Privacy Policy
Last updated: July 2026
1. Data Controller
The controller responsible for data processing on this platform (Lemoyn) within the meaning of the GDPR is:
Maximilian Auer
Brucknerstraße 12
4961 Mühlheim am Inn, Österreich
Email: hallo@lemoyn.com
2. Processors & Third Parties
We use the following service providers to whom personal data is transmitted:
| Service | Purpose | Region | Legal basis |
|---|---|---|---|
| Supabase | Database, authentication, file storage | EU/Frankfurt ✅ | Art. 6 I b |
| Netlify | Hosting, CDN, website delivery | USA ⚠️ | Art. 6 I f (DPF) |
| Mapbox | Interactive maps & address search | USA ⚠️ | Art. 6 I a (consent) |
| Bunny.net (BunnyWay d.o.o.) | Video hosting & streaming (clips) | EU/Slovenia ✅ | Art. 6 I f |
| easyname GmbH | Transactional email delivery (SMTP) | EU/Austria ✅ | Art. 6 I b |
| YouTube (Google) | Video embeds on spots & clips in privacy-enhanced mode (only loaded after "Map & media" consent) | USA ⚠️ | Art. 6 I a (consent) |
| Google Analytics 4 | Audience measurement / statistics (consent only) | USA ⚠️ | Art. 6 I a (consent) |
| Meta Pixel | Marketing / conversion measurement (consent only) | USA ⚠️ | Art. 6 I a (consent) |
⚠️ US services (Netlify, Mapbox, YouTube/Google, GA4, Meta): Data is transferred on the basis of the EU-US Data Privacy Framework (DPF) or EU Standard Contractual Clauses (SCC). Mapbox maps and YouTube videos are only loaded after your consent (see section 3). Please have the applicable safeguard per service confirmed by legal counsel before going live.
3. Cookies & Consent
We do not use third-party tracking or advertising cookies. For operation we use only technically necessary storage plus your locally stored consent decision:
- Necessary (always active): Login/session data (Supabase Auth) for the logged-in area and the storage of your consent choice itself. Legal basis: Art. 6(1)(f) GDPR (technically required).
- Maps (consent): Interactive Mapbox maps are only loaded after your consent. Legal basis: Art. 6(1)(a) GDPR.
- Statistics & marketing (consent): Optional statistics and marketing services (Google Analytics 4, Meta Pixel) are loaded only after your active consent and may set cookies. Legal basis: Art. 6(1)(a) GDPR.
Your decision is stored locally in your browser, versioned and timestamped (no server-side profile). You can withdraw or adjust your consent at any time with future effect via the cookie settings.
4. Retention Periods
- Verification tokens (e.g. email confirmation, password reset): valid 1 hour to 7 days depending on type, deleted after 30 days at the latest
- Email send log: 90 days, after which the recipient address is anonymised
- Reviews & content you create: until you delete them or your account is deleted
- User account: until deletion by the user, but no longer than 24 months after the last login (see below)
Automatic deletion of inactive accounts
In line with the storage-limitation principle (Art. 5(1)(e) GDPR), we store personal data only for as long as it is needed for the respective purposes. If a user does not sign in for 24 months, their account and the associated personal data are automatically and irreversibly deleted. We notify the user by email to the address on file at least 30 days before deletion; a single login within that period prevents the deletion.
5. Your Rights (GDPR Art. 15–22)
You have the following rights regarding your personal data:
- Access to the data processed (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure (“right to be forgotten”, Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Objection to processing (Art. 21)
- Withdrawal of consent with future effect (Art. 7(3))
You can exercise many of these rights directly yourself: in your account settings you can view and change your data and delete your account, including all personal data, at any time. For further requests, contact us at the address given in section 6.
Right to lodge a complaint with the supervisory authority
Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority — in Austria:
Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Wien
dsb@dsb.gv.at · +43 1 52 152-0 · www.dsb.gv.at
6. Privacy Contact
For questions about data protection or to exercise your rights, you can reach us at:
Maximilian Auer
Email: hallo@lemoyn.com
Phone: +43 676 476 50 15