Privacy policy

The controller for data processing on this website and in the StageFront service is:

Davin Seidel Humboldtstraße 55 75175 Pforzheim Deutschland

Email: stagefront.support@gmail.com

StageFront uses no analytics, advertising or tracking services. No third-party scripts are embedded in our pages and no usage behaviour is analysed. That is why there is no cookie banner here.

Only technically necessary cookies are set, which keep you signed in to your account (the session and refresh tokens of our authentication service). They are strictly necessary for the service you have expressly requested; storing them is permitted without consent under § 25 (2) no. 2 TDDDG. They are deleted when you sign out.

This website is delivered through the infrastructure of Cloudflare, Inc. (USA). It is served from whichever Cloudflare data centre is closest in network terms; for visitors from Europe that is usually a location inside the EU, but processing outside the EU is not excluded (see section 10). When you access it, technical access data are processed (IP address, time, requested address, status code, browser identifier). They serve secure, trouble-free operation and defence against attacks.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure operation).

At stagefronthq.com/s/… you will find websites that StageFront users have built for local businesses. If you submit a contact form there, we store your entries (name, email address, phone number, message) together with your IP address and forward the content by email to the people who maintain the website: to the business itself, where an email address is on file for it, and to the StageFront account that owns the website (our user — possibly an agency or freelancer rather than the business itself). Where no address is on file for the business, only that account receives the email. We forward where our sending limits allow it, the stored addresses are retrievable for us, and the hand-off to our email provider succeeds; that forwarding may reach only some of these recipients, or none of them. Otherwise your inquiry remains stored with us. Submissions that our protection against automated input classifies as automated are discarded without their content and are not forwarded. We process the IP address in order to protect the form against automated bulk submissions; the legal basis for that is Art. 6 (1) (f) GDPR, and for forwarding your inquiry Art. 6 (1) (b) or (f) GDPR. We remove the entries and the IP address from our database after twelve months at the latest; the forwarded email is then processed by those recipients.

If you use the form with which a business can request removal of a preview page created for it, we store your details (email address and message, where provided), your IP address and the page concerned. This is necessary in order to handle your request, to put the block in place and maintain it permanently, and to detect misuse of that form (Art. 6 (1) (c) and (f) GDPR). We remove your message and the IP address after twelve months at the latest; the suppression-list entry (email address or business) is kept permanently where one is created, so that the block persists (§ 11), and your email address remains in the request record where the reported page could be matched to a site — so that the objection stays verifiable and a wrongly reported page can be restored; where the page could not be matched, we remove the email address as well after twelve months at the latest.

If the question-and-answer assistant is enabled on one of these websites and you enter a question there, we process the text you enter, the time and your IP address (for IPv6 only the network prefix) in order to answer your question — depending on how that website is set up, either by matching it to an answer stored there or by composing an answer from the stored information — and to protect the input field against automated bulk input (Art. 6 (1) (b) and (f) GDPR). Unless your question already matches a stored question word for word, the text may be sent to Anthropic for matching or for composing the answer (Anthropic PBC, USA; for customers in the European Economic Area, Anthropic's own terms name Anthropic Ireland, Limited, Dublin, as the contracting entity), on the basis of the EU standard contractual clauses under Art. 46 (2) (c) GDPR; Anthropic states (as of this version) that it deletes submitted inputs within 30 days. We do not store the wording of your question ourselves; for requests that trigger a transfer we keep the time and IP address (for IPv6 only the network prefix) for up to twelve months. The details are set out in the privacy notice of the website concerned.

Via stagefronthq.com/kuendigung you can cancel contracts (§ 312k BGB); via stagefronthq.com/melden you can report content (Art. 16 DSA). Both forms store what you enter (for a cancellation: kind and timing of the cancellation, email address, optionally name, customer identifier and reasons; for a report: the address concerned, category, reasons, name and email address) together with your IP address in our database (Supabase, Frankfurt). The IP address serves to limit automated access and is removed after twelve months at the latest. We also use the email address you give in a report to send you the confirmation of receipt required by law (Art. 16(4) DSA); that mail is sent via Resend (USA). Our decision (Art. 16(5) DSA) is sent to you by a person, from the operations mailbox named below.

For a cancellation, we match the email address you give against our customer accounts and place the cancellation with our payment provider Stripe; the account email address may be transmitted to Stripe for that matching. The § 312k Abs. 4 BGB confirmation of receipt is sent via the delivery provider Resend (USA), exclusively to the address on file for the account; your stated reasons are not included in it. Internal notifications about incoming cancellations and reports — including the details entered and the IP address — go to our operations mailbox, which is currently hosted with Google (Gmail, USA).

Legal bases: Art. 6 (1) (c) GDPR (statutory duties under § 312k BGB and Art. 16 DSA) and Art. 6 (1) (f) GDPR (abuse detection). Retention in our database: we retain cancellation declarations as business correspondence for six years (§ 257 HGB, § 147 AO — the period runs from the end of the respective calendar year); after that, the personal details are removed. For reports, all personal details are removed from the database after twelve months at the latest; only the report category is kept. The copies sent by email to our operations mailbox are retained as business correspondence within the statutory retention periods.

To use StageFront you create an account with an email address and a password. Passwords are stored only as a cryptographic hash. Account and usage data (the websites you create, credit movements, saved businesses, deal stages) are held in a database operated by our processor Supabase, hosted in the Frankfurt am Main region (eu-central-1).

The legal basis is Art. 6 (1) (b) GDPR (performance of the contract).

Payments are processed via Stripe (for customers in the EEA: Stripe Payments Europe, Ltd., Ireland). Your payment data — in particular full card numbers — are processed exclusively by Stripe and never reach our systems. From Stripe we receive a customer identifier, the plan booked, the payment status and invoice identifiers, in order to maintain your account and credit balance correctly.

The legal basis is Art. 6 (1) (b) GDPR and, for the retention of invoice data, Art. 6 (1) (c) GDPR in conjunction with commercial and tax retention periods.

System messages (confirmation and sign-in emails, statutory confirmations of receipt — for example under § 312k BGB —, notifications about contact-form inquiries, and internal alerts to our operations mailbox) are sent via the service provider Resend. The recipient address and the message content are transmitted for this purpose.

The legal basis is Art. 6 (1) (b) GDPR for contract-related system messages and Art. 6 (1) (f) GDPR for delivering notifications about contact-form inquiries (legitimate interest in reliable delivery).

When you have a website generated, we transmit your input (the description of the business) and publicly available information about the business concerned to the AI services we use: Anthropic (text generation and image assessment), fal.ai (image processing and video generation) and the Google Places API (the business's photos, opening hours and reviews). This processing takes place in order to create the website you requested. Anthropic is also used for the question-and-answer assistant on published websites (see § 3a); if you test that assistant as the owner of a preview that is not yet published, § 3a applies accordingly to your own input, and the request is additionally stored with your user ID. We remove the IP address after twelve months at the latest; the user ID is retained as part of the usage record, also after your account is deleted (an exception to § 11).

Please do not enter personal data in the description that the website does not need. We will name the providers used and the applicable data processing agreements on request.

The legal basis is Art. 6 (1) (b) GDPR — transmission to these providers is necessary in order to deliver the service you expressly requested.

StageFront contains a searchable database of local businesses so that our users can find businesses without a website of their own. The data — name, address, category, geographic coordinates and, where publicly available, phone number, email address, website and social-media profiles — come from publicly accessible sources, in particular the open Overture Maps dataset. These are business contact details; individual entries may nevertheless relate to natural persons (for example in the case of sole traders).

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is to enable website service providers and potentially interested businesses to initiate a business relationship. Informing each data subject individually would involve disproportionate effort given the size of the dataset (several hundred thousand entries from publicly accessible sources); we therefore rely on Art. 14 (5) (b) GDPR and make the Art. 14 information publicly available here instead. In addition, every preview page created for a business carries a notice and a link through which the business can object to the processing.

Objection (Art. 21 GDPR): you may object to the inclusion of your business at any time — via the removal link on a preview page created for you, or informally by email. Your objection is binding from receipt in either case. Via the removal link, the preview page concerned is taken offline immediately and the confirmation screen shows you the status; an objection by email is handled by a person. Your business is added to a block list; a blocked business's entry in our address pool is no longer offered, and no new pages can be generated from it and no enquiries sent to it through StageFront. The block-list entry itself is made automatically when the page concerned was created directly from an entry in our address pool and no manual check is required (for example when an unusual number of removal requests arrive at once); in all other cases — currently the normal case — a person makes the entry. Your objection is binding from receipt either way.

Businesses are contacted exclusively from the user's own email inbox. StageFront does not send marketing emails to the businesses in the database; the person making contact is responsible for the lawfulness of that outreach.

Websites created through StageFront may display genuine customer reviews of the business concerned, which we retrieve via the Google Places interface. This includes the display name of the reviewer as published by Google. Reviews are never invented — reviews written by the AI model are stripped out in code. The legal basis is Art. 6 (1) (f) GDPR (presenting the business together with its publicly visible reviews). If you wrote such a review and do not want your name to appear on a page published through StageFront, a message to us is enough and we will remove the review from the pages concerned.

If you write to us by email, we process your details in order to handle your inquiry and any follow-up questions. The legal basis is Art. 6 (1) (b) GDPR for contract-related inquiries, otherwise Art. 6 (1) (f) GDPR.

We disclose personal data only to the processors named above, who act on our behalf, and to bodies to which we are legally obliged to transmit data. Data are never sold.

Some of these providers are based in the USA. Such transfers take place on the basis of the European Commission's standard contractual clauses pursuant to Art. 46 (2) (c) GDPR and, where the provider concerned is certified, on the basis of the EU-US Data Privacy Framework pursuant to Art. 45 GDPR.

We store account data for as long as your account exists. After it is deleted we remove your data unless statutory retention obligations require otherwise — in particular the commercial and tax retention periods for invoices and accounting records (generally six or ten years). Entries on the suppression list are kept permanently; that is precisely their purpose, since it is the only way to enforce an objection once it has been made. This does not apply to our platform's event records (technical usage, billing, account and security events relating to your account, including the question-and-answer assistant's records under § 7), in which your user ID is retained permanently; IP addresses are removed from all of these records after twelve months at the latest.

You have the right at any time to information (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing (Art. 21). You may withdraw consent at any time with effect for the future (Art. 7 (3)).

To do so, contact stagefront.support@gmail.com. Irrespective of this, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence or of the alleged infringement.

We update this statement when the service or the legal situation changes. The version published here is the one that applies.