookie choice; 12 months.

• theme (localStorage): stores light/dark mode, only if you use the toggle.

We currently set no optional cookies (e.g. analytics or advertising). If we add any later, only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change your choice at any time via "Cookie settings" in the footer.

10. Recipients and transfers outside the EU

Processors (Art. 28 GDPR): Vercel (hosting), Supabase (database, login, email), xAI (AI, including video clips), HeyGen, Inc., USA (AI video presenters), Resend (email delivery, e.g. order confirmations). Stripe (payments). Data processing agreements are in place or apply with all of them.

For providers based in the USA, transfers are based on the EU-US Data Privacy Framework (EU Commission adequacy decision, Art. 45 GDPR) where the provider is certified, otherwise on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

11. Retention

We keep account data as long as your account exists. After the account is deleted we delete your data unless legal retention duties apply (e.g. invoices and accounting records: 8 or 10 years under §§ 147 AO, 257 HGB).

12. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to withdraw consent (Art. 7(3) GDPR). Write to contact@tinnkeoshop.com.

Right to object (Art. 21 GDPR): where we process data based on legitimate interests, you can object at any time on grounds relating to your particular situation.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the authority where you live.

13. Obligation to provide data

Without an email address and password you can't create an account. Without payment details you can't book a paid plan.

14. Changes

We update this policy when features or the law change. The version published here applies.