Privacy policy

This English translation is provided for convenience only. The German version at clappo.de/datenschutz is the legally binding one.

Version 2026-10-12-v1 · Last updated: October 12, 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
ELMACO, Marco Thiele
Anrather Straße 113
47877 Willich
Email: info@clappo.de
Phone: +49 2154 8886881

2. Visiting this website (clappo.de)

When you access clappo.de, our server automatically processes technical data transmitted by your browser: IP address, date and time of access, page accessed, amount of data transferred, referrer URL, as well as browser type and operating system (server log files). This is necessary to deliver the website and to ensure its security and stability. The legal basis is Art. 6(1)(f) GDPR. The log files are deleted after 14 days at the latest, unless their further retention is necessary to investigate a specific security incident.

The website is operated by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, in data centers in Germany. The same applies to the portal, including its database, file storage and backups. A data processing agreement is in place with Hetzner.

The fonts used on this website are loaded locally from our server. No connection is made to servers of Google or other font providers. The website does not set cookies and does not use tracking or any analytics or advertising services.

3. Contact and plan requests

If you request a plan via the form in the pricing section, we process the information you provide (name, email address, optionally company and message, as well as the plan selected) in order to respond to your request and, where applicable, to set up a trial account. The request is transmitted to our portal server (app.clappo.de) and forwarded from there by email to our sales mailbox; emails are sent via Brevo (Sendinblue GmbH, Berlin). The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (responding to requests).

Your information is deleted as soon as your request has been fully processed and no statutory retention obligations stand in the way.

4. Contact by email or phone

If you contact us by email or phone, we process your information solely to handle your request (Art. 6(1)(b) or (f) GDPR) and delete it as soon as it is no longer required for this purpose.

5. Contacting prospects and trial accounts

This section concerns persons who contact us as prospects or whom we approach because of a recognizable business connection to our offering, and also serves as information pursuant to Art. 14 GDPR.

• What data: name, company, business email address, where applicable phone number and position, notes on conversations, the history of our emails, dates for follow-ups and the status of a trial account.
• Where the data comes from: from you yourself (request, conversation, reply to our message) or from publicly accessible professional sources, such as your website, your legal notice or your professional profile on a network.
• What for: to respond to your request, to set up a trial account for you on request, to make you an offer and to keep track of our communication.
• Legal basis: for your request, Art. 6(1)(b) GDPR (pre-contractual measures); when we approach you, Art. 6(1)(f) GDPR (legitimate interest in acquiring business customers). We send promotional emails only if you have previously contacted us yourself or have given your express consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG (German Act against Unfair Competition)).
• Trial account: A trial account is set up only at your request, is limited in time and contains exclusively fictitious demo data.
• Recipients: the service providers named in section 15, in particular for hosting and email delivery. No data is passed on to third parties for advertising purposes.
• Retention period: We delete your data when it is no longer needed, at the latest 24 months after the last contact, unless you have become a customer or statutory retention periods apply.
• Objection: You may object to the use of your data for direct marketing at any time without giving reasons (Art. 21(2) GDPR), informally by email to info@clappo.de or by replying to our message. We will then add your address to a suppression list so that we do not contact you again. For this purpose we continue to store the address (Art. 6(1)(c) and (f) GDPR).

6. Use of the portal: purpose of data processing

We process your personal data exclusively for the following purposes:

• Provision and operation of the portal
• Authentication and protection of your access
• Management and handling of image approval processes
• Communication with you in the context of your use of the portal
• Fulfillment of statutory retention obligations

7. Who is responsible for content in the portal

Our customers (for example agencies) use the portal to coordinate files with their own clients, employees and service providers. For the data that a customer processes in their workspace (uploaded files, comments, approvals, invited persons), the respective customer is the controller within the meaning of the GDPR. We process this data on their behalf on the basis of a data processing agreement (Art. 28 GDPR).

If you have been invited to the portal as an approver or employee of a customer, please direct any requests regarding your data first to the company that invited you. We support them in responding. For the data of our customers themselves (contracting parties, billing data, admin accounts) and for visits to this website, we are the controller.

8. Data processed

In the context of your use of the portal, we process the following data:

• Contact data: first and last name, email address, role in the portal
• Access data: password hash (not the password itself), time-limited login links, session tokens, login timestamps
• Usage data: files uploaded or edited by you (images, videos, PDFs, Office documents), comments and comment attachments, approval status, activity log
• Technical data: IP address (only temporarily, to prevent abuse, see section 11), browser type, operating system

9. Legal bases

Processing is carried out on the basis of:

• Art. 6(1)(b) GDPR — performance of a contract (portal access)
• Art. 6(1)(c) GDPR — legal obligation (e.g. commercial and tax law)
• Art. 6(1)(f) GDPR — legitimate interest (IT security, prevention of abuse, contacting and supporting prospects)
• Art. 6(1)(a) GDPR — consent (e.g. for optional features)

10. Retention period

We store your data only for as long as is necessary for the purposes stated or as required by statutory retention periods (e.g. 6/10 years under the HGB (German Commercial Code) / AO (German Fiscal Code)).

After the end of the contract, access credentials are deactivated. Customers can still export their data for 30 days. After that, project-related data is permanently deleted, unless a retention obligation stands in the way. It remains in backups for up to 30 additional days (see section 13).

11. IP addresses and security

To defend against attacks (e.g. brute force on the login), IP addresses are held briefly in memory. This data is not stored persistently and is automatically forgotten after one hour at the latest.

We use Sentry for error analysis. Only anonymized identifiers (user UUID + role) and technical error data are transmitted. Personal data such as name, email address or IP is not transmitted to Sentry. Sentry is hosted in the EU (Frankfurt). Addresses of notification webhooks and parameters in requested URLs are removed or masked before transmission.

12. Conversion of Office documents

So that Office documents (Word, PowerPoint, Excel) can be displayed and commented on in the portal, we convert them to PDF. The conversion takes place on our own servers at Hetzner Online GmbH in Germany; the file is not transmitted to any other service provider for this purpose. We store the converted file in our file storage.

13. Backups

So that data can be restored after a technical failure, we back up the portal's database and uploaded files daily. The backups are stored encrypted in storage provided by Hetzner Online GmbH in Germany and are deleted after 30 days at the latest.

Data that has been deleted in the portal may therefore remain in backups for up to 30 days. It is no longer used there and is deleted when the period expires. The legal basis is Art. 6(1)(f) GDPR in conjunction with Art. 32 GDPR (security of processing).

14. Notifications to Slack and Microsoft Teams

A customer's admins can configure the portal to send a message to a channel in Slack or Microsoft Teams when there are new files, versions, comments and decisions. This feature is switched off by default. If it is switched on, we transmit to the address stored by the customer: the type of event, the project name, the file name, for comments the first 80 characters of the comment text, and a link to the project that only works after logging in.

The recipient is the customer via their own workspace at Slack (Slack Technologies) or Microsoft. The customer is responsible for this transmission and the further processing there. Their agreements with Slack or Microsoft apply.

15. Processors and recipients

We use the following service providers on the basis of data processing agreements (DPA):

• Hosting (website, portal, database, file storage and backups): Hetzner Online GmbH, Gunzenhausen (data centers in Germany)
• Email delivery: Brevo (Sendinblue GmbH, Berlin)
• Error monitoring: Sentry (Functional Software, Inc., server location EU/Frankfurt)
• Maintenance and support of the systems: an external IT service provider based in Germany
• Payment processing (only when booking a plan): Stripe (Stripe Payments Europe Ltd., Dublin, Ireland)

16. Transfers to third countries

The portal's data (application, database, files and backups) is located in Germany. The service provider for error monitoring (Sentry) is based in the USA; the error data is processed in the EU (Frankfurt). Access from the USA, for example for support or maintenance, nevertheless cannot be ruled out. Sentry is certified under the EU-US Data Privacy Framework; the transfer takes place on the basis of the adequacy decision of the European Commission (Art. 45 GDPR).

17. Your rights

You have the right to:

• access to your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR)
• withdraw consent you have given (Art. 7(3) GDPR)
• lodge a complaint with a supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf

To exercise your rights, please contact the email address given in section 1 informally. These rights apply equally to the website and the portal.

18. Cookies and session storage

The portal uses only technically necessary session cookies to keep you logged in. No tracking cookies, no advertising tracking and no analytics tools are used.

19. Contact and terms of service

Further information on the contractual basis can be found in our Terms of Service.