Privacy Policy

This statement informs you about the processing of personal data when using ACHAT STUDIO (studio.achat.graphics).

1. Controller

ACHAT GRAPHICS, owner Henry Drenth, Bahnhofstr. 68, 71332 Waiblingen, Germany, email studio@achat.graphics.

2. What data we process

• Order data: email address, billing address, VAT ID where applicable, and the data required for payment (card data is processed solely by Stripe and not stored by us).
• Content data: the event text you enter, the content you upload (logo, audio, fonts), and the previews and videos generated from them.
• Technical data: server log data arising on access (e.g. IP address, time, resource requested, user agent) and a technically necessary cookie counting the free preview quota.

Providing email and billing data is required to conclude and perform the contract and to meet tax obligations (§ 14 UStG); without it the purchase cannot be completed. Providing the other content data is voluntary but necessary to create the requested video.

3. Purposes and legal bases

• Performance of the contract (creating, providing and delivering the videos, payment processing, communication): Art. 6(1)(b) GDPR.
• Compliance with legal obligations, in particular commercial and tax retention and invoicing duties: Art. 6(1)(c) GDPR.
• Secure and stable operation, abuse and fraud prevention (e.g. server logs, preview quota): Art. 6(1)(f) GDPR.

4. Services and processors

To provide the service we use the following providers as processors (Art. 28 GDPR):

• Vercel Inc. (USA): hosting and delivery of the web app.
• Hetzner Online GmbH (Germany): server for video generation (render worker).
• Resend (Plus Five Five, Inc.) (USA): sending the delivery and service emails.
• Cloudflare, Inc. (USA): storage of the finished files (R2).
• Neon, Inc. (USA): database for order and preview data.
• Features & Labels, Inc. (fal.ai) (USA): AI generation of images and videos.
• Anthropic PBC (USA): AI generation of the concept texts.
• sevDesk GmbH (Germany): accounting and invoice management.

Data processing agreements with these providers exist or are being concluded. Where data is transferred to the USA or other third countries, this is based on the EU Standard Contractual Clauses (Art. 46 GDPR) and, where applicable, a certification under the EU-US Data Privacy Framework.

Payment provider Stripe. For payment processing we use Stripe Payments Europe Ltd. (Ireland). Stripe processes the payment data (in particular card data) largely as an independent controller within the meaning of Art. 4(7) GDPR, and not as our processor, because as a licensed payment institution it determines the purposes and means of processing for fraud prevention, anti-money-laundering and its own legal obligations itself. To that extent Stripe's own privacy policy applies (stripe.com/privacy). The legal basis for the disclosure is Art. 6(1)(b) GDPR (performance of a contract); transfer to the USA is based on the EU Standard Contractual Clauses or Stripe's certification under the EU-US Data Privacy Framework.

5. Cookies

We use only technically necessary cookies (in particular to count the free preview quota). These are required for operation (§ 25(2) TDDDG) and need no consent. No web analytics or third-party tracking takes place.

6. Retention

Order and content data are deleted once they are no longer needed for the stated purposes; unbought preview images are deleted automatically on a regular basis. Server log data is generally deleted or anonymised within 7 to 30 days, unless it is needed longer to defend against disruptions or abuse.

Invoices and accounting records are kept for 10 years (§ 147(3) AO, § 14b(1) UStG), and received commercial and business letters for 6 years (§ 257 HGB).

7. No automated decision-making

No automated decision-making in individual cases, including profiling, with legal effect concerning you (Art. 22 GDPR) takes place. The AI used generates only the ordered content and makes no decisions about you.

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on Art. 6(1)(f) (Art. 21). You can withdraw any consent at any time with effect for the future. Requests go to studio@achat.graphics.

You also have the right to lodge a complaint with a supervisory authority. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

Last updated: June 2026.