Privacy

Privacy policy under the GDPR · last updated 17 October 2026

This website has no tracking, no analytics, no ads and no cookies. Fonts, images and scripts are all served from this site, so your browser does not contact other companies while you read it. What little data does come up is listed here.

1. Who is responsible

The controller under Art. 4(7) GDPR is:

Email: [email protected]

2. Hosting and server data

The site is hosted on Cloudflare Pages, run by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Every time a page is loaded, your browser sends technical data to the server: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. This is needed to deliver the page and to keep it safe from attacks.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a site that works and is secure). We do not keep our own logs of this data and do not combine it with other data. Cloudflare processes it on our behalf under a data processing agreement (Art. 28 GDPR). Data may be transferred to the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and also uses the EU Standard Contractual Clauses.

3. Your city next to the clock

The bar at the top shows the time where you are, labelled with your city. The time comes from your own device. The city is estimated by Cloudflare from your IP address and handed back to your browser by a small function on this site. The city is not stored and not logged by us. Legal basis: Art. 6(1)(f) GDPR (our interest in a friendly, local greeting).

4. The cookie note

When you close the cookie note by eating it, your browser remembers that in its local storage (the entry nf-cookie with the value 1), so the note does not come back. This entry stays on your device, contains no personal data and is never sent to us. It is strictly necessary to provide the function you asked for (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

5. When you email us

If you write to us, we use your email address, your name and what you write to answer you and, if it comes to that, to prepare and carry out a project. Legal basis: Art. 6(1)(b) GDPR (steps before and for a contract) and Art. 6(1)(f) GDPR (answering enquiries). We delete the messages when they are no longer needed, unless tax or commercial law requires us to keep them (usually 6 or 10 years under § 257 HGB and § 147 AO). Our email is hosted by Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, in its EU data centre, which processes it on our behalf under a data processing agreement (Art. 28 GDPR).

6. The free tools

The free tools under /tools/ run in your browser. What you type into them is not sent to us and not stored. One exception: the email setup check looks up the public DNS records of the domain you enter. For that, your browser sends the domain name and your IP address to Cloudflare's public DNS service (cloudflare-dns.com), run by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, which answers the lookup. Legal basis: Art. 6(1)(f) GDPR (our interest in offering the check you started). Cloudflare is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). The lookup only starts when you press the button.

7. Northframe Builder and Northframe Collect

Our two apps run on our own server at Oracle Cloud Infrastructure in the Frankfurt data centre (Germany): Northframe Builder at builder.northframesites.com and Northframe Collect at collect.northframesites.com. Oracle processes the data on our behalf under a data processing agreement (Art. 28 GDPR). The database, the uploaded files and the backups stay on this server; we keep the last 14 daily backups.

Builder. When you create an account we store your name, your email address and a hash of your password (never the password itself), your workspaces and team roles, the sites you build and the images you add. A sign-in cookie keeps you signed in; it is technically necessary, only valid for this app and is not used for tracking. To protect accounts we briefly use your IP address to limit repeated sign-in attempts. Legal basis: Art. 6(1)(b) GDPR (providing the app you signed up for) and Art. 6(1)(f) GDPR (security). We keep the data while your account exists and delete it when you ask us to, apart from the rolling backups, which are overwritten within 14 days.

Collect. We use Collect to gather texts, logos, photos and PDFs from our clients through private links. Uploads are checked for viruses on the same server, location and camera details are removed from photos, and nothing is shared with third parties. Clients find a privacy page inside Collect, linked from their project page. Legal basis: Art. 6(1)(b) GDPR (carrying out the website project). We delete project content after the project, unless tax or commercial law requires us to keep parts of it.

Emails from both apps (sign-in links, invitations, notifications) are sent through our email provider Zoho, see section 5. Optional features that would send data to other services (sign-in with Google, AI features, stock photo search) are switched off; if we switch one on, we will add it here first.

Payments. If you buy an export in the Builder, the payment is handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment details directly on Stripe's checkout page; we never see your card details. For the invoice, the checkout also asks for your billing name and address and, optionally, your VAT ID. Stripe tells us the payment status, your email address and the amount, creates the invoice and keeps the payment and invoice records for us. Legal basis: Art. 6(1)(b) GDPR (the purchase) and Art. 6(1)(c) GDPR (tax and commercial record keeping, usually 10 years under § 147 AO). Stripe may transfer data to Stripe, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Stripe's own privacy policy: https://stripe.com/privacy.

8. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on our legitimate interests (Art. 21). To use these rights, an email to the address above is enough.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example the one for our location: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI).

9. Nothing automatic

We make no automated decisions and do no profiling. You do not have to give us any data to read this website.