Privacy Policy

1. Controller

The controller within the meaning of the GDPR is the operator of suggar.me named in the Imprint.
Privacy contact: privacy@suggar.me

2. Data Processed and Purposes

2.1 Server Logs (Website Visits)

With every page request, our server automatically records:

• IP address (automatically deleted after 7 days)
• Date and time of the request
• Requested URL, HTTP method, status code
• Browser and operating system (user agent)

Purpose: Security, error detection, protection against misuse.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

2.2 Registration as a Creator

To create a Creator account, the following mandatory information is collected:

• First and last name
• Email address
• Username
• Password (encrypted with bcrypt — no plaintext access possible)
• Country (to verify EU eligibility for creator registration)

You may optionally also provide: a phone number (only for the optional SMS variant of two-factor login), display name, bio, profile picture, banner image, accent color, social links. When purchasing a paid creator plan, billing country, business type and, where applicable, a VAT ID are additionally collected.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

2.3 Login and Two-Factor Authentication

Login is via email and password. With every login, a 6-digit one-time code (OTP) is additionally sent by email; optionally by SMS if a phone number is on file. OTP codes are stored only temporarily and are automatically deleted after use or after 15 minutes.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(f) GDPR (security interest).

2.4 Payments (Supporters and Creators)

Payment data (card numbers, bank details) is processed exclusively by Stripe, Inc. (510 Townsend St., San Francisco, CA 94103, USA) as part of Stripe Connect. We do not store any complete payment data.

We receive from Stripe: transaction ID, amount, payment status and — if provided by the supporter — name, email and message. These are displayed to the Creator in the dashboard and stored internally.

The creator's Stripe Connect account ID is processed for payouts to creators. As part of the legally required identity verification (Know Your Customer, KYC), Stripe collects additional identification data directly from the creator (e.g. an identity document); this data is processed exclusively by Stripe and never passes through the Operator's servers.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Third-country transfer (USA): EU Standard Contractual Clauses (Art. 46 GDPR). Stripe's privacy policy: stripe.com/de/privacy

2.5 Statistics / Page View Tracking

With your express consent (cookie banner), we record anonymized view counts per Creator profile. IP address and user agent are logged internally in the process. No cross-session profiles are created and no data is shared with third parties.

Legal basis: Art. 6(1)(a) GDPR (consent), Section 25(1) of the German Telecommunications and Digital Services Data Protection Act (TDDDG).
Withdrawal: At any time via Cookie Settings in the footer.

2.6 Transactional Emails

We send necessary emails: a welcome message upon registration, OTP codes at login, notifications about incoming payments. This processing is necessary for the performance of the contract.

Legal basis: Art. 6(1)(b) GDPR.

3. Disclosure of Data

Data is only disclosed to:

• Stripe, Inc. — payment processing and Creator payouts (Stripe Connect). Privacy policy: stripe.com/de/privacy
• Email delivery provider — for transactional emails; exclusively on the basis of a data processing agreement (Art. 28 GDPR)
• Authorities — where and to the extent we are legally obligated to do so

Data is not disclosed for advertising or other purposes.

4. Retention Period

• Account and profile data: Until account deletion; deleted within 30 days upon request
• Transaction data: 10 years (Sections 147 AO, 257 HGB — commercial and tax-law retention obligation)
• Server logs: 7 days, then automatically deleted
• OTP codes: Immediately after use or after 15 minutes
• Raw statistics data (IP, user agent): 7 days; aggregate counts indefinitely
• Cookie consent: 12 months
• Session tokens: Valid for a limited time; see the Cookie Policy for exact durations

5. Your Rights under the GDPR

You have the following rights with respect to us:

• Access (Art. 15) — to data stored about you
• Rectification (Art. 16) — of inaccurate or incomplete data
• Erasure (Art. 17) — insofar as no retention obligations apply
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection (Art. 21) — to processing based on legitimate interests
• Withdrawal of consent (Art. 7(3)) — at any time with effect for the future, e.g. cookie consent via Cookie Settings

Requests to: privacy@suggar.me

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the state authority responsible for your place of residence or the German Federal Commissioner for Data Protection and Freedom of Information (BfDI).

6. Cookies and Tracking Technologies

We use technically necessary cookies (JWT session tokens) as well as — with your consent — statistics cookies. Detailed information including all cookie names, durations and legal bases can be found in our Cookie Policy. Consents can be managed or withdrawn at any time via Cookie Settings in the footer.

7. Technical Security

All connections are TLS/SSL-encrypted (HTTPS). Passwords are hashed with bcrypt — no plaintext access is possible. JWT tokens are signed with server-side secrets and are valid for a limited time. Payment data never leaves our infrastructure and is processed directly by Stripe.

8. Changes to This Policy

We reserve the right to amend this Privacy Policy. The current version is always available at suggar.me/datenschutz. Registered Creators will be informed by email of any material changes.

Last updated: September 2026