Privacy policy

The controller for data processing on this website and in the StageFront service is:

Davin Seidel Humboldtstraße 55 75175 Pforzheim Deutschland

Email: stagefront.support@gmail.com

StageFront uses no analytics, advertising or tracking services. No third-party scripts are embedded in our pages and no usage behaviour is analysed. That is why there is no cookie banner here.

Only technically necessary cookies are set, which keep you signed in to your account (the session and refresh tokens of our authentication service). They are strictly necessary for the service you have expressly requested; storing them is permitted without consent under § 25 (2) no. 2 TDDDG. They are deleted when you sign out.

This website is delivered through the infrastructure of Cloudflare, Inc. (USA). It is served from whichever Cloudflare data centre is closest in network terms; for visitors from Europe that is usually a location inside the EU, but processing outside the EU is not excluded (see section 10). When you access it, technical access data are processed (IP address, time, requested address, status code, browser identifier). They serve secure, trouble-free operation and defence against attacks.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure operation).

At stagefronthq.com/s/… you will find websites that StageFront users have built for local businesses. If you submit a contact form there, we store your entries (name, email address, phone number, message) together with your IP address and forward the content by email to the operator of that website. We process the IP address in order to protect the form against automated bulk submissions; the legal basis for that is Art. 6 (1) (f) GDPR, and for forwarding your inquiry Art. 6 (1) (b) or (f) GDPR.

If you use the form with which a business can request removal of a preview page created for it, we store your details (email address and message, where provided), your IP address and the page concerned. This is necessary in order to handle your request, to enforce the block permanently and to detect misuse of that form (Art. 6 (1) (c) and (f) GDPR).

To use StageFront you create an account with an email address and a password. Passwords are stored only as a cryptographic hash. Account and usage data (the websites you create, credit movements, saved businesses, deal stages) are held in a database operated by our processor Supabase, hosted in the Frankfurt am Main region (eu-central-1).

The legal basis is Art. 6 (1) (b) GDPR (performance of the contract).

Payments are processed via Stripe (for customers in the EEA: Stripe Payments Europe, Ltd., Ireland). Your payment data — in particular full card numbers — are processed exclusively by Stripe and never reach our systems. From Stripe we receive a customer identifier, the plan booked, the payment status and invoice identifiers, in order to maintain your account and credit balance correctly.

The legal basis is Art. 6 (1) (b) GDPR and, for the retention of invoice data, Art. 6 (1) (c) GDPR in conjunction with commercial and tax retention periods.

System messages (confirmation and sign-in emails, notifications about contact-form inquiries) are sent via the service provider Resend. The recipient address and the message content are transmitted for this purpose.

The legal basis is Art. 6 (1) (b) GDPR for contract-related system messages and Art. 6 (1) (f) GDPR for delivering notifications about contact-form inquiries (legitimate interest in reliable delivery).

When you have a website generated, we transmit your input (the description of the business) and publicly available information about the business concerned to the AI services we use: Anthropic (text generation and image assessment), fal.ai (image processing and video generation) and the Google Places API (the business's photos, opening hours and reviews). This processing takes place solely in order to create the website you requested.

Please do not enter personal data in the description that the website does not need. We will name the providers used and the applicable data processing agreements on request.

The legal basis is Art. 6 (1) (b) GDPR — transmission to these providers is necessary in order to deliver the service you expressly requested.

StageFront contains a searchable database of local businesses so that our users can find businesses without a website of their own. The data — name, address, category, geographic coordinates and, where publicly available, phone number, email address, website and social-media profiles — come from publicly accessible sources, in particular the open Overture Maps dataset and the Google Places API. These are business contact details; individual entries may nevertheless relate to natural persons (for example in the case of sole traders).

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is to enable website service providers and potentially interested businesses to initiate a business relationship. Informing each data subject individually would involve disproportionate effort given the size of the dataset (several hundred thousand entries from publicly accessible sources); we therefore rely on Art. 14 (5) (b) GDPR and make the Art. 14 information publicly available here instead. In addition, every preview page created for a business carries a notice and a link through which the business can object to the processing.

Objection (Art. 21 GDPR): you may object to the inclusion of your business at any time — via the removal link on a preview page created for you, or informally by email. We then add your business to a suppression list: the preview pages created for you are removed, and for a blocked business no new pages can be generated and no inquiries can be sent through StageFront. In rare cases — for example when an unusual number of removal requests arrive at once and we have to rule out automated manipulation — we apply the block only after a short manual review; the page concerned is still taken offline immediately, and the confirmation screen tells you so.

Businesses are contacted exclusively from the user's own email inbox. StageFront does not send marketing emails to the businesses in the database; the person making contact is responsible for the lawfulness of that outreach.

Websites created through StageFront may display genuine customer reviews of the business concerned, which we retrieve via the Google Places interface. This includes the display name of the reviewer as published by Google. Reviews are never invented — reviews written by the AI model are stripped out in code. The legal basis is Art. 6 (1) (f) GDPR (presenting the business together with its publicly visible reviews). If you wrote such a review and do not want your name to appear on a page published through StageFront, a message to us is enough and we will remove the review from the pages concerned.

If you write to us by email, we process your details in order to handle your inquiry and any follow-up questions. The legal basis is Art. 6 (1) (b) GDPR for contract-related inquiries, otherwise Art. 6 (1) (f) GDPR.

We disclose personal data only to the processors named above, who act on our behalf, and to bodies to which we are legally obliged to transmit data. Data are never sold.

Some of these providers are based in the USA. Such transfers take place on the basis of the European Commission's standard contractual clauses pursuant to Art. 46 (2) (c) GDPR and, where the provider concerned is certified, on the basis of the EU-US Data Privacy Framework pursuant to Art. 45 GDPR.

We store account data for as long as your account exists. After it is deleted we remove your data unless statutory retention obligations require otherwise — in particular the commercial and tax retention periods for invoices and accounting records (generally six or ten years). Entries on the suppression list are kept permanently; that is precisely their purpose, since it is the only way to enforce an objection once it has been made.

You have the right at any time to information (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing (Art. 21). You may withdraw consent at any time with effect for the future (Art. 7 (3)).

To do so, contact stagefront.support@gmail.com. Irrespective of this, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence or of the alleged infringement.

We update this statement when the service or the legal situation changes. The version published here is the one that applies.