Privacy Policy

This is an English translation for convenience. The German version (“Datenschutzerklärung”) is the legally binding version.

1. Overview

The protection of your personal data is important to us. This policy explains which data we process when you visit this website (apzura.com), for what purpose, and on what legal basis.

We process personal data in particular when you contact us via the contact form or by email, and in the form of technically necessary server log files. Fonts are served locally from our server; no external CDNs or font services are used.

2. Controller

The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Email: support@apzura.com

3. Hosting and Server Log Files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you access the website, Vercel, as our processor, processes technically necessary access data (server log files), in particular:

• IP address of the requesting device
• date and time of access
• the page or file accessed and the amount of data transferred
• referrer URL (the previously visited page)
• the browser type and operating system used

This data is required to deliver the website, to ensure security and stability, and to defend against attacks. The legal basis is our legitimate interest in a secure and functional operation (Art. 6 (1) (f) GDPR). Regarding transfers to the USA, see the section “Transfer to Third Countries”.

4. Contacting Us (Contact Form and Email)

When you contact us via the contact form or by email, we process the data you provide in order to handle your request. For the contact form, this includes in particular:

• name
• email address
• phone number (optional)
• the content of your project description and your other details (e.g. project status, desired platform, selected features, optional link)

Providing your name, email address, and project description is required in order to answer your request; all other fields are optional.

The legal basis is the performance of pre-contractual measures or the performance of a contract (Art. 6 (1) (b) GDPR), insofar as your request is aimed at concluding or preparing a contract, and otherwise our legitimate interest in responding to inquiries (Art. 6 (1) (f) GDPR). In addition, you confirm your consent in the form to the processing of your data for the purpose of handling your request (Art. 6 (1) (a) GDPR), which you can withdraw at any time with effect for the future.

The technical delivery of the messages sent via the form is handled by the service provider Resend, Inc. (USA); see the sections “Recipients and Third-Party Providers” and “Transfer to Third Countries”. We store the request data until your matter has been fully processed and no statutory retention obligations prevent deletion.

5. Cookies and Consent

This website uses cookies and similar technologies. Technically necessary cookies are required to operate the site and are set without consent. We only use all non-necessary technologies (statistics, marketing) if you have actively consented via our consent banner (opt-in).

On your first visit, we ask for your consent. You can allow or reject individual categories and change or withdraw your choice at any time with effect for the future via the “Cookie settings” link in the footer. The legal basis for consent-requiring technologies is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG).

For Google services we use Google Consent Mode v2. Before your consent, no Google tags are loaded and no cookies used for statistics or marketing are set.

6. Google Analytics 4

After your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar identifiers to analyze the use of the website statistically (e.g. pages visited, time spent, approximate origin, device used).

The IP address is truncated by Google and not stored permanently. We do not merge this data with other data sources. The usage data collected is automatically deleted after the retention period we have selected (by default up to 14 months).

The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG), which you can withdraw at any time with effect for the future. A transfer of data to Google LLC in the USA is possible; see the section “Transfer to Third Countries”.

7. App Idea (AI-Assisted App Idea Generator)

On the “App Idea” page, you can have an AI suggest an app idea. Your inputs (e.g. industry, business name, location and optional website, or hobby/interest and goal) are processed solely to generate the suggestion. Providing personal data is not required – please do not enter any sensitive or personal data.

For generation, we use the interface of OpenAI, L.L.C. (USA) as a processor. In business mode, the model additionally performs a web search on the specified business to make the suggestion more precise. Your inputs are transmitted to OpenAI; according to OpenAI, data submitted via the API is not used to train the models.

To prevent abuse and control costs, we limit the number of requests. For this purpose, we process your IP address via the service Upstash (Upstash, Inc., USA) to assign requests to a quota; this processing takes place only for this purpose and only for a short time. The legal basis is our legitimate interest in secure, abuse-free operation and in providing this feature (Art. 6 (1) (f) GDPR).

The suggested app ideas are non-binding, automatically generated sketches and do not constitute advice or an offer. Regarding transfers to the USA, see the section “Transfer to Third Countries”.

To protect against automated abuse (bots), we use Cloudflare Turnstile before submission (Cloudflare, Inc., USA). This processes technical information about your browser as well as your IP address to check whether the request comes from a human. The legal basis is our legitimate interest in abuse-free operation (Art. 6 (1) (f) GDPR).

8. Recipients and Third-Party Providers

We use the following service providers as processors for the operation of the website:

• Vercel, Inc. (based in the USA) – hosting and delivery of the website. Basis: legitimate interest; data processing agreement; standard contractual clauses.
• Resend, Inc. (based in the USA) – technical delivery of messages sent via the contact form. Basis: pre-contractual measures or legitimate interest; data processing agreement; standard contractual clauses.
• Google Ireland Limited (Google Analytics) – based in Ireland; transfer to Google LLC (USA) possible. Function: statistical audience measurement. Basis: consent; standard contractual clauses.
• OpenAI, L.L.C. (based in the USA) – AI-assisted generation of app ideas incl. web search in business mode. Basis: legitimate interest or pre-contractual measures; standard contractual clauses.
• Upstash, Inc. (based in the USA) – limiting the number of requests per IP (rate limit) for the app idea generator. Basis: legitimate interest; standard contractual clauses.
• Cloudflare, Inc. (based in the USA) – bot and abuse protection (Cloudflare Turnstile) for the app idea generator. Basis: legitimate interest; standard contractual clauses.

Beyond this, we only share your data if we are legally obliged to do so.

9. Transfer to Third Countries

Vercel (USA) and Resend (USA) process data in the United States. For these transfers, standard contractual clauses (SCC) of the European Commission and data processing agreements (DPA) are in place. To our knowledge, both providers are also certified under the EU-U.S. Data Privacy Framework. Despite these safeguards, there is a general risk in the USA of access by U.S. authorities.

When using Google services (Google Analytics), data may be transferred to Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses are additionally in place. This processing only takes place after your consent.

When using the app idea generator, data is transferred to OpenAI (USA) and Upstash (USA). For these transfers, standard contractual clauses of the European Commission are in place. Despite these safeguards, there is a general risk in the USA of access by U.S. authorities.

For bot protection (Cloudflare Turnstile), data is additionally transferred to Cloudflare (USA). For this transfer, standard contractual clauses of the European Commission are in place; here, too, there is a general risk in the USA of access by U.S. authorities.

10. Retention Period

• Server log files: generally for a short period for security and stability purposes (usually up to 30 days), unless a security-relevant event requires longer storage.
• Contact requests: until your matter has been fully processed and until any statutory retention periods have expired.

11. Your Rights

Under the GDPR, you have the following rights:

• access to the data stored about you (Art. 15)
• rectification (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• objection to processing (Art. 21)
• withdrawal of consent given with effect for the future (Art. 7 (3))
• lodging a complaint with a supervisory authority (Art. 77)

To exercise your rights or for questions about data protection, you can reach us at support@apzura.com. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Rheinland-Pfalz).

12. Data Security

Access to this website and the transmission of your form data take place exclusively in encrypted form via TLS (recognizable by “https://” and the padlock symbol in your browser’s address bar).

13. Changes to This Policy

We will update this privacy policy if the legal situation or our processing changes (e.g. when introducing new features or services). The version published on this page applies; you can find the current status at the beginning of this policy.