Privacy Policy

1. Controller

The controller responsible for processing personal data on the bleane platform is:

bleane GmbH Wandersmannstr. 64 65205 Wiesbaden Germany

For questions about data protection, contact us at hello@bleane.com.

2. Overview

This privacy policy explains which personal data we process when you visit our website, create an account, attend events or act as a host.

When you RSVP to an event or join a space, the respective host receives the data required for this. The host is responsible for any further processing of this data.

We do not use our own analytics or advertising trackers and do not make automated decisions that have legal effects on you or similarly significantly affect you.

3. Visiting the website

When you visit the website, we process technically necessary connection data: IP address, time and target of the request, browser and device information and, where applicable, the previously visited page. This serves to deliver the website, analyse errors and prevent misuse.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the secure and reliable operation of the Platform.

4. Account

For your account, we process your name, email address, an encrypted password or data from the sign-in method you chose, an optional profile picture and information about your active sessions.

The legal basis is Art. 6 (1) (b) GDPR, as this data is required to provide your account.

5. Events, RSVPs and spaces

When you RSVP to an event, buy a ticket or join a space, we process your registration, your answers to registration questions, your attendance or check-in status and content you post in spaces.

We share this data with the respective host to the extent required to run the event or the space. The legal basis is Art. 6 (1) (b) GDPR.

6. Processing on behalf of hosts

Hosts manage the data of their guests and members on bleane, for example in guest lists, segments or notes. In this respect, we process the data on behalf of the host under Art. 28 GDPR, and the host is the controller. Please direct requests about this data to the host first.

7. Payments

Payments for tickets and plans are processed by Stripe Payments Europe, Ltd., Ireland. Stripe processes your payment data, such as card details, and may also use it under its own responsibility to prevent fraud. We only receive the information we need to match the payment.

The legal basis is Art. 6 (1) (b) GDPR. We keep invoices and payment records for up to ten years due to commercial and tax law obligations (Art. 6 (1) (c) GDPR).

8. Emails and notifications

We send you emails required to use the Platform, for example for sign-in, confirmations, reminders and event changes. The legal basis is Art. 6 (1) (b) GDPR. We use the service Resend to send them.

We only send promotional emails with your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time with effect for the future.

9. Cookies and local storage

We only use technically necessary cookies and local storage, for example for your sign-in session, to prevent misuse and for settings such as language and color scheme. The legal basis is § 25 (2) no. 2 TDDDG in conjunction with Art. 6 (1) (b) or (f) GDPR. No consent is required for this.

10. Service providers and recipients

We use the following service providers to operate the Platform and have concluded data processing agreements with them under Art. 28 GDPR:

• Vercel Inc., USA: website hosting
• Render Services, Inc., USA: hosting of our server applications
• Supabase Inc., USA: database and data storage
• Resend, USA: sending emails
• Stripe Payments Europe, Ltd., Ireland: payment processing
• Functional Software, Inc. (Sentry), USA: error monitoring, with storage in the EU

11. Transfers to third countries

Some of our service providers are based in the USA or use global infrastructure. Transfers to third countries are based on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework, or on EU Standard Contractual Clauses.

12. Retention

We only store personal data for as long as necessary for the respective purpose. We delete account data when you delete your account. We only keep connection data for operation, error analysis and security, and longer only to investigate specific security incidents. Statutory retention obligations remain unaffected.

13. Your rights

Subject to the legal requirements, you have the following rights:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
• Objection to processing based on Art. 6 (1) (f) GDPR on grounds relating to your particular situation, and to direct marketing at any time (Art. 21 GDPR)

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 31 63, 65021 Wiesbaden, Germany, datenschutz.hessen.de.

15. Changes

We update this privacy policy when our Platform or the legal situation changes. The version published here applies.