Privacy Policy

This is a convenience translation. The German version is authoritative.

This privacy policy applies to the website slugbase.app and to the SlugBase Cloud service at cloud.slugbase.app. It explains which personal data we process, for which purpose, on which legal basis, with which recipients and for how long, and which rights you have. The self-hostable Community Edition of SlugBase is not part of this service; whoever runs it is responsible for the processing on their own instance.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Michael David Guggenbichler, sole proprietor (Einzelunternehmer)
Linzer Straße 17
4100 Ottensheim
Austria
VAT ID: ATU82945789
Email: hello@slugbase.app

Further details are in the Legal Notice.

We have not appointed a data protection officer because the conditions of Art. 37(1) GDPR are not met. You can reach us on all data protection matters at hello@slugbase.app.

When we are controller and when processor: we are the controller ourselves for your account, billing, the security of the service, the website and the other processing described in this policy. If a business uses SlugBase for its own purposes, for example with the Team plan for its employees, the business is the controller for the content and member data of its workspaces, and we process them as its processor under the Data Processing Agreement, which becomes part of the contract with every order as an entrepreneur and with every use of the service for business purposes. In that case, please address questions about this content to the business first.

2. Your bookmarks are private

1. SlugBase is a platform for managing bookmarks. Every bookmark can get a private slug through which /go/<slug> forwards to the target. This forwarding works only for signed-in members. There are no public redirects and no public pages with your bookmarks.
2. Only you, and those members or teams of the same workspace with whom you expressly share them, can see your bookmarks and folders. Sharing grants read access only. Workspace administrators also have no automatic read access to other members' private bookmarks. Your tags are private and are never passed on with a share.
3. We do not read your bookmarks as part of normal operation. We access content only when you ask us to in a support request, and only to the extent needed for that, or when we are legally required to (for example by an order of an authority or a court) or to the extent strictly necessary to review a notice about unlawful content or a well-founded suspicion of a serious breach of the Terms. Running the database, backups and fixing faults requires access to the systems on which the content is stored. That is not reading the content.
4. Please note: content you save (addresses, titles, descriptions) can contain information about you or other people. Save only what you are allowed to save.

3. Processing activities

We process data of members (people with an account), of invited people, of invoice customers, of website visitors and of people who contact us. For each processing activity we state purpose, data, legal basis, recipients and retention. The recipients are described in more detail in section 5, and retention is summarised in section 7.

The legal bases are: contract (Art. 6(1)(b) GDPR), legitimate interest (point (f)), consent (point (a)) and legal obligation (point (c)), in particular the retention duty under § 132 of the Austrian Federal Fiscal Code (Bundesabgabenordnung, BAO).

3.1 Visiting the websites and technical connection data

• Purpose: delivering the websites slugbase.app and cloud.slugbase.app, stability and security of operation, fault diagnosis.
• Data: when you visit, the DNS service, the content delivery network (CDN) and our servers process the usual connection data: IP address, time, requested address, status code and information about your browser. The CDN terminates the TLS encryption and in doing so processes the requests including the requested address; for a redirect that includes the slug. Our application logs contain, per request, a request identifier, the route template (not the concrete address with the slug), the status code, the response time, the type of access and an internal workspace identifier. They do not contain bookmark addresses, slugs, email addresses or message texts.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the service.
• Recipients: bunny.net (BunnyWay d.o.o., Slovenia) for DNS and CDN, the hosting providers (section 5).
• Retention: application logs and access logs of our web servers 14 days. Connection data at the CDN at most 30 days.

3.2 Registration and account

• Purpose: setting up and running your account, performing the usage contract.
• Data: email address, display name, password (stored only as a hash), language, display and operating preferences (theme, accent colour, default view, keyboard shortcuts), settings for sign-in notices and for switching off AI suggestions, verification status of the email address, progress of the onboarding checklist, time of creation and of the last sign-in, and the version of the terms you accepted, with the time. A personal workspace is created for you.
• Check at registration: we refuse registrations with email addresses from disposable domains. The check concerns the domain only and is rule-based; your name or other details are not assessed.
• Legal basis: Art. 6(1)(b) GDPR; for the disposable-domain check Art. 6(1)(f) GDPR (protection against abuse).
• Recipients: hosting providers, CDN, Lettermint (for the verification email).
• Retention: until the account is deleted (see section 8).

3.3 Sign-in, sessions and account security

• Purpose: signing in, protecting your account, access through personal API tokens.
• Data:
  • Sessions: a random session token (stored only as a hash), sign-in and expiry times, time of last activity, the truncated user agent of your browser and a coarse network prefix of your IP address (for IPv4 the first two blocks, for IPv6 the first 48 bits). The full IP address is not stored and no location is derived. You can see your sessions in your account settings and end them there.
  • Two-factor sign-in (optional): the TOTP secret (encrypted), the last accepted time step to prevent reuse, and ten backup codes (stored only as hashes).
  • Single-use tokens in emails (email verification, password reset, change of email address): only as a hash, with purpose, target address for a change, and validity.
  • Personal API tokens (optional): name, hash, the first characters for display, scope, assigned workspace, expiry, time of last use and coarse network prefix of the last use.
  • Sign-in notice: on a sign-in from a new device we send you, if you want it (default: on), an email with the time, browser family and coarse network prefix.
• Legal basis: Art. 6(1)(b) GDPR; for security measures (reuse protection, sign-in notices, keeping used tokens) Art. 6(1)(f) GDPR. Our legitimate interest is the security of your account and of the service.
• Recipients: hosting providers, CDN, Lettermint (emails).
• Retention: sessions until expiry or sign-out. Single-use tokens 7 days after use or expiry. Intermediate states of a sign-in through an OIDC provider 10 minutes. The remaining data until revocation, expiry, loss of membership or deletion of the account. Details in section 7.

3.4 Sign-in through an external sign-in provider (OIDC)

• Purpose: signing in without a password of your own, where we offer an external sign-in provider and you choose it.
• Data: if you choose to sign in through a federated provider (OpenID Connect), we receive from it the identifier of your identity at the provider, your email address and your name. We store the provider identifier, the identifier of your identity, the email address used when linking, and the times of linking and last use. For the duration of the sign-in (10 minutes) we store an intermediate state.
• Legal basis: Art. 6(1)(b) GDPR. Use is voluntary and possible only if you choose it.
• Recipients: the provider you choose. It processes your data as an independent controller under its own privacy policy. We have no influence on that.
• Retention: until you remove the link or the account is deleted.

3.5 Workspaces, members, teams and invitations

• Purpose: collaboration in workspaces, management of members and teams, invitations.
• Data: name of the workspace, memberships with role (owner, administrator, member), joining date and time of last activity in the workspace, teams (name, description, members), workspace settings (for example switching AI suggestions on or off). For invitations: email address of the invited person, role, teams, the inviting person, validity and the invitation token (stored only as a hash). Members of the same workspace see each other's display name, email address, role and last activity.
• Invited people: the member who invited you gave us your email address. We use it only to send the invitation. The invitation is valid for 7 days. If you do not accept it, no account is created.
• Legal basis: Art. 6(1)(b) GDPR towards members. Towards invited people Art. 6(1)(f) GDPR. Our legitimate interest and that of the inviting member is inviting colleagues and fellow users.
• Recipients: other members of the workspace (as described), Lettermint (invitation email), hosting providers.
• Retention: as long as the membership or the workspace exists. Invitations that were accepted, revoked or have expired are deleted 30 days after acceptance, revocation or expiry.

3.6 Bookmarks, folders, tags, slugs and shares

• Purpose: the core function of the service: saving, organising, searching and opening your bookmarks, forwarding through slugs, sharing, import and export.
• Data: address (URL) and its normalised form, host, title, description, slug and forwarding switch, pinned status, owner, folders (name, icon, colour), tags (private), shares with members or teams, personal slug preferences, timestamps, and the archive status on a plan change (section 8). For frequency of use we store only the number of openings and the time of the last opening, not a history of individual openings. Import files are processed in memory and not stored; exports are generated on demand and not stored.
• Legal basis: Art. 6(1)(b) GDPR.
• Recipients: hosting providers, CDN (transmission). No one else. For access to content by us see section 2.
• Retention: until you delete the content or the workspace or account is deleted (section 8).

3.7 Page metadata and favicons

• Purpose: prefilling title and description and showing the icon of the target page.
• Data: when you create a bookmark or change its address, our servers fetch the target page (at most the first 512 KiB of HTML) and read the title, description, site name, canonical address and language. Per host we also fetch the page's icon, resize it and serve it from our own address; your browser does not contact the target page for this. The target page sees a request from our servers, not from you; your IP address is not passed on.
• Legal basis: Art. 6(1)(b) GDPR.
• Recipients: the operators of the fetched target pages (as the technical counterpart), hosting providers.
• Retention: metadata per workspace 7 days, icons per host 7 days; after that they are deleted and fetched again if needed.

3.8 AI suggestions (optional)

• Purpose: suggestions for title, slug and tags when you choose "Suggest" in the dialog.
• Availability: AI suggestions are optional. They are available only if we have switched the function on for SlugBase Cloud, your plan includes it, the workspace has switched it on and you have not switched it off in your account settings. You can switch the function off at any time. As long as we have not switched it on, no data is sent to an AI provider.
• Data, when the function is switched on and you use it: the AI provider receives the address of the bookmark, the public page metadata fetched by our servers, the names of your existing tags and the requested language. Your other bookmarks, workspace names and your notes or descriptions are not sent. The suggestion is cached for you per workspace, account, address and language. We also count per workspace which fields (title, slug, tags) you took over from a suggestion, without content.
• Legal basis: Art. 6(1)(b) GDPR. You trigger each request yourself by your input.
• Recipients: only if the function is switched on: Mistral AI SAS (Paris, France) as processor.
• Retention: cache 30 days, count of fields taken over 90 days. We switch the feature on only once it is contractually settled that the AI provider does not use the transmitted data to train AI models. We will state here how long it keeps them before we switch the feature on.

3.9 Workspace activity log

• Purpose: traceability of important changes in a workspace. Administrators can view the log if the plan includes it.
• Data: we log significant actions such as creating and renaming the workspace, changes to members, roles and invitations, team changes, shares and their revocation, bulk deletions, imports and exports (with counts only), changes to settings and billing changes. For each action we store the time, the acting person (display name at the time of the action and a reference to the account or token), the type of action, the affected object, a small piece of additional information and the coarse network prefix. We do not log addresses or titles of bookmarks. Actions are logged in all workspaces, including on the Free plan; viewing is available only in plans that include the log. After a change to such a plan, administrators and owners also see the entries from the time before, as far as they have not yet been deleted at the end of the retention period.
• Legal basis: Art. 6(1)(b) GDPR (providing the function); Art. 6(1)(f) GDPR (security and traceability in the workspace).
• Recipients: administrators and owners of the workspace, as far as the plan allows viewing; hosting providers.
• Retention: 1 year. If you delete your account, the display name stored at the time of the action stays in the log until this period ends; the reference to your account and the network prefix are removed.

3.10 Plans, payment and invoices

• Purpose: handling paid plans, payments, invoices and cancellation invoices, dunning, meeting tax and commercial-law obligations.
• Data:
  • Billing data: name or company, billing address, country, for businesses the VAT ID if you provide it, the indication consumer or business, email address for the invoice.
  • Contract data: plan, number of seats, billing period, subscription status, end of the term, cancellation marker, payment status, history of payments, refunds, dunning stages.
  • Documents: invoices (SB-00001) and cancellation invoices (SB-ST-00001) with the details as of the time of issue.
  • Contract and procedure records: the contract with the version of the terms and the time, a declaration of withdrawal (name, email address, free text, time) with our acknowledgement, notices to you about changes (for example of prices, terms or VAT) with the record of who received them and when, your objections to them, an audit log of changes in the billing system and a send record of the emails of the billing system (recipient, type of message, time, delivery status).
  • Means of payment: you enter payment details directly at Mollie (hosted payment page). We receive the type of payment method, the last four digits, the expiry date and a reference to the payment authorisation that arises with the first payment and against which we charge each renewal. We do not receive or store complete card numbers.
  • Contract and order records: acceptance of the Terms and acknowledgement of the Privacy Policy, an express request for an immediate start and the acknowledgement under the FAGG, if made, and declarations of cancellation with our confirmation, each with version, time and hashed connection data.
  • In SlugBase itself we hold only what is needed for your entitlements: plan, status, end of term, number of seats, deadlines and the account responsible for billing.
• Legal basis: Art. 6(1)(b) GDPR (contract); Art. 6(1)(c) GDPR (accounting and retention, in particular § 132 BAO and the VAT Act); Art. 6(1)(f) GDPR (proof of consents and defence of legal claims).
• Recipients: Mollie B.V. (Amsterdam, Netherlands) as payment service provider, which processes payment data as an independent controller (fraud prevention, anti-money-laundering, regulatory duties); Lettermint (sending invoices and notices); hosting providers (including backup storage); Scaleway SAS (France) for the yearly archive (see retention) and for the nightly copy of the billing system's database; the operator's tax and bookkeeping adviser (a professional bound by statutory secrecy and an independent controller) for invoices, cancellation invoices and payment records.
• Retention: invoices, cancellation invoices and payment records 7 years from the end of the calendar year of issue (§ 132 BAO). We anonymise the customer record when the workspace is deleted; the documents keep the details as of the time of issue. We keep the accepted version of the Terms, the evidence of your request for an immediate start, declarations of cancellation and of withdrawal, notices with the record of recipients, objections and the audit log for 3 years after the subscription or purchase ends, so that claims can be established or defended (Art. 6(1)(f), Art. 17(3)(e) GDPR; limitation under §§ 1480, 1486 ABGB). If a withdrawal leads to a refund, we keep the declaration of withdrawal with the cancellation invoice for 7 years from the end of the calendar year (§ 132 BAO). If proceedings are pending, we keep the documents concerned until they are concluded. Send records of the emails 2 years. They are then deleted. After the end of each calendar year we place the year's documents, encrypted and unalterable, with Scaleway SAS (France). This yearly archive is kept for 8 years from archiving and cannot be deleted early during that time; we use it only to meet the statutory retention duty. The 8 years consist of the 7 years under § 132 BAO plus a safety year, because the lock is fixed for the whole period when the archive is written: this way it reliably lasts until the statutory period ends and covers an extension of retention for pending proceedings (§ 132(1) BAO). The nightly copy of the billing system's database at Scaleway SAS is kept for 14 days. The backups of the billing system's database are kept encrypted in the object storage of Hetzner Online GmbH: the continuous backup for restoring any point in time of the last 30 days, and monthly backups for 12 months.

3.11 Transactional emails

• Purpose: sending emails that are necessary for the service.
• Data: your email address, your language and the content of the message. The emails are in particular: verification of the email address, change of email address (with a notice to the old address), password reset, notice of a password change, notice about two-factor sign-in, sign-in notice for a new device, invitations, notice of a transfer of ownership, order confirmation, confirmation of a withdrawal, confirmation of a cancellation, invoices, cancellation invoices, payment notices (failed payment, expiring payment card), a reminder at least 30 days before every yearly renewal, the announcement of price changes, notices of changes to the terms or of the introduction of VAT, and notice of a termination by us. The emails contain no tracking pixels and link only to our own address. We currently send no newsletters and no marketing emails.
• Legal basis: Art. 6(1)(b) GDPR; for security notices Art. 6(1)(f) GDPR. Our legitimate interest is the security of your account.
• Recipients: Lettermint B.V. (Netherlands) as processor for sending by SMTP.
• Retention: we do not store the messages in SlugBase. The billing system keeps a send record for its emails (recipient, type of message, time, delivery status), which we keep for 2 years (section 3.10). Storage at the sending service is governed by our contract with it.

3.12 Email and support

• Purpose: answering your enquiries, support, security reports, reports of unlawful content.
• Data: if you write to us by email at hello@slugbase.app or support@slugbase.app, we process your address, the message and the details you give in it. All emails to and from these addresses are held in the mailboxes at Infomaniak (sections 5 and 6); this applies to support correspondence and to correspondence about billing. If you ask us in support to look at your content, we access it only to the extent needed (section 2).
• Legal basis: Art. 6(1)(b) GDPR (existing or prospective contract, support); otherwise Art. 6(1)(f) GDPR (answering enquiries). We process reports of unlawful content provided for by law, for example under the Digital Services Act, under Art. 6(1)(c) GDPR.
• Recipients: Infomaniak Network SA (Geneva, Switzerland) as provider of the mailboxes, with a transfer to Switzerland (section 6); hosting providers.
• Retention: emails and support cases as long as handling requires and afterwards, as far as needed to defend possible claims, until the limitation period ends, at most 3 years from the last contact, and while proceedings are pending until they are concluded; statutory retention duties remain unaffected.

3.13 Abuse prevention and rate limiting

• Purpose: protecting the service from abuse, for example mass sign-in attempts.
• Data: counters per action and per IP address (as a hash) or account that limit how often an action is possible within a period. To protect against requests being carried out twice, we store per account a request key, a hash of the request and its result.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the security and availability of the service.
• Recipients: hosting providers, CDN.
• Retention: counters are deleted at the latest one hour after the last action, request keys after 24 hours.

3.14 Error reports

• Purpose: detecting and fixing software errors.
• Server side (always active): we capture technical error reports from the servers with the error trace, route template, status code and information about the runtime environment. Email addresses, IP addresses, session and other credentials and cookies are removed before storage. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is stable and secure operation; because of the scrubbing the interference is minor.
• In the browser (only with consent): only if you have consented in the application do we load a component that reports errors in the browser. It transmits the error trace, information about the browser and the address of the page at the time of the error. In individual cases parts of the content displayed at the time of the error can be included. The legal basis is Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021.
• Recipients: the error store runs on our own servers at the hosting providers; there is no further recipient.
• Retention: 30 days.

3.15 Audience measurement

• Purpose: understanding how the website and the application are used, in order to improve them.
• Data: we record page views and interactions in pseudonymised form and evaluate them only in aggregate. For this we use Umami, which runs on our own servers and sets no cookies. No third party has access. In addition we report four events from the server (registration verified, checkout started, subscription activated, Supporter purchase), only with the event name, the website identifier and the page path, without email address, identifier, name or amount, and only if you have agreed to audience measurement.
• Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 165(3) TKG 2021. The script is loaded only after your consent. Rejecting and accepting carry equal weight. Not consenting has no disadvantage for you.
• Recipients: none; Umami runs on our servers at the hosting providers.
• Retention: raw data 12 months, deleted after that.

3.16 Consents and proof

• Purpose: storing and proving your decisions on audience measurement and browser error reports.
• Data: your decision (open, agreed, rejected), the time and the version of this policy. On the website we store the decision in your browser's local storage (section 4). In the application we store it in your account so that it applies on all devices. Until you decide, "rejected" applies.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to respect your decision and to be able to prove that consent was given (Art. 7(1) GDPR), for example to the data protection authority.
• Recipients: hosting providers.
• Retention: as long as the consent applies and for 3 years afterwards; in the browser, until you delete your browser data. After your account is deleted, we keep this proof without your name, linked to a hash of your email address computed with a secret key, until the retention period ends.

3.17 Backups and restoration

• Purpose: protection against data loss and restoring the service after failures.
• Data: backups of the database with all the data mentioned. The backups are database dumps, stored in an object storage of Hetzner Online GmbH inside the EU, in a storage area reserved for them. They are transferred to the object storage over an encrypted connection (TLS).
• Legal basis: Art. 6(1)(f) GDPR (availability and integrity), also to meet Art. 32 GDPR.
• Recipients: the hosting provider Hetzner Online GmbH (object storage for the backups).
• Retention: hourly backups are kept 48 hours, daily backups 30 days and monthly backups three months. A backup that has been removed remains in the object storage as an earlier version for another 30 days. A restoration returns the state of one backup, not of an arbitrary point in time. Deleted data remains in backups until these periods end and has disappeared from all backups after 125 days at the latest; the yearly archive of the documents under section 3.10 is excepted. After a restoration we carry out again, where needed, any deletions made since the backup.

3.18 Legal obligations and legal claims

• Purpose: meeting legal obligations (for example information to authorities, retention, procedures under the Digital Services Act) and enforcing or defending legal claims.
• Data: the data needed in the individual case.
• Legal basis: Art. 6(1)(c) GDPR, for legal claims Art. 6(1)(f) GDPR.
• Recipients: authorities, courts and legal advisers, as far as necessary in the individual case.
• Retention: as long as the purpose requires, for legal claims until the end of the proceedings and limitation periods.

3.19 Online forms for withdrawal and cancellation

• Purpose: receiving and handling a withdrawal through the public "Withdraw from contract" form and a cancellation through the public "Cancel contracts here" form on slugbase.app, and acknowledging their receipt (§ 13a FAGG, § 312k BGB). Section 3.10 applies to the functions in the billing area of your account.
• Data: your name, the email address of your account or other details identifying the contract (an invoice or order number is optional), the email address for the acknowledgement, an optional message, and the date and time of receipt. To protect against automated submissions we check a proof of work (Altcha) on our own server, without a third party and without cookies, and keep an abuse log with the IP address as a hash.
• Legal basis: for a withdrawal Art. 6(1)(c) GDPR in conjunction with § 13a FAGG; for a cancellation Art. 6(1)(b) and (c) GDPR in conjunction with § 312k BGB; for the abuse log Art. 6(1)(f) GDPR. Our legitimate interest is protecting the form against abuse.
• Recipients: hosting providers; Lettermint B.V. for sending the acknowledgement.
• Retention: declarations of withdrawal and of cancellation as stated in section 3.10. We do not delete submissions that trigger the abuse check unseen; we review them by hand and delete them once it is clear that they are not a declaration, at the latest 30 days after receipt. The abuse log 30 days.

4. Cookies and local storage

We use only technically necessary cookies. They are set without consent under § 165(3) TKG 2021 because they are necessary for us to provide the service you expressly request.

1. We set no other cookies. We use no advertising or tracking cookies, no third-party scripts, no third-party fonts and no third-party embeds.
2. Local storage: on the website slugbase.app we store your consent decision in your browser's local storage (first party, no cookie). It serves only to respect your decision on your next visit. If storage is blocked, we treat that as a rejection.
3. Subject to consent are only audience measurement (section 3.15) and error reports in the browser (section 3.14). Both are loaded only after your consent. Audience measurement sets no cookies even then.
4. You can change or withdraw your decision at any time through the consent settings in the footer (section 11).

5. Recipients and processors

We pass on data only as far as necessary for the purposes stated. We have contracts under Art. 28 GDPR with our processors. "Hosting providers" in this policy means Hetzner Online GmbH, netcup GmbH and STRATO AG.

1. We operate audience measurement (Umami), the error store, operational monitoring and abuse prevention ourselves on our own servers. They are not additional recipients.
2. Other members of your workspace are recipients of the details in section 3.5 and, as far as you share, of the shared content.
3. Authorities, courts and advisers receive data only where there is a legal obligation or where it is necessary to protect legal claims.
4. We do not sell data and do not pass data on for advertising.

6. International transfers

1. We store your data in the EU: servers, database and backups are in the EU, as are the sending of transactional emails and payment handling. Data can be processed outside the European Economic Area (EEA) in these cases: in the answering of DNS queries (point 7), in our email correspondence (point 2) and, at your initiative, under points 3 to 5.
2. Email correspondence with us (Switzerland): we run the mailboxes hello@slugbase.app and support@slugbase.app at Infomaniak Network SA in Geneva, Switzerland. All messages that you send to these addresses, or that we send from them, are processed there: support correspondence, correspondence about billing, and notices and data protection requests. Switzerland is a third country. For it there is an adequacy decision of the European Commission (Art. 45 GDPR; Decision 2000/518/EC); the transfer is therefore permitted without further safeguards.
3. External sign-in provider: if you choose to sign in through a federated provider that is established outside the EEA or processes data there, the processing happens at your initiative and under that provider's rules. We ourselves pass on to the provider only the technical details necessary for the sign-in.
4. Optional AI suggestions: the intended provider is established in the EU. If processing outside the EEA takes place in future, it will be based only on an adequacy decision (Art. 45 GDPR) or standard contractual clauses (Art. 46 GDPR), and we will update this policy beforehand.
5. Card payment: when you pay by card, the card scheme and the card-issuing bank process your data under their own terms, possibly also outside the EEA; such a transfer is necessary for the performance of the contract (Art. 49(1)(b) GDPR).
6. When you click a saved address, your browser connects to the target page. That is not something we control.
7. Content delivery network (EU locations only) and DNS: our website and our application are delivered through the content delivery network of bunny.net (BunnyWay d.o.o., Slovenia). By our configuration (the EU routing filter of bunny.net), the network delivers only from bunny.net locations in the EU. Visitors from outside the EU are also served from there. No processing by the content delivery network takes place outside the EU. At these locations, the technical data of the request (IP address, requested address, browser details, for signed-in members the session cookie) and the transmitted content are processed briefly, because the connection ends there. bunny.net is established in the EU and subject to the GDPR; we have concluded a data processing agreement with bunny.net. DNS queries for our domain names are answered by the worldwide DNS network of bunny.net. A query contains the name asked for and the address of the querying resolver, and it may contain part of your own IP address.

7. Retention

After the periods expire we delete the data or irreversibly anonymise it. Statutory retention duties remain unaffected.

8. Downgrade, export and deletion

8.1 Downgrade of the plan

1. If a workspace falls to a plan with lower limits (for example after cancellation at the end of the term, after the grace period for a failed payment has ended, or on a change from Team to Personal), we archive the bookmarks above the limit. We do not delete them.
2. Archived bookmarks are no longer visible in lists, in search and in /go, and can no longer be edited. They stay fully stored as long as the workspace exists, are exported with an archive flag, and you can delete them. On a later change to a higher plan they are restored up to the new limit.
3. Which bookmarks are archived is decided by a fixed rule per workspace: the most recently opened bookmarks are kept, and in a tie the most recently created.
4. On a change from Team to another plan, shares, teams and invitations stay stored but have no effect until Team is booked again. Open invitations are revoked. Members remain members.
5. The processing of your other data does not change because of the downgrade. We process the archived data only to keep it for you.

8.2 Export

1. You can export your content at any time, including archived content: as a lossless JSON file that can be imported again, or as an HTML file in Netscape format for browsers. The export contains your own bookmarks with folders, tags, slugs, forwarding and pinned status and your personal slug preferences, and on request also readable shared bookmarks of other members.
2. The export is generated on demand and not stored on the server. We log it with counts only.
3. You can obtain a copy of further data about you (account, memberships, sessions, log entries, billing) on request under section 10.

8.3 Deletion

1. Deleting your account: you can delete your account in your account settings, after entering your email address and confirming again with your password or your provider. This is not possible while you are the sole owner of a workspace with other members or are responsible for billing a workspace with a running paid subscription. In that case transfer ownership or cancel first.
2. What is deleted with the account: workspaces in which you are the only member are deleted with all their content. Also deleted are your sessions, provider links, single-use tokens, backup codes, two-factor data, API tokens, tags, slug preferences, cache of AI suggestions and team memberships, and the account itself.
3. What stays in shared workspaces: in workspaces with other members, your bookmarks and folders stay with the workspace because the other members rely on them. They are shown without a link to your account as "Former member", and administrators can reassign or delete them. If you do not want that, delete or transfer your content before deleting your account. When you leave or are removed from a workspace, you or the person removing you decide whether your bookmarks are transferred or deleted. In the activity log the display name of that time stays until the one-year period ends (section 3.9).
4. Deleting a workspace: the owner can delete the workspace after confirming again and entering its name. It is immediately no longer visible or retrievable, and a background job then removes all content, memberships, invitations, settings, logs and caches. Deletion is final; export beforehand. While a paid subscription is running, deletion is not possible. The subscription must be cancelled first; cancellation at the end of the term is enough.
5. Billing data: when the workspace is deleted, we end open subscriptions, anonymise the customer record in the billing system (name, email address and address are replaced) and delete the customer at Mollie where nothing is open. Because of § 132 BAO we keep invoices, cancellation invoices and payment records for 7 years under § 132 BAO, and the other contract and order records, consent evidence and send records as stated in section 3.10 (section 7). The unalterable yearly archive of the documents (section 3.10) cannot be deleted early during its 8 years.
6. Backups: deleted data disappears from backups only when they expire under section 3.17, after 125 days at the latest. During that time they are not used for operation.
7. End of the contract without deletion by you: if the contract for your account ends other than by your own deletion, for example through termination by us or the discontinuation of the service, you can still sign in and export your data for 30 days (Terms clause 14 paragraph 6 no. 5). We then delete the account as described in points 2 to 6.

9. Security measures

We take appropriate technical and organisational measures under Art. 32 GDPR. In summary:

1. Encrypted transmission (TLS), including the transfer of backups to the object storage, storage of product data and backups in the EU.
2. Passwords, session tokens and API tokens are stored only as hashes, passwords with a memory-hard method; two-factor secrets are stored encrypted.
3. Separation of workspaces at database level and restricted database rights; sensitive columns are reachable only through narrow, reviewed functions.
4. Optional two-factor sign-in, limits on sign-in attempts, sign-in notices and the ability to end sessions.
5. Logs and error reports are kept free of credentials and content or are scrubbed. We embed no third-party scripts or fonts.
6. Access to systems only for authorised persons, regular restore tests of the backups.
7. Protection against access by public authorities outside the EU (Art. 28 and 32 of Regulation (EU) 2023/2854, the Data Act): our infrastructure is located in the EU and operated by companies established in the EU, except for the mailboxes in Switzerland and the worldwide DNS network of bunny.net, which answers DNS queries (sections 5 and 6). We disclose data to authorities only on the basis of Union law or the law of a Member State. If a body outside the EU requests data, we examine the request, disclose only what we are obliged to disclose under Art. 32 of the Data Act, and inform the customer concerned beforehand where this is permitted.

10. Your rights

Under the GDPR and the Austrian Data Protection Act (DSG) you have the following rights:

1. Access (Art. 15): you can ask for information about your data, the purposes, recipients, retention and origin, and obtain a copy.
2. Rectification (Art. 16): you can have inaccurate data corrected. You can change much of it yourself in the settings.
3. Erasure (Art. 17): you can ask for erasure if the data are no longer necessary, you have withdrawn a consent, you successfully object, or the processing is unlawful. The right does not apply where we still need the data to meet legal obligations (for example under § 132 BAO) or to establish, exercise or defend legal claims.
4. Restriction (Art. 18): you can ask for restriction of processing, for example while accuracy is contested.
5. Notification (Art. 19): we tell recipients of corrections, erasures and restrictions, unless that is impossible or disproportionate.
6. Data portability (Art. 20): you can export your bookmarks yourself at any time (section 8.2). The other data you have provided to us and that we process automatically on the basis of contract or consent, you receive on request in a structured, commonly used and machine-readable format.
7. Objection (Art. 21): see the paragraph on the right to object at the end of this section.
8. No automated decision (Art. 22): see section 13.

Exercising your rights: write to hello@slugbase.app. We answer without undue delay and at the latest within one month; for complex requests we can extend this period by two months and will tell you within the first month. Information is free of charge. If we have reasonable doubts about your identity, we can ask for further information to confirm it.

Right to object (Art. 21 GDPR): you can object at any time, on grounds relating to your particular situation, to processing of your data that we carry out on the basis of legitimate interests (Art. 6(1)(f) GDPR). We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

11. Withdrawing consent

Where processing is based on your consent (audience measurement, error reports in the browser), you can withdraw it at any time with effect for the future. In the application and on the website you change your decision through the consent settings in the footer; it takes effect immediately. Withdrawing is as easy as giving consent. The lawfulness of the processing carried out until then remains unaffected. You can also write to hello@slugbase.app.

12. Complaint to the data protection authority

If you believe the processing of your data violates data protection law, you have the right to lodge a complaint with the supervisory authority (Art. 77 GDPR, § 24 DSG). In Austria this is:

Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Vienna
Austria
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

You can also contact the supervisory authority of your habitual residence or place of work in the EU. We would appreciate it if you first gave us the opportunity to clarify your concern.

13. Automated decisions

We make no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, and we do not carry out profiling. For transparency we name the following rule-based processes:

1. Registrations with email addresses from disposable domains are refused (section 3.2).
2. If a subscription is cancelled, or a renewal payment fails after the retries and the grace period, the workspace is moved to the Free plan (or, for a workspace with the Supporter plan, to that plan) at the set time. This follows from the terms; no data about you is assessed. The consequences for your data are in section 8.1.
3. AI suggestions are non-binding suggestions that you accept or discard. They have no legal effect.

14. Obligation to provide data

1. For registration and use we need an email address, a display name and a password (or sign-in through a provider). Without them we cannot perform the contract.
2. For paid plans we need your billing details. We are legally obliged to issue invoices; without these data we cannot deliver the plan.
3. The consents (audience measurement, error reports in the browser), AI suggestions, two-factor sign-in, API tokens and sign-in through a provider are voluntary. Declining has no consequences for the rest of your use.
4. When you contact us, you decide which details to provide.

15. Changes to this policy

We may change this policy, for example because of new functions, different recipients or a change in the law. The version in force is always available on the Privacy Policy page; version and date are at the top. This policy is available in German and English; in case of differences, the German version prevails. We will inform registered members of material changes by email or by a prominent notice in the service before they take effect. If we want to process data for other purposes in future, we will inform you beforehand. We send earlier versions on request.

16. Contact

Data protection requests, access, erasure, objection and withdrawal: hello@slugbase.app
Support and security reports: support@slugbase.app
Postal address: Michael David Guggenbichler, Linzer Straße 17, 4100 Ottensheim, Austria

See also the Terms, the Withdrawal page and the Legal Notice.