Last updated: August 2026

Privacy

1 · Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

Represented by: Ingo Lange
Company registration number: HE 496668
E-mail: admin@wellstack.de

2 · General information on data processing

We process our users' personal data only to the extent necessary to provide a functioning website and our content and services. Personal data is generally processed only with the user's consent. An exception applies where obtaining prior consent is not possible for practical reasons and processing is permitted by law.

Where we obtain consent for processing operations, Article 6(1)(a) GDPR serves as the legal basis. Where processing is necessary for the performance of a contract, Article 6(1)(b) GDPR serves as the legal basis.

3 · Categories of data processed

In the course of our services we process the following categories of personal data:

• Master data: name, e-mail address, profile picture where applicable
• Usage data: progress, completed sessions, routines and comparable activity data within our applications
• Payment data: transaction information, subscription status
• Communication data: the content of enquiries sent by e-mail
• Technical data: IP address, browser type, operating system, device identifiers, times of access
• App usage data: interactions within our applications and dashboards

This website itself is static. It has no sign-in, no forms and no analytics tools. Simply visiting this website generates only the data described under 4.1 and 4.5.

4 · Hosting and technical infrastructure

4.1 Vercel (hosting of this website)

This website is hosted by Vercel Inc., 340 Pine Street Suite 701, San Francisco, CA 94104, USA. When our website is accessed, technical data is recorded automatically, namely IP address, browser type, pages accessed and time of access. Vercel stores this data in server log files and deletes it automatically after a short period. The transfer of data to the USA is safeguarded by the European Commission's standard contractual clauses. Legal basis: Article 6(1)(f) GDPR. Further information: vercel.com/legal/privacy-policy

4.2 Supabase (database and authentication)

For storing user data, authentication and real-time database functions we use Supabase Inc., 970 Toa Payoh North, #07-04, Singapore 318992. Supabase processes personal data, including e-mail addresses, encrypted passwords and application data, on our behalf on the basis of a data processing agreement under Article 28 GDPR. Further information: supabase.com/privacy

4.3 Microsoft Azure (cloud services)

For selected backend services and compute resources we use Microsoft Azure (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Processing takes place on the basis of a data processing agreement. Data may be processed in data centres within the EU or in third countries with an adequate level of protection. Further information: privacy.microsoft.com

4.4 GitHub (code hosting and delivery)

Source code and deployments are managed via GitHub, Inc., 88 Colin P Kelly Jr Street, San Francisco, CA 94107, USA, a subsidiary of Microsoft. GitHub does not process any personal end-user data in this context, only metadata of the development process.

4.5 Google Fonts

This website loads typefaces from Google Fonts, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When a page is accessed, your IP address is transmitted to a Google server so that the fonts can be delivered. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in a consistent presentation. Further information: policies.google.com/privacy

5 · Payment processing

5.1 Stripe

For processing payments we use Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe collects and processes payment data, that is card or bank details and transaction information, directly and on its own responsibility in accordance with PCI-DSS standards. We receive only a confirmation of payment and a unique transaction identifier. Payment data is not passed on to us in full. Legal basis: Article 6(1)(b) GDPR. Further information: stripe.com/privacy

5.2 RevenueCat (in-app purchases and subscriptions)

For managing in-app subscriptions in our mobile applications we use RevenueCat, Inc., 633 Taraval Street Suite 101, San Francisco, CA 94116, USA. RevenueCat processes transaction information, device identifiers and subscription status. The transfer of data to the USA takes place on the basis of standard contractual clauses. Legal basis: Article 6(1)(b) GDPR. Further information: revenuecat.com/privacy

6 · Video hosting and media delivery

For delivering video content within our applications we use Bunny.net (BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia). When videos are retrieved, technical data such as IP address, device used and content requested is processed by the Bunny.net CDN in order to ensure fast and stable delivery. Processing takes place on the basis of our legitimate interests under Article 6(1)(f) GDPR and on the basis of a data processing agreement. Further information: bunny.net/privacy

7 · Transfers to third countries

Some of the service providers we use are based outside the European Union, for example in the USA. Where personal data is transferred to third countries, we ensure an adequate level of protection through appropriate safeguards, in particular:

• EU standard contractual clauses under Article 46(2)(c) GDPR
• adequacy decisions of the European Commission, where available
• certifications under the EU-U.S. Data Privacy Framework

8 · Our own applications and client projects

Wellstack develops and operates its own applications and also builds applications and platforms for clients. In data protection terms these are two different roles:

• Our own portfolio applications. Here Wellstack Limited is the controller within the meaning of Article 4(7) GDPR. This privacy policy applies, together with the privacy information provided inside the respective application.
• Applications we build and operate for clients. Here Wellstack Limited acts towards end users as a processor within the meaning of Article 28 GDPR. Responsibility for the lawful collection and processing of end-user data lies with the respective client as the operator of the application. In that case, privacy information for end users is provided separately by the respective operator.

The categories of data processed typically comprise user profile, progress data, messages, payment data and device-related information. Data is stored in encrypted form in the infrastructure operated at Supabase and, where applicable, Azure.

9 · Contacting us by e-mail

If you contact us by e-mail, the data you provide, that is your name, e-mail address and the content of your message, is stored for the purpose of handling your enquiry and in case of follow-up questions. We do not pass this data on without your consent. Legal basis: Article 6(1)(f) GDPR. The data is deleted once your enquiry has been dealt with conclusively and no statutory retention obligations prevent deletion.

10 · Cookies and local storage

This website uses no marketing or tracking cookies. Only technically necessary cookies and local browser storage mechanisms required for secure operation are used. A consent banner is not required for technically necessary cookies under section 25(2) TDDDG.

11 · Retention periods

• Server log files: automatic deletion after 30 days at the latest
• Contact enquiries: deletion once conclusively dealt with, after 3 years at the latest
• Contract data and proof of payment: 10 years in accordance with commercial and tax retention obligations
• User accounts: until the account is deleted at the user's request, followed by prompt deletion subject to statutory obligations

12 · Your rights as a data subject

• Right of access under Article 15 GDPR
• Right to rectification under Article 16 GDPR
• Right to erasure under Article 17 GDPR
• Right to restriction of processing under Article 18 GDPR
• Right to data portability under Article 20 GDPR
• Right to object to processing under Article 21 GDPR
• Right to withdraw consent under Article 7(3) GDPR

To exercise your rights please contact admin@wellstack.de.

13 · Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data at any time. As a Cypriot company, the competent authority is:

Alternatively you may contact the data protection authority of your habitual residence.

14 · Data security

We use technical and organisational security measures to protect your data against accidental or intentional manipulation, loss, destruction and access by unauthorised persons. These include in particular:

• encrypted data transmission via TLS and HTTPS
• encrypted data storage in the database infrastructure
• access control following the principle of least privilege
• regular security reviews of the services used

15 · Currency and amendment of this privacy policy

This privacy policy is dated August 2026. As our products and services develop, or as a result of changed statutory or regulatory requirements, it may become necessary to amend it. The current version is always available at this address.