Data privacy

1. Data Controller

The entity responsible for data processing on this website and in connection with Blursafe within the meaning of the General Data Protection Regulation (GDPR) is:

Blursafe Owner: Timm Lehmann Osterland 6a 31832 Springe Germany Email: info@blursafe.com

2. General Information on Data Processing

The protection of your personal data is important to us. We treat personal data confidentially and in accordance with the applicable statutory data protection regulations and this privacy policy.

Personal data is any information relating to an identified or identifiable natural person. This may include, in particular, name, email address, IP address, hardware ID, payment and contract information, as well as technical usage data.

This privacy policy explains what personal data is processed, in particular when visiting our website, contacting us, receiving product information, purchasing and using Blursafe, as well as during licensing, software updates, and the use of external services.

3. Hosting and Website Provision

For the provision of our website, we use services from Framer as well as Alfahosting.

When accessing our website, technically required information that your browser automatically transmits may be processed. This may include, in particular:

–    IP address
–    Date and time of access
–    accessed page or file
–    Referrer URL
–    Browser type and version
–    Operating system used
–    Device information
–    Amount of data transferred
–    HTTP status code

This processing is necessary to technically provide the website and to ensure the stability and security of our services.

The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure, stable, and error-free provision of our online services.

Insofar as service providers process personal data on our behalf, this is done in accordance with Art. 28 GDPR.

In the case of internationally operating service providers, processing may take place outside the European Union or the European Economic Area. Where necessary, such transfer takes place in compliance with Art. 44 et seq. GDPR.

4. Contacting Us by Email

If you contact us by email, we process the personal data you provide to handle your request.

Our email mailboxes (@blursafe.com) are provided via Microsoft. When contacting us by email, the data you transmit is therefore also processed by Microsoft.

This may include, in particular:

–    Email address
–    Name, if provided
–    Content of your message
–    Time of contact
–    other voluntarily submitted information

If your inquiry serves the initiation or performance of a contract, processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR. For other inquiries, the processing is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the proper processing of and response to your inquiry.

The data will be deleted as soon as they are no longer required for processing and no statutory retention obligations or other legal reasons prevent deletion.

5. Product Information and Newsletter

On our website, you can send us a message via a contact form and sign up for product information, news, and updates about Blursafe.

We use Framer’s form functionality for the contact and support ticket forms. Subscriptions to product information, news and updates (newsletter) are processed through Formspark. The data entered in each form is transmitted to the respective service.

The following data, in particular, may be processed:

–    Name, if provided
–    Email address
–    Inquiry and content of your message
–    Date and time of transmission
–    technically required information for providing and securing the form

The processing of contact requests is carried out to handle your inquiry on the basis of Art. 6 para. 1 lit. b GDPR, insofar as it serves the initiation or performance of a contract, otherwise on the basis of Art. 6 para. 1 lit. f GDPR.

Processing for sending product information and newsletters is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR. Insofar as information is stored on or read from your end device for this purpose and consent is required, this is additionally carried out on the basis of Section 25 para. 1 TDDDG.

You can withdraw your consent at any time with effect for the future. An unsubscribe option is available in particular via an unsubscribe link that may be included in the respective message or by email to info@blursafe.com.

Insofar as the form provider processes personal data on our behalf, this is done in accordance with Art. 28 GDPR.

6. Google Analytics

If you have given your explicit consent, we use Google Analytics on our website.

Google Analytics is used to statistically evaluate the use of our website and to improve our offer.

The following information, in particular, may be processed:

–    visited pages
–    Time and duration of page views
–    approximate geographical origin
–    Device information
–    Browser information
–    Operating system
–    Interactions with our website
–    Origin of the website visit

Google Analytics may use cookies and comparable technologies for this purpose.

The processing is carried out on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR. Insofar as information is stored on or read from your end device, this is additionally based on your consent pursuant to Section 25 para. 1 TDDDG.

You can withdraw your consent at any time with effect for the future via the privacy settings of our website.

When using Google services, processing may be carried out by other companies of the Google Group, in particular in the USA. Where necessary, a transfer takes place in compliance with Art. 44 et seq. GDPR.

7. Consent and Cookie Management

We use CookieGuard (cookieguard.co), a service of AllCaps Technologies Inc., PO Box 1143, Frisco, TX 75035, USA, to collect, store and apply your privacy choices. Loading the service transmits technical connection data, including your IP address, to CookieGuard. The service also processes a visitor identifier, selected categories, the decision timestamp and country or region information. Your choice is stored in the cookie cookieguard_consent for up to 365 days; additional identifiers and pending consent records may be stored in browser local storage. CookieGuard also receives page views for service usage billing. Google Analytics is activated only with your consent. You can change or withdraw your choice at any time using the privacy icon. CookieGuard and its subprocessors may process data in the United States. Provider information on privacy and data processing is available at https://cookieguard.co/privacy and https://cookieguard.co/dpa. The dialog font is hosted locally on our server.

Analysis, tracking, and external media services are used in accordance with your selection.

This applies in particular to services such as:

–    Google Analytics
–    embedded YouTube videos
–    other external media or tracking services, if applicable

You can withdraw or change any consent given at any time with effect for the future.

Technically necessary processing may take place independently of consent, provided that a corresponding statutory legal basis exists.

8. Instagram

Our website may contain links to our profile on Instagram.

With simple links, a connection to Instagram is generally only established when you click on the corresponding link. After clicking, you leave our website and are redirected to the Instagram platform. Personal data may be processed there by companies of the Meta group of companies.

We generally have no influence on the nature, scope, and purposes of this processing.

For further processing, the data protection provisions of the respective platform operator apply.

9. LinkedIn

Our website may contain links to our company page or profile on LinkedIn.

With a simple link, a connection to LinkedIn is generally only established when you click on the corresponding link.

After clicking, you will be redirected to the LinkedIn platform. In particular, information about your access, your device, your IP address, and, if applicable, your LinkedIn user account may be processed.

LinkedIn explains in its privacy policy that when using its services, device and connection information such as IP address, browser, and device information, among other things, can be processed.

LinkedIn also uses cookies and comparable technologies, in particular in connection with plugins and other services on third-party sites.

Insofar as only a simple link to LinkedIn is used on the Blursafe website, a connection to the platform is generally only established by clicking on it.

§ 10 System Requirements

(1) The customer is responsible for providing the technical requirements necessary for use.
(2) Supported operating systems, platforms, architectures, and minimum requirements are specified in the respective current product description.
(3) Blursafe does not warrant functionality on systems that are explicitly not supported or in unsupported technical environments.
(4) Statutory warranty rights remain unaffected.

10. YouTube and Embedded Videos

Videos from the YouTube platform may be embedded on our website. YouTube is a service of Google.

To protect your privacy, we use the enhanced data protection mode offered by YouTube where possible for embedded YouTube videos, in particular via youtube-nocookie.com. YouTube provides this mode for embedded videos.

Loading only after consent

Embedded YouTube videos are generally only loaded after your consent.

Before your consent, only a placeholder should be displayed. A connection to the embedded YouTube player is only established after you have agreed to the use of external media or YouTube.

When loading or playing a YouTube video, the following data, in particular, may be processed:

–    IP address
–    accessed website
–    Browser and device information
–    Operating system
–    Time of access
–    Information about the use of the video
–    if applicable, information about your Google account, provided you are logged in there

Google points out that when embedding YouTube video content, certain browser and page information can be automatically transmitted to Google.

YouTube or Google may also use cookies and comparable technologies. For example, Google describes cookies used for YouTube settings and playback preferences.

The legal basis for the processing of personal data in connection with embedded YouTube content is Art. 6 para. 1 lit. a GDPR.

Insofar as information is stored on or read from your end device, this is additionally based on your consent pursuant to Section 25 para. 1 TDDDG.

You can withdraw your consent at any time with effect for the future via the privacy settings of our website. In the event of a transfer of personal data to the USA or other third countries, the requirements of Art. 44 et seq. GDPR are taken into account.

In addition, our website may contain simple links to our YouTube channel or individual YouTube videos. With such a simple link, a connection to YouTube is generally only established by clicking on it.

11. Booking Appointments via Cal.com

Our website may contain links for booking appointments via Cal.com.

With a simple link, a connection to Cal.com is only established when you click on the corresponding link. You will leave our website and be redirected to the appointment booking platform.

When using the appointment booking service, the contact details you enter as well as technical connection data can be processed there. For further processing, the data protection provisions of the respective platform operator apply.

12. External Platforms and App Stores

Insofar as Blursafe is offered in the future via platforms such as the Microsoft Store, the Apple App Store, or other external distribution platforms, personal data may be processed there under the responsibility of the respective platform operator. This may include, in particular:

–    User account data
–    Information about download or purchase
–    Payment information
–    Device information
–    technical usage data

The data protection provisions of the respective platform operator apply to these processing activities.

This section is only relevant in so far as Blursafe is actually offered via corresponding platforms.

13. Processing of Documents and Images

Blursafe processes documents and images locally on the user's device. This includes, in particular, document analysis, OCR, recognition, redaction, pseudonymization and – if activated – local AI functions. Document and image contents are not transferred to Blursafe or external AI or cloud services for this processing.

Local user learning also takes place on the device. No document texts or recognized personal content are permanently stored as learning data in plain text.

The license, payment, email, and update functions are technically separate from the processing of document content. The connections required for this do not serve the transmission or evaluation of processed documents.

14. Free Trial Phase

Blursafe can be tested free of charge for three days. To use this trial phase, neither the purchase of a license nor the provision of payment details is generally required.

To manage the trial phase, technically necessary information is stored locally on the device.

This may include, in particular:

–    Time of start of the trial phase
–    Status of the trial phase
–    technically required information to protect against manipulation

In addition, at the start of the trial phase, the application contacts Blursafe's licensing systems, provided an internet connection is available. The following data, in particular, may be processed:

–    a pseudonymous device identifier (salted hash value, see section 15)
–    Time of start of the trial phase
–    Version of the Blursafe software used
–    technically required connection data including the IP address
–    Country of origin derived from the IP address

On our systems, the start of the trial phase is stored and linked to the pseudonymous device identifier in order to prevent multiple uses of the free trial phase on the same device – for example, through reinstallation. If the license server is not reachable during the first start, the trial phase begins completely locally.

At the start of the trial phase, we derive the country of origin from the IP address and store it together with the trial phase data record; the IP address itself is not stored for this purpose. We use the country exclusively for statistical analysis of which countries Blursafe is tested from. It will be deleted after twelve months at the latest (see section 22).

The processing serves to determine the start, duration, and expiration of the free trial phase and to prevent abusive, unlimited use.

The processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR within the scope of pre-contractual use, as well as Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in protecting against abusive, unlimited use of the trial offer and in obtaining usage statistics by country.

15. License Activation, License Verification and Device Binding

For the activation, validation, and management of a Blursafe license, as well as for the management of the free trial phase, the application communicates with Blursafe's licensing systems.

After activation, the ongoing license check is generally performed locally on your device using a cryptographically signed proof of license. A connection to the license server is established in particular in the following cases:

–    when activating a license
–    after expiry of the local offline period (usually up to 14 days plus a short grace period of a few days)
–    in case of missing or damaged license proof
–    in case of significant deviations of the system clock
–    when releasing or reassigning a device (deactivation)

Instead of a raw hardware identifier, we process a pseudonymous device identifier: a salted SHA-256 hash value derived from a hardware identifier of your system. The underlying raw hardware identifier does not leave your device.

When communicating with the license systems, the following data, in particular, may be processed:

–    License key or technical license information derived therefrom
–    License status
–    pseudonymous device identifier of the device used
–    Information for assigning a device to a license
–    Version of the Blursafe software used
–    Time of activation and validation requests
–    IP address
–    country of origin derived from the IP address at the start of the trial (see section 14)
–    technically required security and log data

The pseudonymous device identifier serves in particular for device binding, managing the devices permitted for a license, and managing the free trial phase.

It is not used to analyze the contents of the documents or images processed with Blursafe.

The processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR, insofar as it is necessary for the activation, provision, and verification of a Blursafe license.

Insofar as the processing serves to protect against license misuse, manipulation, or attacks on our systems or for the statistical evaluation of use by country, it is carried out on the basis of Art. 6 para. 1 lit. f GDPR.

Our legitimate interest consists in protecting our software, our infrastructure, and our licensing system from abuse, as well as in generating usage statistics by country.

16. Software Updates

Every time the application starts, Blursafe automatically checks whether a new version of the software is available. For this purpose, the application retrieves an update file from Blursafe's update infrastructure.

The following technically required data, in particular, may be processed:

–    IP address
–    Time of the request
–    technical HTTP connection information including an identifier of the update component used

Information about your installed software version, your operating system, or your system architecture is not transmitted to our servers during this check. The selection of the version suitable for your system is made locally on your device.

An update found can be downloaded automatically and – depending on the operating system – installed in the background. The update function is an integral part of the application and serves in particular to provide security updates in a timely manner. The legal basis is Art. 6 para. 1 lit. b GDPR, insofar as the update function is part of the provided software service. Insofar as the processing serves the security and integrity of the software and infrastructure, it is additionally carried out on the basis of Art. 6 para. 1 lit. f GDPR.

17. Purchase of Blursafe and Payment Processing via Stripe

We use Stripe for payment processing when purchasing a Blursafe license.

Within the framework of the purchase and licensing process, the following information, in particular, may be processed by Blursafe:

–    Name
–    Email address
–    Stripe customer identifier
–    Checkout or session identifier
–    selected plan or associated price identifier
–    Payment status
–    Subscription identifier
–    Invoice identifier
–    Start and end of a billing period
–    Currency
–    amount information required for matching
–    technical reference identifiers for assigning payment, order, subscription, and license

Payment method details, such as complete credit card numbers, are processed directly by Stripe and are not stored by Blursafe.

Blursafe processes the information transmitted by Stripe in particular to

–    assign payments to an order,
–    provide purchased licenses,
–    manage subscriptions and renewals,
–    handle payment errors or cancellations, and
–    prevent duplicate or abusive processing.

The legal basis is Art. 6 para. 1 lit. b GDPR, insofar as the processing is necessary for the execution of the purchase or license contract. Insofar as data must be stored due to statutory commercial or tax requirements, processing is carried out on the basis of Art. 6 para. 1 lit. c GDPR.

18. License and Transaction Emails via Resend

Blursafe may use Resend for the technical dispatch of license, purchase, and other transactional emails.

The following data, in particular, may be processed:

–    Recipient's email address
–    Sender information
–    Subject
–    Content of the message
–    Time of dispatch
–    Delivery status
–    technical metadata of delivery

In the case of license emails, the message content may contain in particular information about the purchased license as well as for downloading the software.

Insofar as a license key is transmitted by email, it may also be processed by the email service provider used during technical delivery.

For the traceability of the dispatch, Blursafe can store in particular the recipient, purpose, time, and technical delivery status.

The processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR, insofar as the dispatch is necessary for the performance of the contract. Insofar as the processing serves secure, reliable, and traceable delivery, Art. 6 para. 1 lit. f GDPR may additionally apply.

19. No Permanent Storage of Processed Document Content on Blursafe Servers

Documents and images opened and processed by users in Blursafe are processed locally as a matter of principle.

Blursafe's license, payment, email, and update infrastructure is not intended to transmit or permanently store the contents of these documents or images on Blursafe servers.

License verification, payment processing, and software updates are technically separate from the actual processing of document content.

20. SSL or TLS Encryption

For security reasons, our website and the server connections intended for this purpose use SSL or TLS encryption.

This is intended to protect data from unauthorized access by third parties during transmission.

You can recognize an encrypted website connection in particular by the fact that the address begins with https://.

21. Server, Security and Audit Logs

When accessing our servers, technically required log data may be processed.

This may include, in particular:

–    IP address
–    Time of access
–    requested resource
–    HTTP status
–    technical client information
–    License and activation events
–    security-related events

Processing is carried out for provisioning, error analysis, traceability, and securing our systems, as well as for protection against abuse and attacks.

The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure and reliable operation of our systems.

22. Storage Duration

As a matter of principle, personal data is only stored for as long as is necessary for the respective processing purpose or as long as statutory retention obligations exist.

For Blursafe, the following principles apply in particular:

–    License, customer, purchase, and subscription data may be stored for the duration of the contractual relationship and beyond, insofar as this is necessary for license management, billing, verification, legal defense, or statutory retention obligations.
–    Technical audit and security data are only stored for as long as is necessary for traceability, security, and abuse prevention.
–    Trial phase data records: The pseudonymous device identifier and the start of the trial phase are stored for as long as is necessary to prevent multiple uses of the free trial phase; since the device identifier permanently prevents a new trial phase on the same device, no automatic deletion takes place in this respect. The country recorded at the start of the trial is deleted after 12 months at the latest.
–    Access logs of the admin system are cleaned up according to technically defined retention periods.
–    Stripe payment and webhook data can be stored as far as this is necessary for reliable and traceable purchase, payment, and subscription processing.
–    Email and delivery data can be stored by the email service providers used for technically necessary periods.
–    Data for which statutory commercial or tax retention obligations exist are stored for the legally prescribed period.

After the respective purpose ceases to apply and relevant retention periods expire, personal data is deleted or anonymized, unless there is another legal basis for further storage.

23. Recipients of Personal Data

Within the scope of the processing activities described, personal data may be transmitted in particular to service providers whom we use for the operation and provision of our services.

These may include, in particular:

–    Hosting and infrastructure companies
–    Payment service providers
–    Email service providers
–    Form providers
–    Analytics providers, provided you have consented to this
–    Providers of external media such as YouTube, provided you have consented to this
–    IT and security service providers

Disclosure only takes place if there is a legal basis for it or if you have consented.

Insofar as service providers act as processors on our behalf, they are used in accordance with Art. 28 GDPR.

24. Data Transfer to Third Countries

When using internationally operating service providers, personal data may be processed outside the European Union or the European Economic Area.

Insofar as a transfer to a third country takes place, we observe the requirements of Art. 44 et seq. GDPR.

Depending on the provider, an adequacy decision of the European Commission or appropriate safeguards such as standard contractual clauses can be used for this purpose.

25. Legal Bases of Processing

Depending on the nature and purpose of the data processing, we base the processing of personal data in particular on the following legal bases:

Art. 6 para. 1 lit. a GDPR – Consent

if you have given us consent to process personal data for a specific purpose.

Art. 6 para. 1 lit. b GDPR – Contract and pre-contractual measures

if processing is necessary for the performance of a contract or to carry out pre-contractual measures.

Art. 6 para. 1 lit. c GDPR – Legal obligation

if processing is necessary for compliance with a legal obligation.

Art. 6 para. 1 lit. f GDPR – Legitimate interests

if processing is necessary to protect our legitimate interests or the interests of a third party, and the interests or fundamental rights and freedoms of the data subject do not override those interests.

26. Your Rights

Under the statutory conditions, you have the following rights in particular:

–    Right of access pursuant to Art. 15 GDPR
–    Right to rectification pursuant to Art. 16 GDPR
–    Right to erasure pursuant to Art. 17 GDPR
–    Right to restriction of processing pursuant to Art. 18 GDPR
–    Right to data portability pursuant to Art. 20 GDPR
–    Right to object pursuant to Art. 21 GDPR
–    Right to withdraw consent pursuant to Art. 7 para. 3 GDPR

You can withdraw any consent given at any time with effect for the future.

The lawfulness of the processing carried out on the basis of the consent until withdrawal remains unaffected by this.

To exercise your rights, you can contact the following address:

–    info@blursafe.com

Right to Object

Insofar as we process personal data on the basis of Art. 6 para. 1 lit. f GDPR, you have the right, under the statutory conditions, to object to the processing at any time for reasons arising from your particular situation.

If personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for this purpose.

27. Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

For Blursafe's registered office, the following supervisory authority, in particular, is competent:

The State Commissioner for Data Protection of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen)

–    Prinzenstraße 5
–    30159 Hannover

Germany

The right to contact another data protection supervisory authority competent under statutory regulations remains unaffected.

28. Automated Decision-Making

Decision-making based solely on automated processing, including profiling within the meaning of Art. 22 GDPR, does not take place as a matter of principle, unless explicitly stated otherwise in a specific process.

Automated technical decisions for license validation, device binding, abuse detection, or software provisioning serve to execute and secure the respective technical functions and are not used to create comprehensive personal user profiles.

29. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy if this becomes necessary due to technical changes to our website, the Blursafe software, service providers used, or due to changed legal requirements.

The current version published on our website shall apply.

As of: September 2026