Privacy Policy

This statement informs you about the processing of personal data when using ACHAT STUDIO (studio.achat.graphics).

1. Controller

ACHAT GRAPHICS, owner Henry Drenth, Bahnhofstr. 68, 71332 Waiblingen, Germany, email studio@achat.graphics.

2. What data we process

• Order data: email address, billing address, VAT ID where applicable, and the data required for payment (card data is processed solely by Stripe and not stored by us).
• Content data: the event text you enter, the content you upload (logo, audio, fonts), and the previews and videos generated from them.
• Technical data: server log data arising on access (e.g. IP address, time, resource requested, user agent) and a technically necessary cookie counting the free preview quota.
• Effectiveness-measurement data: If you reach the site through one of our short links (studio.achat.graphics/r/…), we store the identifier of the post you came from, the time, the country of origin (derived from the request, without storing your IP address), the referrer URL, the link target, and a shortened checksum of your browser identifier (user agent) salted with a secret key. That checksum serves only to filter out automated requests and cannot be turned back into the original user agent. We then record whether a preview was started and a checkout was begun, and in the event of a purchase the amount, package and post identifier. These steps are linked by a pseudonymous session identifier.
• Instagram interaction data: If someone comments on one of our Instagram posts, Meta sends us a notification about it. From this we store the comment identifier, the post identifier and the time, in order to count demand per post. The Instagram username and the comment text are not stored in normal operation; they are stored only if we exceptionally answer comments ourselves (see section 6).

Providing email and billing data is required to conclude and perform the contract and to meet tax obligations (§ 14 UStG); without it the purchase cannot be completed. Providing the other content data is voluntary but necessary to create the requested video.

3. Purposes and legal bases

• Performance of the contract (creating, providing and delivering the videos, payment processing, communication): Art. 6(1)(b) GDPR.
• Compliance with legal obligations, in particular commercial and tax retention and invoicing duties: Art. 6(1)(c) GDPR.
• Secure and stable operation, abuse and fraud prevention (e.g. server logs, preview quota): Art. 6(1)(f) GDPR.
• Measuring how well our own posts and the ordering path work (click on a short link, preview started, checkout started, purchase), and counting comment demand per post: Art. 6(1)(f) GDPR. Our legitimate interest is in knowing which of our own content actually leads to orders, so that we are not producing on guesswork. We weighed this against your interests: no cross-site identifiers are created, no profiles are built, nothing is passed to third parties for advertising, the measurement happens only within our own systems, your IP address is not stored for it, and the data is deleted after the periods stated in section 7. You may object to this processing at any time under Art. 21 GDPR (section 9).

4. Services and processors

To provide the service we use the following providers as processors (Art. 28 GDPR):

• Vercel Inc. (USA): hosting, delivery of the web app and audience measurement.
• Hetzner Online GmbH (Germany): server for video generation (render worker).
• Resend (Plus Five Five, Inc.) (USA): sending the delivery and service emails.
• Cloudflare, Inc. (USA): storage of the finished files (R2).
• Neon, Inc. (USA): database for order and preview data.
• Anthropic PBC (USA): AI generation of the concept texts.
• sevDesk GmbH (Germany): accounting and invoice management.
• Telegram FZ-LLC (UAE): delivery of internal operational alerts to us (e.g. "post published", fault notifications). No customer data is sent over this channel.

For generating the images and videos we use Features & Labels, Inc. (fal.ai) (USA). No personal data is sent to this service: only the image descriptions derived from your selections are passed on. Your event text is burned into the video on our own server, and uploaded logos, fonts and audio files only ever reach our render server, never fal.ai. It is therefore not a processor under Art. 28 GDPR.

To publish our own posts and to receive comment notifications we use the API of Meta Platforms Ireland Ltd. (Ireland). Meta is itself the controller for the Instagram platform; Meta’s own privacy policy applies in that respect.

Data processing agreements with these providers exist or are being concluded. Where data is transferred to the USA or other third countries, this is based on the EU Standard Contractual Clauses (Art. 46 GDPR) and, where applicable, a certification under the EU-US Data Privacy Framework.

Payment provider Stripe. For payment processing we use Stripe Payments Europe Ltd. (Ireland). Stripe processes the payment data (in particular card data) largely as an independent controller within the meaning of Art. 4(7) GDPR, and not as our processor, because as a licensed payment institution it determines the purposes and means of processing for fraud prevention, anti-money-laundering and its own legal obligations itself. To that extent Stripe's own privacy policy applies (stripe.com/privacy). The legal basis for the disclosure is Art. 6(1)(b) GDPR (performance of a contract); transfer to the USA is based on the EU Standard Contractual Clauses or Stripe's certification under the EU-US Data Privacy Framework.

5. Cookies and audience measurement

We use only technically necessary cookies (in particular to count the free preview quota). These are required for operation (§ 25(2) TDDDG) and need no consent.

For audience measurement we use Vercel Web Analytics. The service is cookieless, sets no cross-site identifier and builds no user profiles; it records aggregated data such as the page visited, referrer, country, device type and browser. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in audience measurement). No information is stored on or read from your device within the meaning of § 25 TDDDG. No other third-party tracking takes place.

Effectiveness measurement without cookies. The measurement described in section 2 deliberately works without cookies and without storing anything on your device: the post identifier is appended to the address when you are redirected and is passed on from there exclusively on our server. No information is therefore stored on or read from your device within the meaning of § 25 TDDDG here either, and no consent is required for it. This is measurement of our own content, not advertising tracking, and the data is not shared with third parties for advertising purposes.

6. Comments on Instagram

This information is addressed to people who comment on one of our Instagram posts and is provided under Art. 14 GDPR, because we do not collect this data from you directly but receive it through Meta’s API.

• Categories of data: comment identifier, post identifier, time. Instagram username and comment text only in the exceptional case below.
• Source: Meta Platforms Ireland Ltd. via the Instagram API.
• Purpose and legal basis: counting how much demand an individual post generates (Art. 6(1)(f) GDPR). In normal operation a specialised service provider answers the comments; we merely count them and need neither your name nor the text of your comment to do so, which is why we store neither. Only if we exceptionally answer comments ourselves do we additionally store the username and the comment text, so that we can reply to you.
• Retention: 90 days.
• Recipients: Neon, Inc. (USA) as database processor on the basis of the EU Standard Contractual Clauses.

You may object to this processing at any time under Art. 21 GDPR; we will then delete the entry concerned without undue delay.

7. Retention

Fixed, automatically enforced periods apply to your content: files you upload (logo, audio, fonts) are deleted automatically 24 hours after upload, as they are not needed beyond producing your video. Finished videos and stills stay available for 24 months so you can download them again, and are deleted automatically afterwards. Unbought preview images are deleted automatically on a regular basis. Server log data is generally deleted or anonymised within 7 to 30 days, unless it is needed longer to defend against disruptions or abuse.

Fixed, automatically enforced periods apply to the effectiveness measurement: click and funnel data (short-link visits, preview and checkout starts) are deleted after 12 months, the purchase metrics (amount, package, post identifier) after 24 months, and Instagram interaction data after 90 days. This does not affect invoices and accounting records, which are retained separately under the tax periods below.

Invoices and accounting records are kept for 10 years (§ 147(3) AO, § 14b(1) UStG), and received commercial and business letters for 6 years (§ 257 HGB).

8. No automated decision-making

No automated decision-making in individual cases, including profiling, with legal effect concerning you (Art. 22 GDPR) takes place. The AI used generates only the ordered content and makes no decisions about you. The effectiveness measurement described in section 3 is evaluated only in aggregate, to decide which content we produce next; it produces no assessment of individual people and has no effect on prices or on the services offered to you.

9. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on Art. 6(1)(f) (Art. 21). You can withdraw any consent at any time with effect for the future. Requests go to studio@achat.graphics.

You also have the right to lodge a complaint with a supervisory authority. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

Last updated: August 2026.