Privacy Policy

Last updated: 2026-05-06

1. Overview

StringStar ("the Platform") is operated by Concepts for You GmbH, Am Tiefen Graben 2, 85757 Karlsfeld, Germany. We take the protection of your personal data very seriously. This privacy policy explains what data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR).

2. Data Controller

Concepts for You GmbH
Am Tiefen Graben 2
85757 Karlsfeld, Germany
Email: info@conceptsforyou.de
Commercial Register: München, HRB 174336
VAT ID: DE263733130

3. Data We Collect

We collect the following categories of personal data:

  • Account Data: Name, email address, and authentication credentials (processed via Firebase Authentication by Google).
  • Usage Data: Stringing orders, customer profiles, inventory data, and analytics stored in our database (hosted on Supabase, EU region).
  • B2B API Data: Incoming order data from connected external web shops (e.g., Shopify) is processed for automated job creation.
  • Payment Data: Payment and billing information processed by Stripe Inc. StringStar does not store credit card numbers.
  • Location Data: Approximate location for the Shop Finder feature, processed by Mapbox Inc.
  • Support Data: Support ticket content may be processed by the Google Gemini API for automated assistance.
  • Analytics Data: With your consent, we collect anonymized usage data such as page views, referrers, device type, and approximate geographic region via Google Analytics (GA4). No personally identifiable information is collected through analytics.

4. Third-Party Processors

We use the following third-party services, all bound by data processing agreements:

  • Firebase Authentication (Google LLC): User authentication and identity management. Privacy: firebase.google.com/support/privacy
  • Supabase Inc.: Database hosting (EU-based servers). Privacy: supabase.com/privacy
  • Stripe Inc.: Payment processing (PCI DSS Level 1 compliant). Privacy: stripe.com/privacy
  • Mapbox Inc.: Geolocation and map services for Shop Finder. Privacy: mapbox.com/legal/privacy
  • Google Gemini API (Google LLC): AI-powered support ticket processing and intelligent extraction of B2B webhook order data for automated stringing job creation. Privacy: ai.google.dev/terms
  • Google Analytics 4 (Google LLC): Website analytics to understand how visitors use our website, activated only with your explicit consent. Google may process data on servers in the United States under Standard Contractual Clauses. Privacy: policies.google.com/privacy. Opt-out: tools.google.com/dlpage/gaoptout

5. Legal Basis for Processing

We process your data based on: (a) performance of a contract (Art. 6(1)(b) GDPR) when providing our services; (b) legitimate interests (Art. 6(1)(f) GDPR) for security and service improvement; (c) your consent (Art. 6(1)(a) GDPR) for analytics cookies (Google Analytics) and optional features like the Shop Finder location services. You may withdraw your consent for analytics at any time by clearing your browser cookies or declining when the cookie banner is shown.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. After account deletion, data is removed within 30 days, except where legally required to retain it (e.g., tax records for 10 years). Analytics data collected by Google Analytics is retained for 14 months and is not linked to your personal account.

7. Your Rights

Under the GDPR, you have the right to: access your data, rectify inaccurate data, erase your data ("right to be forgotten"), restrict processing, data portability, object to processing, and withdraw consent. To exercise any of these rights, contact us at info@conceptsforyou.de.

8. Data Transfers

Our primary database is hosted within the EU. Some third-party processors (Firebase, Stripe, Mapbox, Gemini, Google Analytics) may transfer data to the United States under appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission.

9. Cookies

StringStar uses the following types of cookies:

  • Essential Cookies: Required for authentication and session management. These are always active and do not require consent.
  • Analytics Cookies (Google Analytics): Used to collect anonymized usage statistics such as page views, session duration, and referral sources. These cookies (e.g., _ga, _ga_*) are only set after you give explicit consent via our cookie banner. If you decline, no analytics cookies are placed and no analytics data is collected. We use Google Consent Mode v2, which ensures that analytics tracking is fully deactivated until you consent.

You can change your cookie preferences at any time by clearing your browser cookies for stringstar.app. The cookie banner will reappear on your next visit.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or in-app notification.