Privacy policy

Information pursuant to Art. 13 and 14 GDPR · Last updated: September 2026

This is a courtesy translation. The German version is the only legally binding version.

Controller

Missus GmbH
Ulrichsweg 53/2
8045 Graz, Austria
Email: privacy (at) difora (dot) eu

Privacy and security contact: management of Missus GmbH (Security & Privacy Lead). This contact role is not a designation as a statutory data protection officer.

(I) This website

This website uses no cookies, no third-party analytics or tracking services, and no social media plugins. We serve our own fonts, scripts and images. Our limited first-party measurement is described below.

Server log files

When you visit this website, the web server automatically processes technical access data (in particular IP address, date and time of access, page requested, browser type) to the extent technically necessary to deliver the website and ensure its stability and security. The legal basis is our legitimate interest in the secure operation of the website (Art. 6(1)(f) GDPR). This data is not combined with other sources and is deleted after a short period.

Design partner enquiry

If you submit the form on this website, we process the details you provide (email address and, optionally, name, company and your message) together with the language version you selected, in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or our legitimate interest in responding to your enquiry (Art. 6(1)(f) GDPR). We do not use this data for newsletters or any other advertising. The data is deleted once it is no longer required and no statutory retention obligations apply.

(II) Account, agreement and service

We process names, business email, organisation/membership, password/token hashes and quota usage counters. Company details, the accepting person’s name and verified email, time, declaration and exact terms are stored as organisation-contract evidence. Article 6(1)(b) GDPR applies to directly affected contracting persons; for staff/contacts we rely on legitimate interests in business administration and access protection (Article 6(1)(f)). Billing/statutory retention relies on Article 6(1)(c). Project, screenshot and review content is processed on the customer’s instructions as described in III.

A necessary session token is stored in browser localStorage without advertising use. Information comes from you, your inviting organisation and Mollie/VIES for payment/tax checks. Required account/agreement information is necessary to provide the affected service. We do not make solely automated decisions with legal or similarly significant effects under Article 22 GDPR.

Limited first-party measurement

We count visits to our home and comparison pages and the start of a registration separately, in aggregate. This creates no cookies, browser IDs or browser storage entries. A random receipt for each event prevents duplicate delivery; it is neither reused nor linked to a later account. Do Not Track and Global Privacy Control disable this browser measurement.

For newly created organisations, we record the first successful account verification, project and CI-token creation, upload, deliberate baseline approval, further completed build, plan selection and confirmed first payment. Records contain the event and time, organisation and optional project identifier, a hashed build reference and optional plan identifier. The reference to the registering account is removed after verification. These measurement records contain no screenshot content, token values, passwords, email addresses, IP addresses or browser identifiers.

Missus GmbH uses these limited operational records as controller to improve registration and product onboarding. The legal basis is our legitimate interest in that improvement (Art. 6(1)(f) GDPR). We do not use individual profiles for advertising or disclose these records to analytics providers. Only authorised administrators have access; internal and test organisations are excluded. You may object on grounds relating to your particular situation by contacting us at the address above. Technical access-data processing for security remains separate.

Organisation measurement records expire 90 days after organisation creation; deleting the organisation removes them earlier, and deleting a project removes its project events. Aggregate daily counts are kept for 90 days and individual delivery receipts for 24 hours. Cleanup runs daily; failed cleanup jobs can delay physical deletion. Copies in existing backups follow their backup retention cycle.

(III) Processing on behalf of customers and return

We process screenshots, baselines, differences, project/build metadata, discussions and reviews as a processor for your organisation, which determines content, purposes, users and recipients. Prefer synthetic test data. A valid main agreement and DPA are required before new processing. A verified authorised representative may review/save all texts beforehand and retrieve the exact receipt afterwards.

Owners may download available organisation data through authentication as gzip-compressed JSON lines with PNG images, including while acceptance is pending. Export before final organisation deletion; lawfully erased content is not reconstructed. The DPA and annexes govern deletion, return and backup limits.

(IV) Providers, locations and access

UpCloud Oy operates application/private database in Amsterdam and object storage for images, invoices and SQL backups in Frankfurt. Sendinblue SAS (Brevo) sends transactional account/verification/billing mail and configured project/review notifications containing metadata/links, without screenshot attachments. Brevo describes European storage but further provider/support access including India and the USA. EU storage does not mean exclusively European access.

Microsoft 365 provides business mailboxes. Its EU Data Boundary depends on tenant/service scope and includes documented transfer exceptions. Customer Processing Data must not be added to ordinary support emails without checked instructions and safeguards; use the protected application for images. Scaleway provides registry/DNS and Hetzner domain registration, without screenshot-processing instructions in those roles. Processors are bound under Article 28 GDPR within scope. Separate recipients outside the EEA require applicable adequacy decisions or suitable guarantees, including effective standard clauses/additional measures where needed; details/copies are available from our privacy contact.

Management operates the one-person business. Temporary travel access requires the DPA’s country/risk/security checks. There is no blanket third-country permission or staffed 24/7 on-call commitment. Provider changes follow the agreed notice/objection procedure. Customer Processing Data is not used for AI training.

(V) Payments and customer-selected recipients

Mollie B.V. receives necessary payment information as an independent controller, not screenshots; Mollie Invoice is not used. Payment details are collected in Mollie checkout. VIES checks supplied EU VAT IDs. Optional GitHub/GitLab/Bitbucket integrations and webhooks are customer-configured. They may transmit status, project/build context, links and, only with expressly enabled PR thumbnails, reduced image content to chosen recipients. Full images retain access controls. Recipient/proxy copies may outlast disabling; instructions and transfer safeguards apply. No data sales or newsletters from enquiries.

(VI) Retention

• Account/team information: while needed for use, then deletion; removing an individual does not erase a continuing organisation agreement.
• Contract evidence: relationship plus three years after organisation closure for evidence/legal defence under Article 6(1)(f). Specific documented statutory duties/proceedings may require longer bounded retention. This is not a universal statutory three-year period.
• Build contents: normally eligible after 90 days for completed builds not awaiting review. Ongoing/open reviews and needed baseline/discussion images remain protected. Inactive branch baselines follow project settings (60-day default), baseline history 365 days. Build summaries/settings remain until their scope is deleted.
• Finished/failed jobs and audit details: 30 days; minimal audit events and build-delivery history: 90 days. Review delivery history remains with the build. Daily bounded runs may be delayed by backlog/failure.
• Deletion instructions: active data without undue delay, within 30 days; own existing SQL backups up to a further 30 days after active deletion (normal cleanup threshold 28 days). No one aggregate 30-day promise for all provider copies. Separate provider records follow checked settings and bounded DPA procedures; Brevo’s period from termination of its whole agreement is not an individual Difora-customer period.
• Enquiries and technical operating logs: only while needed for handling or secure operation/incident analysis, with regular review/removal. Separately needed business/incident evidence remains purpose-limited and bounded; no fixed universal automatic mailbox/log period is claimed.
• Invoices: generally seven years from the end of the relevant calendar year under section 132 BAO, longer as necessary for relevant pending tax proceedings. This does not retain screenshot content.

(VII) Security

HTTPS and mandatory verified production SMTP TLS protect transport, without end-to-end mailbox encryption. Passwords/access tokens are hashed and integration secrets encrypted. UpCloud describes encryption at rest. Administrative access is restricted; device, MFA, access-review and incident procedures follow agreed safeguards. Affected organisations are notified of known breaches of their processing data without undue delay and within 48 actual hours. This is not a general 24/7 support promise.

(VIII) Your rights

You generally have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). An informal email to the address above is sufficient to exercise your rights.

If you believe that the processing of your data infringes data protection law, you may lodge a complaint with the Austrian Data Protection Authority: www.dsb.gv.at.