Privacy Policy

Markus Kösel

Ahornhöhe 22

87437 Kempten (Allgäu)

Germany

Email: info@mandelcloud.com

Account, sign-in, Cockpit, Diary, Collection, profile, community features, billing, and support are processed to perform the contract or answer pre-contractual requests, Article 6(1)(b) GDPR.

Public profiles, published works, comments, upvotes, follows, remixes, and their visible origins are processed to provide the chosen platform functions and make the community visible, Article 6(1)(b) GDPR; where needed, also based on legitimate interests in a functioning, secure, and understandable service, Article 6(1)(f) GDPR.

Billing, tax, accounting, cancellation, and evidence data are processed to perform contracts and comply with legal obligations, Article 6(1)(b) and (c) GDPR.

Transactional emails sent by Mandelcloud through Mailjet and their delivery information are processed to perform contracts, communicate, troubleshoot, and maintain deliverability, Article 6(1)(b) and (f) GDPR. Open and click tracking is disabled for these messages. This statement does not cover payment and subscription notices sent by Paddle as an independent controller; the linked Paddle Privacy Notice applies to those messages.

Moderation, security records, abuse prevention, and legal enforcement are processed based on legitimate interests in platform protection, legal enforcement, and evidence, Article 6(1)(f) GDPR; statutory duties remain reserved.

Consent-based processing is used only when a function asks for explicit consent, Article 6(1)(a) GDPR.

Account data such as email address, display name, profile text, handle, profile image, and banner.

When registering and making new purchases, we record your confirmation that you are at least 18 and have reached the age of majority where you live, together with the time, language, and version of the accepted terms. This supports performing and evidencing the agreement and enforcing the age requirement, Article 6(1)(b) and (f) GDPR. We do not collect a date of birth or identity-document copy for this purpose in the normal registration and purchase process.

Usage and content data for sign-in, Cockpit settings, default scene, Diary, Collection, published works, comments, upvotes, follows, notifications, remixes, and their origins.

Saved scenes, public preview images, profile images, and other files you choose to upload.

Moderation reports, review requests, owner notices, decisions, statuses, handling notes, and timestamps.

Billing data such as plan, billing period, cancellation and payment status, references, and support notes. Full payment details are processed by the relevant payment provider; Mandelcloud does not receive full card details.

Email delivery data such as recipient address, message content and attachments, sending and delivery status, timestamps, technical message identifier, error and bounce information.

Security and usage data such as sign-in state, browser/device information, security events, and error records where required for operation, security, and troubleshooting.

When you publish a work, profile, or comment, the intended content and information are visible to others.

With “Image only,” the scene is not shared for remixing.

With “Image + scene,” the shared scene is provided for remixes and its origin remains visible.

If public remixes have already been created from a work, the necessary links may remain anonymised after account deletion so the origins of those works remain understandable.

IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, hosts the delivered website. Access and security logs are generated. According to IONOS product information, visitor data is generally retained for eight weeks and the IP address is anonymised in the web-hosting statistics made available to us. The legal basis is Article 6(1)(f) GDPR (secure and stable operation).

Google Cloud is used for sign-in, account management, data storage, file storage, secure processing, and abuse prevention. Google processes customer data as a processor and separate service data under the applicable contractual and privacy terms. According to the provider, parts of sign-in processing may take place in the United States; configured regions are used for storage locations that can be selected. Third-country transfers are safeguarded in particular by adequacy decisions and/or EU Standard Contractual Clauses.

For purchases through Paddle, Paddle is the reseller and an independent controller for the purchase. Paddle processes contact, billing, payment, transaction, device, and IP data for payments, tax, fraud prevention, and subscription management. Mandelcloud shares the account and order details needed to associate the purchase and receives purchase, subscription, and refund status to provide paid features (Article 6(1)(b) GDPR). Paddle's privacy notice identifies its entities, international processing, transfer safeguards, and your rights. This processing occurs when you use a Paddle purchase or related management function.

Mailjet is used to deliver transactional account, contract, support, privacy, moderation, and legal communications, including email verification, password reset, and account recovery messages. For this purpose, Mailjet processes in particular the recipient address, message content, action links and attachments, and sending, delivery, error, and bounce data. Open and click tracking is disabled for these messages. Technical delivery and error data continue to be processed for reliable delivery and troubleshooting.

Domain and mailbox providers are used for support, billing, privacy, and legal requests as well as operating the website.

Access by our team is restricted to authorised persons and is used for support, billing, privacy, legal, moderation, security, and operations cases.

Service providers may process data outside the EU/EEA. Where required, appropriate safeguards such as adequacy decisions, EU Standard Contractual Clauses, or equivalent mechanisms are used.

Account, profile, settings, Diary, Collection, and social data are generally stored for the duration of the account and deleted or anonymised after account deletion unless legal duties, security reasons, or third-party rights require otherwise.

Public works, comments, and profile content remain stored until deletion, removal, visibility restriction, or account deletion; links needed for already published remixes may remain anonymised after account deletion.

Plan changes, cancellation, payment failure, or an exceeded storage limit do not automatically delete existing content. They may block new paid actions or uploads. Deletion due to a long-term storage overage requires advance notice, an export option, and a defined period.

Billing, payment, invoice, cancellation, and tax-relevant records are retained as long as required for billing, evidence, statutory retention duties, and the establishment, exercise, or defence of claims; tax and commercial retention periods may last up to eight or ten years.

Support, privacy, legal, moderation, and security cases are retained for handling and then generally until ordinary limitation periods expire, unless a longer legal, security, or dispute-related reason applies.

Local browser data such as drafts, layouts, and exported files stays on your device and can be lost when browser or device storage is cleared.

Mandelcloud uses only storage needed for the requested service, account security, or settings you choose. Access to the device is based on section 25(2)(2) TDDDG; subsequent processing is based on Article 6(1)(b) or (f) GDPR depending on purpose. No analytics, advertising, or marketing cookies are used.

Sign-in state is stored in the browser so you can remain signed in. It remains until sign-out, account deletion, browser clearing, or the relevant session ends.

Google reCAPTCHA may be used to prevent automated attacks. Security and device information is sent to Google and reCAPTCHA may set the necessary `_GRECAPTCHA` cookie. This is used only for abuse and fraud protection under Article 6(1)(f) GDPR and section 25(2)(2) TDDDG.

Language, theme world, and other Cockpit settings are stored only after you select or use them.

For signed-in accounts, language, theme world, default scene, and Cockpit settings may also be saved with the account so they can be restored on the next sign-in.

Local caching may be used to preserve views, layouts, drafts, and work in progress in the current browser.

On checkout and customer-portal pages, Paddle may use its own cookies and similar technologies for payments, security, and subscription management. Paddle’s privacy and cookie notices additionally apply to these pages; any required consent is collected there.

The fonts used by Mandelcloud are served by Mandelcloud itself. Loading them does not connect to an external font provider.

Signed-in users can request a download of their account data from the account area.

A separate creations download can restore private Diary drafts as new drafts; public works are not republished automatically.

Account deletion is request-based. A data export is offered but is not a condition for accepting a deletion request. An active paid subscription must be cancelled separately and may delay final completion; the request is nevertheless accepted immediately and handled by our team.

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction of processing, data portability, and objection.

Where processing is based on consent, you can withdraw consent with effect for the future.

You may also lodge a complaint with a competent data protection supervisory authority.

Privacy requests can be sent to info@mandelcloud.com.