Privacy Notice for Capture (sourcenet.app)

Last updated: [date of publication]

This notice applies to our application Capture at sourcenet.app. Our website www.sourcenet.io has its own privacy notice, which you will find there.

In short: The content of your workspace is stored with Google Cloud in Frankfurt am Main; the company that uses the workspace is responsible for it, and we process it on that company’s behalf. You sign in through Google, and that data is in the USA. Capture sets no cookies, shows no ads and keeps no statistics about you.

1. Who is responsible

We are responsible for your account, signing in, Capture’s e-mails, support and security:

sourcenet.io UG (haftungsbeschränkt)
Paul-Klee-Str. 14, 40822 Mettmann, Germany
Managing director: Alexander Klähn
E-mail: hello@sourcenet.io

The company that uses a workspace is responsible for its content, that is your employer or the company that invited you. We process this content only on that company’s behalf, under a data processing agreement (Art. 28 GDPR; Section 4).

We are not required to appoint a data protection officer (Section 38 of the German Federal Data Protection Act, BDSG). For questions about data protection, write to us at the address above.

2. When you open Capture

Delivery through Firebase Hosting. Capture is delivered by Firebase Hosting, a Google service (Google Cloud EMEA Limited, Dublin, Ireland). So that the application loads quickly, it comes from a content delivery network that Fastly, Inc. (USA) runs for Google, from a server near you, which may be outside the EU. Google and Fastly process your IP address and technical information from your browser (such as browser type, language, the file requested and the time) to deliver the application to you and protect it against attacks. We keep no access logs of our own.

Program libraries from Google. When it starts, Capture loads the Firebase program libraries it uses to sign you in and to read and store your data from Google’s servers (www.gstatic.com). Google receives your IP address and browser details here too. Fonts and images come from our own hosting, not from Google Fonts or other providers.

• Legal basis: our legitimate interest in providing you with a secure, fast application (Art. 6(1)(f) GDPR).
• Processing on our behalf: Google processes the data on our behalf, under Google’s Cloud Data Processing Addendum; Fastly as Google’s sub-processor.
• Transfer to the USA: Google LLC is certified under the EU-US Data Privacy Framework; the European Commission’s standard contractual clauses apply in addition, for Fastly too.

No cookies, no statistics. Capture sets no cookies and uses no services for advertising, audience measurement or usage statistics. In your browser’s storage, Capture keeps only what the application needs:

• your sign-in, so you stay signed in (Firebase Authentication);
• a note without any identifier of which versions of the Firebase libraries were used on which days; Firebase sends it along with its requests;
• two settings of your view: the role you last used and whether you see initiatives as cards or as a list.

The legal basis for this is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), because this information is strictly necessary for the application you want to use. Signing out removes your sign-in; you delete everything else by clearing the site data for sourcenet.app in your browser.

3. Your account

What we store: your name, your e-mail address, your password (only as a hash, so it cannot be read), a profile picture if you add one, which workspaces you belong to and which one you are using; also when you sign in and the IP addresses you sign in from.

Where the data comes from: from you, when you order Capture or edit your profile; if you are invited, your name and e-mail address come from the person who invites you.

What for: to provide you with an account, sign you in, link you to the right workspaces and detect and prevent misuse.

• Legal basis: if you ordered Capture yourself, the performance of the contract (Art. 6(1)(b) GDPR). Otherwise our legitimate interest, and our customer’s, in giving the people it invites secure access (Art. 6(1)(f) GDPR). The security logs are always based on this legitimate interest.
• Where: signing in runs on Google’s Firebase Authentication; Google processes the sign-in data (e-mail address, password hash, times and IP addresses of sign-ins) in the USA. Everything else is stored with Google Cloud in Frankfurt am Main.
• Processing on our behalf and transfer to the USA: as in Section 2, under Google’s Cloud Data Processing Addendum, with the EU-US Data Privacy Framework and the standard contractual clauses.
• How long: as long as your account exists. Google keeps the IP addresses of sign-ins for a few weeks. The technical logs of our server functions, with your user ID and IP address, are deleted after 30 days.

Deleting your account: write to us and we will delete your account within 30 days. Copies in our backups are overwritten as they expire, after 14 weeks at the latest. In the workspaces you worked in, your name stays with your entries and in the change log, so that their records remain complete; the company concerned decides about that (Section 4).

4. The content of your workspace

In a workspace, you and your colleagues record initiatives, savings, tasks, comments, suppliers and documents; Capture logs every change with the person and the time. This also includes your role in the workspace, who invited you and when you were last there.

• Responsible is the company that uses the workspace. It decides whom it invites, what is stored and when it is deleted. We process the content only on its behalf and on its instructions, under our data processing agreement, and use it for nothing else: not for advertising, not for statistics about you and not to train AI models.
• Where: with Google Cloud in Frankfurt am Main.
• Who sees it: only the members of the workspace, according to their role. We ourselves see it only where running the service requires it, for example for a support request or a fault.
• Your rights regarding this content are exercised with the company that uses the workspace. If you write to us, we forward your request there.

5. E-mails from Capture

Capture sends e-mails when someone invites you to or adds you to a workspace, when your workspace is set up and when you ask for a new password; later also notes about your subscription, for example before an introductory offer ends. For this we use Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany).

• What Brevo processes: your e-mail address, your name, the content of the e-mail (such as who invited you, the name of the workspace and a link) and whether the e-mail was delivered. We do not track whether you open our e-mails or click links in them.
• Legal basis: as for your account (Section 3).
• Processing on our behalf: Brevo processes the data on our behalf, under its data processing agreement, on servers in the EU.

6. The support chat

Provider: The chat is provided by Crisp IM SAS, 2 Boulevard de Launay, 44100 Nantes, France (the “chat provider”). Crisp stores the data in the EU (in the Netherlands, Germany, France and, for backups, Ireland) and does not transfer it to countries outside the European Economic Area.

With “Chat with us” you open a window in which you can write to us. Only then does Capture load the chat provider’s chat page; before that, the provider learns nothing about you.

• What the chat provider processes: your name, your e-mail address, your company’s name and Capture’s language, which we pass to the chat so we know who is writing; your messages; your IP address and browser details. So that the conversation continues the next time you open it, the chat page stores an identifier in your browser. If we reply after you have closed the window, the chat provider may send you the reply and a transcript of the conversation by e-mail.
• Legal basis: your request and, where applicable, a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering your questions (Art. 6(1)(f) GDPR); for the identifier in your browser, Section 25(2) no. 2 TDDDG, because the chat you open needs it.
• Processing on our behalf: the chat provider processes the data on our behalf, under its data processing agreement.
• How long: as long as your account exists, so that we know the history if you come back to it. If you have your account deleted, we delete your chats too.

For your security: we do not verify the name and e-mail address in the chat. So we never change your account or workspace (members, owner, export, deletion) on the strength of a chat message alone: you do it in Capture, or we confirm it by e-mail to the address in your account.

By e-mail: if you would rather write us an e-mail, Section 4 of our website’s privacy notice applies.

7. Subscription and payment

You buy the subscription for Capture from Paddle.com, our online reseller and Merchant of Record. Paddle processes your purchase and payment details as an independent controller; more on this in our website’s privacy notice (Section 3) and in Paddle’s privacy notice.

• What we receive from Paddle: that something was bought and what, the buyer’s e-mail address, the company’s name and the state of the subscription (active, cancelled, payment due). We use it to set up the workspace and to activate or archive it.
• Legal basis: the performance of the contract (Art. 6(1)(b) GDPR).
• How long: as long as the workspace exists; what commercial and tax law requires, up to ten years.

8. Who receives your data

Beyond that, we pass on your data only where a law obliges us to, for example to an authority. We do not sell data.

9. Security

The connection to Capture is encrypted (TLS), and so is the data at rest. Every workspace is separated from all others; security rules on the server enforce the separation. All accounts with access to our systems are protected by two-step sign-in. How we protect the data in your workspace is described in Annex 2 of our data processing agreement.

10. Your rights

You have the right

• to access your data (Art. 15 GDPR),
• to have incorrect data corrected (Art. 16 GDPR),
• to have your data erased (Art. 17 GDPR),
• to have processing restricted (Art. 18 GDPR),
• to receive your data in a common format (Art. 20 GDPR),
• to object to processing based on our legitimate interest (Art. 21 GDPR).

To do so, write to us at hello@sourcenet.io. For the content of a workspace, contact the company that uses it (Section 4).

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Do you have to provide data? To use Capture you need an account with a name and an e-mail address; it doesn’t work without them. Everything else, such as a profile picture, is voluntary.

Automated decisions within the meaning of Art. 22 GDPR are not made.

11. Changes

If Capture or the law changes, we will update this notice. The version published here applies.