From 1814a76e74b73947241117d7ce47913ff206f93b Mon Sep 17 00:00:00 2001 From: Deeman Date: Sun, 22 Feb 2026 15:54:26 +0100 Subject: [PATCH] legal: add imprint page, upgrade privacy policy to GDPR-proper MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add /imprint route and template (§5 DDG compliant, Hendrik's details) - Rewrite privacy.html: data controller, legal basis per GDPR Art. 6, sub-processors (Paddle/Resend/Umami/Hetzner), retention periods, GDPR rights with article references, BfDI supervisory authority link - Add /imprint to sitemap.xml Co-Authored-By: Claude Sonnet 4.6 --- web/src/beanflows/public/routes.py | 7 + .../beanflows/public/templates/imprint.html | 56 ++++++++ .../beanflows/public/templates/privacy.html | 125 ++++++++++-------- 3 files changed, 134 insertions(+), 54 deletions(-) create mode 100644 web/src/beanflows/public/templates/imprint.html diff --git a/web/src/beanflows/public/routes.py b/web/src/beanflows/public/routes.py index 4748745..7afd75e 100644 --- a/web/src/beanflows/public/routes.py +++ b/web/src/beanflows/public/routes.py @@ -46,6 +46,12 @@ async def about(): return await render_template("about.html") +@bp.route("/imprint") +async def imprint(): + """Legal imprint (Impressum) — required by §5 DDG.""" + return await render_template("imprint.html") + + @bp.route("/methodology") async def methodology(): """Data methodology page — explains all data sources.""" @@ -119,6 +125,7 @@ async def sitemap_xml(): xml += url_entry(f"{base}/pricing", priority="0.8") xml += url_entry(f"{base}/terms", priority="0.3", changefreq="yearly") xml += url_entry(f"{base}/privacy", priority="0.3", changefreq="yearly") + xml += url_entry(f"{base}/imprint", priority="0.2", changefreq="yearly") # Add dynamic BeanFlows entries here (e.g. public commodity pages) xml += "" diff --git a/web/src/beanflows/public/templates/imprint.html b/web/src/beanflows/public/templates/imprint.html new file mode 100644 index 0000000..f8e063d --- /dev/null +++ b/web/src/beanflows/public/templates/imprint.html @@ -0,0 +1,56 @@ +{% extends "base.html" %} + +{% block title %}Imprint — {{ config.APP_NAME }}{% endblock %} + +{% block head %} + + +{% endblock %} + +{% block content %} +
+
+

Imprint

+

Legal disclosure pursuant to §5 DDG (Digitale-Dienste-Gesetz)

+ +
+ +
+

Service Provider

+

+ Hendrik Dreesmann
+ c/o COCENTER
+ Koppoldstr. 1
+ 86551 Aichach
+ Germany +

+
+ +
+

Contact

+

Email: {{ config.EMAIL_FROM }}

+
+ +
+

VAT

+

Small business owner pursuant to §19 UStG (Umsatzsteuergesetz). VAT is not charged and no VAT identification number is issued.

+
+ +
+

Responsible for Content

+

+ Hendrik Dreesmann
+ c/o COCENTER, Koppoldstr. 1, 86551 Aichach +

+

(pursuant to §18 Abs. 2 MStV)

+
+ +
+

Disclaimer

+

Despite careful content control we assume no liability for the content of external links. The operators of linked pages are solely responsible for their content.

+
+ +
+
+
+{% endblock %} diff --git a/web/src/beanflows/public/templates/privacy.html b/web/src/beanflows/public/templates/privacy.html index 6ede657..9545ff4 100644 --- a/web/src/beanflows/public/templates/privacy.html +++ b/web/src/beanflows/public/templates/privacy.html @@ -7,87 +7,104 @@

Privacy Policy

-

Last updated: January 2024

+

Last updated: February 2025

-
-
-

1. Information We Collect

-

We collect information you provide directly:

-
    -
  • Email address (required for account creation)
    • -
  • Name (optional)
    • -
  • Payment information (processed by Paddle)
    • +
    + +
    +

    1. Data Controller

    +

    + Hendrik Dreesmann
    + c/o COCENTER, Koppoldstr. 1, 86551 Aichach, Germany
    + Email: {{ config.EMAIL_FROM }} +

    +
    + +
    +

    2. Data We Collect

    +

    Data you provide directly:

    +
      +
    • Email address — required to create an account and deliver the service
      • +
    • Payment information — collected and processed by Paddle (we never see your card details)
    -

    We automatically collect:

    +

    Data collected automatically:

      -
    • IP address
      • -
    • Browser type
      • -
    • Usage data
      • +
    • IP address and browser type — used for security and abuse prevention
      • +
    • Session data — stored in a server-side cookie to keep you logged in
      • +
    • Usage data — anonymised page views collected by Umami Analytics (no cookies, no cross-site tracking)
    -
    -

    2. How We Use Information

    -

    We use your information to:

    +
    +

    3. Legal Basis (GDPR Art. 6)

      -
    • Provide and maintain the service
      • -
    • Process payments
      • -
    • Send transactional emails
      • -
    • Improve the service
      • -
    • Respond to support requests
      • +
    • Art. 6(1)(b) — Contract: email address and payment data, to provide and bill the service
      • +
    • Art. 6(1)(f) — Legitimate interest: security logs, anonymised analytics, fraud prevention
      • +
    • Art. 6(1)(c) — Legal obligation: invoicing records retained for 10 years as required by German tax law
    -
    -

    3. Information Sharing

    -

    We do not sell your personal information. We may share information with:

    +
    +

    4. Sub-processors

    +
    +

    Paddle (payments) — processes payment data on our behalf. Paddle Privacy Policy

    +

    Resend (transactional email) — sends magic-link and notification emails. Resend Privacy Policy

    +

    Umami (analytics) — self-hosted, anonymised page-view analytics. No cookies, no cross-site tracking, no personal data transferred to third parties.

    +

    Hetzner (hosting) — servers located in Germany (EU). Hetzner Privacy Policy

    +
    +
    + +
    +

    5. Cookies

    +

    We use only essential cookies:

      -
    • Service providers (Paddle for payments, Resend for email)
      • -
    • Law enforcement when required by law
      • +
    • Session cookie — keeps you logged in; expires when your session ends or after 30 days
      • +
    • CSRF token — protects form submissions; session-scoped
    +

    We do not use advertising, tracking, or third-party cookies. Umami Analytics is cookieless.

    -
    -

    4. Data Retention

    -

    We retain your data as long as your account is active. Upon deletion, we remove your data within 30 days.

    -
    - -
    -

    5. Security

    -

    We implement industry-standard security measures including encryption, secure sessions, and regular backups.

    -
    - -
    -

    6. Cookies

    -

    We use essential cookies for session management. We do not use tracking or advertising cookies.

    -
    - -
    -

    7. Your Rights

    -

    You have the right to:

    +
    +

    6. Data Retention

      -
    • Access your data
      • -
    • Correct inaccurate data
      • -
    • Delete your account and data
      • -
    • Export your data
      • +
    • Account data — retained while your account is active; deleted within 30 days of account deletion
      • +
    • Invoicing records — retained for 10 years as required by German tax law (§147 AO)
      • +
    • Security logs — retained for 30 days
      • +
    • Anonymised analytics — retained indefinitely (no personal data)
    -
    -

    8. GDPR Compliance

    -

    For EU users: We process data based on consent and legitimate interest. You may contact us to exercise your GDPR rights.

    +
    +

    7. International Transfers

    +

    All servers are located in Germany (EU). Paddle and Resend may process data outside the EU; both maintain EU Standard Contractual Clauses (SCCs) to ensure adequate protection.

    -
    +
    +

    8. Your Rights (GDPR)

    +

    As an EU resident you have the right to:

    +
      +
    • Access (Art. 15) — obtain a copy of your personal data
      • +
    • Rectification (Art. 16) — correct inaccurate data
      • +
    • Erasure (Art. 17) — delete your account and personal data
      • +
    • Restriction (Art. 18) — restrict how we process your data
      • +
    • Portability (Art. 20) — receive your data in a machine-readable format
      • +
    • Object (Art. 21) — object to processing based on legitimate interest
      • +
    +

    To exercise any of these rights, email {{ config.EMAIL_FROM }}. We respond within 30 days.

    +

    You also have the right to lodge a complaint with your national data protection authority. In Germany: BfDI.

    +
    + +

    9. Changes

    -

    We may update this policy. We will notify you of significant changes via email.

    +

    We may update this policy. For significant changes we will notify you by email at least 14 days in advance.

    10. Contact

    -

    For privacy inquiries: {{ config.EMAIL_FROM }}

    +

    Privacy enquiries: {{ config.EMAIL_FROM }}

    +