Privacy policy for sumthink.io

Controller

Die Quadratur UG (haftungsbeschränkt)
Sierichstraße 120
22299 Hamburg
Germany

Managing Director: Christian Durlej
E-Mail: info@die-quadratur.de

sumthink is a brand operated by Die Quadratur UG (haftungsbeschränkt). This policy covers the public website and the member platform at sumthink.io.

Hosting and server logs

The website is hosted by Lovable Labs Incorporated and delivered through Cloudflare, Inc. as content delivery network. When you open a page, the infrastructure processes connection data such as IP address, date and time of the request, requested URL, referrer, HTTP status and browser user agent. This data is required to deliver the site, to keep it stable and to defend against attacks.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure and functional website. Server log data is deleted or aggregated after a short period, as a rule within 30 days, unless it is needed to investigate a security incident.

Cookies and local storage

We do not use tracking cookies, advertising cookies or third party analytics. If you sign in to the member platform, the authentication token of our backend provider is stored in your browser's local storage. This storage is strictly necessary to provide the service you explicitly requested, Sec. 25(2) no. 2 TDDDG, so no consent banner is required. Signing out removes the token.

On the public website we also store your language choice and whether you dismissed the language hint in your browser's local storage. This storage is necessary for the presentation you chose (Sec. 25(2) no. 2 TDDDG).

Fonts

Web fonts are served locally from our own hosting. No request is sent to Google Fonts or any other font CDN when you load a page, and no IP address is transmitted to a font provider.

Project request form

When you send us a project request, we process the data you enter: name, e-mail address, company, project stage, project description, any files you upload, an optional NDA request and, if present in the URL you arrived from, campaign parameters (UTM source, medium, campaign). The data is stored in our backend (Supabase, hosted in the European Union) and is used only to assess and answer your request.

Legal basis: Art. 6(1)(a) GDPR for the consent you give with the checkbox and Art. 6(1)(b) GDPR for pre-contractual communication. You can withdraw your consent at any time with effect for the future. We keep the request until it is handled and any statutory retention periods have expired, or until you ask us to delete it.

Member platform

Registered members can create a profile and use collaboration features. Depending on what you enter or upload, we process: account data (e-mail, password hash handled by our authentication provider), profile data (name, handle, headline, biography, skills, tags, links, optional contact details), uploaded CV documents, portrait images, project and build data, posts and comments, direct messages, session participation, notifications and usage state such as read markers.

Legal basis: Art. 6(1)(b) GDPR, performance of the membership relationship, and Art. 6(1)(f) GDPR for the secure operation of the platform. We send transactional e-mails, for example invitations, reminders and notifications. Every such e-mail contains an unsubscribe link for the non essential categories. Member data is deleted when you close your account, minus data we must keep by law.

AI processing

Some features send content to the Lovable AI Gateway, which routes the request to Google Gemini models. This happens only when you actively use the feature and only for the purpose of producing the result you asked for. The affected features are: idea refinement on the project request form, CV scan and career analysis, AI portrait generation, pitch deck generation, sparring interviews and feed curation.

Your input is processed to generate the output. We do not use it to train our own models, the providers do not use it to train their models on our behalf, and it is never used for advertising or profiling. Human judgment reviews AI output where it matters, that is the Actual Intelligence stance.

Legal basis: Art. 6(1)(b) GDPR where the feature is part of the service you requested, otherwise Art. 6(1)(a) GDPR based on your consent. Do not paste content into AI features that you are not allowed to share.

Voice dictation

Where we offer voice input, the feature uses the speech recognition built into your browser. Depending on your browser and operating system, the audio may be transmitted to and processed by the browser vendor, for example Google or Apple, under their own privacy terms. We receive only the resulting text. The feature starts only when you activate it.

AI transparency (EU AI Act Art. 50)

Features that use artificial intelligence are labeled as AI in the interface. Images generated by AI, for example generated portraits and pitch deck imagery, carry a visible "AI-generated" label. Feed content that is curated or drafted by our AI pipeline is marked as such on the post itself. When you interact with an AI assisted feature, the interface tells you before you submit content.

Recipients and processors

We work with processors under Art. 28 GDPR: our hosting and content delivery providers, our backend and database provider (Supabase, EU region), our AI gateway provider and the connected model providers, and our transactional e-mail provider. Where a transfer to a third country takes place, it is based on the EU Standard Contractual Clauses or an adequacy decision.

Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise your rights, contact us at info@die-quadratur.de.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.