Privacy Policy

This page explains which personal data are processed when you visit endocraft.app or enter something on it: why I process them, on which legal basis, who else receives them and how long I keep them. Personal data means any information that can be linked to you, for example your email address or your device's IP address.

1. Controller

The controller responsible for data processing on this website is:

Marco Enders
EndoCraft
Virchowstraße 29
67227 Frankenthal
Germany

Email: marco@endocraft.app
Contact form: in the Impressum (legal notice)

Write to me there with any questions about data protection or to exercise your rights (section 11).

2. Visiting the website

The website is hosted on Cloudflare Pages. When you load a page, your browser technically has to send data to the server. Cloudflare processes these data: your IP address, date and time, the address requested, the page you came from, your browser and operating system, and connection details. This is necessary to deliver the page, to load it fast and to fend off attacks. Cloudflare may also receive error reports from your browser about failed connections (Network Error Logging).

Legal basis: Art. 6(1)(f) GDPR. My legitimate interest is a secure, available and fast website.

Retention: According to Cloudflare, these data are kept only for a limited period. In my Cloudflare account I only see aggregated figures, such as the number of requests, and no individual visitors.

Cookies: The website sets no cookies. Only if Cloudflare considers a request suspicious and shows a security check can Cloudflare set a technically necessary security cookie. The legal basis for that is § 25(2) no. 2 of the German TDDDG.

Fonts: All fonts are served from this server. Your browser loads nothing from Google Fonts or other font services.

Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare acts as my processor. The data processing agreement is part of Cloudflare's terms. On the transfer to the USA, see section 10.

3. My server for forms and the Studio

The contact form, email sign-ups, the Studio and the counter on the free page for Dungeon Masters talk to my server at endocraft-production.up.railway.app. In doing so, your IP address, date and time, the address requested and your browser are transmitted.

Railway keeps access logs of these requests, including the IP address, for 7 days on my plan. My server itself does not write email addresses or message contents to its log. To prevent abuse, it counts how often an IP address sends something within a short time (for example at most five messages in 15 minutes). These counters exist only in working memory and are not stored permanently.

Legal basis: Art. 6(1)(f) GDPR, my interest in secure operation free of abuse. For what you do through the server, the legal basis of the respective section applies in addition.

Provider: Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA. Its representative in the EU is DP-Dock GmbH, Ballindamm 39, 20095 Hamburg, Germany. The server runs in the US West region (California, USA). Railway acts as my processor.

4. Contact form and email

If you write to me through the contact form in the Impressum, I process your name, your email address, your message and the time. My server sends the message through the email service Resend to my address marco@endocraft.app. From there, Cloudflare forwards it to my mailbox at an email provider in Germany. My server does not store the message. Against spam, the form has an invisible field and checks how quickly it was submitted. No third-party services such as a captcha are used for this.

If you email marco@endocraft.app directly, the email also goes through Cloudflare to the same mailbox.

Purpose and legal basis: I only use your details to answer your request. If it concerns a contract or an order, the legal basis is Art. 6(1)(b) GDPR; otherwise Art. 6(1)(f) GDPR (my interest in answering requests).

Retention: I delete the request once it has been dealt with and no follow-up questions are expected. It is kept longer only where commercial or tax law requires retention, for business letters up to six years, for example.

Provider: Plus Five Five, Inc. ("Resend"), 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend sends the emails from Ireland (region eu-west-1) but stores messages and delivery data in the USA and deletes them according to its own retention periods. The data processing agreement is part of Resend's terms. According to Cloudflare, it stores no content when forwarding.

5. Emails you sign up for

You can enter your email address on three pages. What you get afterwards depends on the page:

• Free scene for Dungeon Masters (endocraft.app/free/): after confirming, you receive the scene by email. A few days later, a second email follows with a free one-shot and an offer from my Etsy shop. There are no further emails in this series.
• New stream scenes (endocraft.app/streamers/free/): one message when there is a new scene. There is no email series.
• EndoCraft Studio (Studio pages): news about the Studio, mainly early access and a launch discount.

How confirmation works (double opt-in): After you sign up, I send you an email with a confirmation link. Only when you confirm on the linked page are you on the list. Without confirmation you receive no further email, and I delete the sign-up after 30 days.

What is stored:

• your email address and the list you signed up for,
• the times of the sign-up, the confirmation email and the confirmation,
• your IP address and your browser identifier (user agent) at sign-up, and your IP address at confirmation,
• which page or campaign you came from (for example "pinterest" or campaign details from the link),
• which emails I have sent you and when you unsubscribed.

Purpose and legal basis: I send you the emails you requested. The legal basis is your consent under Art. 6(1)(a) GDPR. I store the times and IP addresses so that I can prove your consent (Art. 7(1) GDPR); the legal basis for that is Art. 6(1)(f) GDPR. I use the source details to see which channels work (Art. 6(1)(f) GDPR).

Unsubscribing and withdrawal: Every email contains an unsubscribe link. You can also simply write to me. Unsubscribing takes effect immediately. Withdrawing your consent does not affect the lawfulness of what happened on the basis of your consent before.

Retention: Your data stay stored as long as the list is running for you. For the free scene, it ends with the second email; for stream scenes and the Studio, when you unsubscribe. After that, I keep the address, times and IP addresses for three more years to be able to prove consent, and then delete them. I delete unconfirmed sign-ups after 30 days.

No tracking: I do not measure whether you open an email or click a link. The links in the emails only contain general campaign details (such as "welcome_email") and no identifier that leads back to you. If your email program loads the images in an email, they come from endocraft.app; the connection data from section 2 arise in the process.

Service providers: Delivery is handled by Resend (section 4). Storage is in the Supabase database (section 7).

6. Wishes

After signing up for the free scene and on the Studio's founding page, you can send me a wish, for example which character should appear in your scene. I store your text, the page and, if you entered it, your email address. I need the address to match the wish to your sign-up. I do not store your IP address for this.

Legal basis: Art. 6(1)(b) GDPR insofar as I create something for you in return, such as the announced scene. Otherwise Art. 6(1)(f) GDPR, my interest in learning what people would like.

Retention: If the wish belongs to a confirmed sign-up, as long as that sign-up (section 5). Otherwise I delete it after one year.

7. EndoCraft Studio

In the Studio, which is still in a closed test phase, you use an invite code to create images and short videos from a description.

Invite code: The code and your credits are kept in my database. If you received the code from me by email, it is linked to your email address there.

Creating: For an image, my server sends your description and, if given, your feedback to Anthropic, where an AI model turns it into a detailed image prompt. That prompt goes to AI/ML API, where the image or video is created. Neither your IP address nor your code nor your email address is sent to these providers. Please do not write names or other personal details into your description.

What is stored: For each image, I store in the database your code, your description, the generated image prompt, your feedback, the addresses of the generated images, the variant you chose, the time and your IP address. The IP address is used only to prevent abuse; I remove it after 30 days. I use the rest to show you your images and to improve the Studio. I delete it on request, and at the latest 12 months after creation.

Sharing: If you save an image for sharing, I create it under a random link, together with the description, the image address and the code. Anyone who knows the link can see the image. I delete the link on request, and at the latest after 12 months.

Buying: Credits cannot currently be bought in the Studio. If that changes, I will update this policy first.

Legal basis: Art. 6(1)(b) GDPR, because you use the Studio and requested an invite code for it. Abuse prevention and improving the Studio are based on Art. 6(1)(f) GDPR.

Providers:

Anthropic Ireland, Limited

6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. According to Anthropic, inputs and outputs are deleted within 30 days and not used for training. Processing may take place in the USA (section 10).

AI/ML API (Boiler Labs FZ-LLC)

RAKEZ Business Zones, Business Center 03, Unit B04-515, Ras Al Khaimah, United Arab Emirates. Only the image prompt and, for videos, the source image are sent there. The generated images are initially stored on this provider's servers. On the transfer, see section 10.

Supabase Pte. Ltd. (database)

65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. The database is located in the West EU (Ireland) region. The data processing agreement is part of Supabase's terms. On access from outside the EU, see section 10.

8. Storage in your browser

Only the Studio stores information in your browser's storage (local storage):

• your invite code, so you do not have to enter it on every visit,
• your last known credit balance, so it shows immediately,
• whether you dismissed the "install as app" hint.

The Studio also sets up a service worker. It stores the Studio's program files in your browser so that it can be installed like an app and opened without a connection. This storage contains no personal details. The information does not leave your browser on its own; the Studio only sends the code to my server when you use it.

Legal basis: § 25(2) no. 2 TDDDG, because storing it is strictly necessary for the Studio to work the way you want to use it. You can delete this information at any time by clearing the site data for endocraft.app in your browser; you will then have to enter the code again.

No other page stores anything in your browser.

9. Links and my profiles on platforms

The website links to my shop on Etsy, to itch.io and Fiverr, and to my Pinterest profile. As long as you do not click, no data go to these platforms. If you click, the privacy policy of that platform applies there. If you buy on Etsy, your contract is concluded via Etsy, and Etsy is responsible for its own processing (Etsy Ireland UC, 5th Floor, One Le Pole Square, Ship Street Great, Dublin 8, Ireland).

My profiles on Instagram, TikTok and Pinterest: When you visit them, the platforms process your data under their own privacy policies. I see what you do publicly there, such as comments and likes, and I receive aggregated statistics from the platforms that do not let me identify individuals. For these statistics, the platform and I may be joint controllers (Art. 26 GDPR). You can exercise your rights most effectively directly with the platform, but you can also contact me. The legal basis for my profiles is Art. 6(1)(f) GDPR, my interest in getting in touch with interested people.

• Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
• TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland
• Pinterest: Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland

TikTok integration: I use the official TikTok Content Posting API solely to upload my own videos as drafts to my own TikTok account. I do not process data of other TikTok users in doing so.

10. Recipients and transfers outside the EU

Apart from me, only these service providers receive data. They process them on my behalf and only on my instructions. I do not sell data and do not share them for advertising.

Cloudflare (USA): hosting, email forwarding

The transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). Cloudflare is certified under it.

Railway (USA, server in California): forms and Studio

Data Privacy Framework (Art. 45 GDPR). Railway is certified.

Resend (USA): email delivery

Data Privacy Framework (Art. 45 GDPR). Resend is certified.

Supabase (Singapore; database in Ireland)

The data are stored in the EU. For access from Singapore or other third countries, the EU standard contractual clauses (Art. 46(2)(c) GDPR) in the data processing agreement apply.

Anthropic (Ireland; processing also in the USA): image prompts in the Studio

EU standard contractual clauses (Art. 46(2)(c) GDPR) in the data processing agreement.

AI/ML API (United Arab Emirates): image and video creation in the Studio

There is no adequacy decision by the European Commission for the Emirates, and I have not agreed standard contractual clauses with AI/ML API. For that reason, only image prompts and source images go there, no IP addresses, codes or email addresses. If you still write personal details into your description, they are sent along, because the image creation you requested is not possible otherwise. This is based on Art. 49(1)(b) GDPR.

My email provider (Germany)

Your messages to me end up in its mailbox.

You can check the status of a certification at dataprivacyframework.gov. On request, I will tell you where to find the standard contractual clauses.

11. Your rights

You have the right of access to your stored data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). Write to me at marco@endocraft.app.

12. Complaints to the supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example where you live. The authority responsible for me is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34, 55116 Mainz, Germany
Postfach 30 40, 55020 Mainz
www.datenschutz.rlp.de

13. Other information and changes

You are not obliged to give me any data. Without your email address, however, I cannot send you emails or answer the contact form, and without a code the Studio does not work. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

If something changes on the website or in the services, I will update this policy. The version published here applies.