Politique de confidentialité

Framebird UG (haftungsbeschränkt), Eberswalder Str. 29, 10437 Berlin, Germany (“Framebird”, “we”, “us”, or “our”) is the controller for the personal data described in this policy unless another role is stated.

For privacy questions or to exercise a data-protection right, email legal@framebird.io. For general product support, email contact@framebird.io.

This policy explains how Framebird processes personal data when you visit our websites, create or use an account, use our web, desktop, mobile, browser-extension, sharing, or support features, subscribe to marketing, or otherwise interact with us. It does not govern a third party's independent processing where that third party provides its own privacy notice.

Customer Content may contain personal data about people other than the account holder. The customer that uploads or shares that content is responsible for having a lawful basis and giving any notice required for that processing. Where Framebird processes Customer Content solely on a customer's documented instructions, the parties' roles are determined by applicable law and any applicable data-processing agreement.

A person who receives a Share link may be able to access its Customer Content and collaboration data, subject to the password, expiry, and other access settings you select. Recipients may be able to download or upload Media, comment, annotate, or change review statuses where you enable those features. You are responsible for choosing appropriate settings and for the people to whom you or your recipients disclose a Share link.

If you participate in a Share, information you submit—including your display name, comments, annotations, review choices, and uploaded Media—may be visible to the Share owner and other permitted recipients according to the Share's settings.

Depending on how you use Framebird, we may process:

• Contact and identity data: name, email address, country, language, profile image, and organization or Workspace details.
• Account and authentication data: account and Workspace identifiers, sign-in methods, linked social-login identifiers, passkey metadata, account settings, permissions, and security events.
• Customer Content and collaboration data: uploaded Media and its metadata, Galleries, Collections, Shares, Canvases, comments, annotations, review activity, filenames, and sharing or access settings.
• Subscription and transaction data: plan, billing period, billing country and address, Merchant of Record, transaction and subscription identifiers, status, purchase history, and transactional analytics. Framebird does not receive full payment-card details.
• Communications data: support requests, feedback, emails, survey responses, and other information you choose to send us.
• Usage, device, and log data: IP address, approximate location derived from IP, browser, device and operating-system information, language, timestamps, requested URLs, referrer, diagnostic data, security events, feature interactions, and service-performance data.
• Marketing and consent data: newsletter subscriptions, campaign and referral information, marketing preferences, cookie choices, legal-document versions accepted, acceptance time and source, and interactions with communications or advertisements.
• Legal-request and moderation data: withdrawal and cancellation declarations, content reports, the reported URL and reason, request and decision records, action taken, and related correspondence.

We ask you not to upload special-category or highly sensitive personal data unless it is necessary for your permitted use of the Services and you have an appropriate legal basis and safeguards.

Where we rely on legitimate interests, we balance those interests against your rights and reasonable expectations. Where we rely on consent, you may withdraw it at any time for the future.

Framebird does not sell Customer Content. Framebird does not use Customer Content for advertising or to train general-purpose artificial intelligence or machine-learning models.

Paid Framebird orders are sold through a Merchant of Record. Lemon Squeezy is the Merchant of Record for new Framebird subscriptions created before 10 August 2026. Paddle.com is the Merchant of Record for new Framebird subscriptions created on or after 10 August 2026. Existing Lemon Squeezy subscriptions, including renewals, remain managed by Lemon Squeezy. The Merchant of Record identified at checkout, on your receipt, or in your customer portal is authoritative. The applicable provider is the seller for the transaction and processes payment, billing, tax, invoicing, fraud-prevention, refund, and chargeback data for its own purposes.

To start and manage a purchase, Framebird may disclose your name, email address, country, billing or business details, selected product and price, account identifier, and transaction metadata to the applicable provider. The provider collects payment details, IP address, billing address, tax information, and other data needed to complete and protect the transaction. Framebird receives buyer names and addresses, email addresses, purchase history, subscription status, and transactional analytics, but not full payment-card details.

Framebird and the Merchant of Record each act as an independent controller for their own processing. Review the Paddle Privacy Notice or, for a legacy transaction, the Lemon Squeezy Privacy Policy. Payment processing is necessary to take pre-contract steps and perform the contract (Art. 6(1)(b) GDPR), comply with legal obligations (Art. 6(1)(c)), and pursue legitimate interests such as fraud prevention and dispute resolution (Art. 6(1)(f)).

When you request a Framebird website or service, our systems and infrastructure providers process technical request data such as IP address, timestamp, URL, request headers, browser, device, response status, and security signals. This is necessary to deliver the requested page or feature, prevent abuse, diagnose failures, and keep the Services secure.

We use cookies, local storage, and similar technologies. Strictly necessary technologies support functions such as authentication, security, language, and consent choices. Optional technologies may support product and website analytics, chat, campaign measurement, and advertising. Depending on your choices and the page or service used, these providers may include PostHog, Tidio, Google, Microsoft Advertising, and Meta.

Where consent is required, optional technologies are not activated before you opt in. You can reject them or select individual categories in the cookie banner. You may withdraw consent for the future by reopening cookie settings and changing your selection. You can also delete or block cookies through your browser, although strictly necessary features may then stop working.

Exact provider names and lifetimes can change when a provider updates its software. The browser's storage controls show the current items on your device. Optional choices are off by default; “Accept” enables all optional choices, “Reject” keeps them off, and “Save selection” applies only the categories you selected.

We disclose personal data only as needed to:

• infrastructure, hosting, storage, content-delivery, database, security, and media-processing providers;
• authentication providers you choose, such as Google or Apple;
• communications, newsletter, customer-support, analytics, error-monitoring, and operational-event providers;
• the Merchant of Record and its payment, tax, fraud-prevention, and support partners;
• professional advisers, auditors, insurers, courts, regulators, or authorities where legally required;
• a buyer or successor in a merger, financing, reorganization, or sale, subject to appropriate confidentiality and data-protection safeguards.

Providers that process personal data on Framebird's behalf are listed on our Subprocessors page, together with their purpose, relevant data, processing location, and legal or privacy reference. Other recipients—including authentication providers, Merchants of Record, professional advisers, and authorities—may act as independent controllers for their own processing.

Some recipients may process data outside the European Economic Area. Where a transfer requires safeguards, we use a lawful transfer mechanism such as an adequacy decision, the EU-U.S. Data Privacy Framework where applicable, or European Commission Standard Contractual Clauses, together with supplementary measures where appropriate. You may contact us for information about the safeguards relevant to your data.

Business customers for whom Framebird processes Customer Personal Data can use our Data Processing Agreement, including its processing instructions, security, assistance, deletion, subprocessor, and transfer terms.

We retain personal data only for as long as needed for the purposes described above. Retention depends on the type of data, the account and feature lifecycle, customer instructions, security and backup needs, limitation periods, disputes, and statutory accounting, tax, or recordkeeping obligations.

You can initiate deletion of your Framebird account through your account settings. You may also contact legal@framebird.io about a deletion request or another data-protection right.

• Account data and active Customer Content are generally kept while the account or relevant feature remains active.
• Customer-deleted or storage-enforcement content may remain recoverable in Trash for the period shown in the product. The current storage-over-limit process uses seven days before permanent removal from active storage.
• An account-deletion request immediately schedules cancellation of an active renewal and ends active sessions. We aim to remove account data and Customer Content from active systems within 30 days after verification, subject to legal holds and the exceptions below.
• Access-restricted backup copies may remain until overwritten through normal backup cycles. They are not restored to active use except for disaster recovery, and deletion rules are reapplied after a restore.
• Transaction, invoice, tax, fraud-prevention, and legal records are retained for the periods required by the applicable Merchant of Record and by commercial, tax, and other laws.
• Support, security, and diagnostic records are retained for the period reasonably needed to resolve the matter, protect the Services, and establish or defend legal claims.
• Consent, Terms-acceptance, cancellation, withdrawal, content-notice, and decision records are retained as needed to demonstrate and honor choices, declarations, legal duties, and limitation periods.

We may keep information that has been irreversibly anonymized because it no longer identifies an individual.

We use technical and organizational measures designed to protect personal data against unauthorized access, alteration, loss, or disclosure. No internet or storage system is completely secure. You are responsible for protecting your credentials and for promptly reporting suspected account compromise.

Framebird is not directed to children under 16, and we do not knowingly collect their personal data. A person must be at least 18 to purchase a paid plan. If you believe a child provided personal data without valid authorization, contact us so we can investigate and take appropriate action.

Depending on the law that applies, you may have the right to:

• withdraw consent at any time for future processing (Art. 7(3) GDPR);
• access your personal data and obtain a copy (Art. 15);
• correct inaccurate or incomplete data (Art. 16);
• request deletion (Art. 17);
• restrict processing (Art. 18);
• receive portable data or have it transmitted where technically feasible (Art. 20);
• object to processing based on legitimate interests and object at any time to direct marketing (Art. 21);
• not be subject to certain solely automated decisions with legal or similarly significant effects (Art. 22);
• lodge a complaint with a competent supervisory authority (Art. 77).

To exercise a right, email legal@framebird.io. Withdrawal and subscription cancellation declarations can also be submitted through the dedicated public functions linked in the site footer. We may need to verify your identity and clarify the scope of a privacy request. Rights may be subject to lawful exceptions. For Paddle-held transaction data, you may also contact Paddle Buyer Support. For data held by a legacy Merchant of Record, contact Lemon Squeezy Support.

Framebird's lead local supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information. You may instead contact the authority for your habitual residence, place of work, or the place of an alleged infringement.

Framebird does not currently make decisions about you based solely on automated processing that produce legal or similarly significant effects within Art. 22 GDPR. A Merchant of Record or security provider may use automated fraud-prevention tools under its own notice. If Framebird introduces covered automated decision-making, we will provide the information and safeguards required by law.

We may update this policy to reflect changes in law, providers, or our processing. We will update the date on the page and provide additional notice where a change materially affects your rights or where the law requires it.