Legal

Privacy Policy

Last updated: 2026-10-13 · version 2026-10-13.1 · Earlier versions available on request.

today is day one UG (haftungsbeschränkt) · www.branddoq.io

1. Controller

today is day one UG (haftungsbeschränkt)
Operator of the Branddoq platform (www.branddoq.io)
Rotebühlstraße 44, 70178 Stuttgart, Germany
Phone +49 (0)711 38 96 76 50 · Email hello@branddoq.io
Represented by the managing directors Verena Mayer and Mirco Wüstholz.

2. Data protection officer

No data protection officer has been appointed. We have assessed the obligation to designate one under Article 37 (1) GDPR and Section 38 (1) of the German Federal Data Protection Act (BDSG): our core activities consist neither of large-scale regular and systematic monitoring of individuals nor of large-scale processing of special categories of personal data; we do not carry out data protection impact assessments as a core activity and do not process data commercially for the purpose of transfer or for market or opinion research; fewer than 20 persons are permanently engaged in the automated processing of personal data. We review these conditions regularly. Please address questions about data protection to hello@branddoq.io, subject “Data protection”, or by post to the controller’s address.

3. Who this policy applies to

This policy informs

visitors of the website www.branddoq.io including the demo environment,
customers and their users (editors, viewers) who use the Branddoq platform, and
visitors of brand guides that our customers publish via the platform (Section 10).

Insofar as we process personal data on behalf of our customers (for example data of users created by customers and data contained in brand guides), the respective customer is the controller; we act as processor on the basis of a data processing agreement pursuant to Article 28 GDPR. In this case, please contact the customer whose brand guide you are using.

4. Hosting and server log files

Data: IP address, date and time, page accessed, HTTP status code, amount of data transferred, referrer URL, browser and operating system.
Purpose: delivery of the website, stability and security, error analysis, defence against attacks.
Legal basis: Article 6 (1) (f) GDPR (legitimate interest in secure and stable operation).
Recipients: Our hosting provider VHUG Technologies OÜ, Lõõtsa tn 5, 11415 Tallinn, Estonia (registration number 17334484) operates and administers the servers for us on the basis of a data processing agreement. The servers are located in a data centre in Germany; the data centre operator has no access to the data. The Plesk software is used for server administration.
Retention period: Log files are deleted regularly as part of the server’s log rotation, at the latest after 30 days, unless they are needed to investigate a security incident.

5. Cookies, local storage, audience measurement and ad performance measurement

5.1 Strictly necessary cookies

For the operation of the website and the platform we use strictly necessary cookies and comparable storage technologies. No consent is required for this (Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); the processing of the associated data is based on Article 6 (1) (b) GDPR (use of the platform) or Article 6 (1) (f) GDPR (legitimate interest in a secure, functioning website).

Name	Purpose	Retention period
`branddock_session`	Session identifier for login, demo sandbox, password access to protected guides, language setting	Session, at most 120 minutes of inactivity
`XSRF-TOKEN`	Protection against cross-site request forgery	Session
`remember_web_…`	“Stay logged in” at login (only if selected)	30 days
`branddoq_consent` (LocalStorage)	Stores your decision in the cookie dialog (selection, time, text version, random identifier)	6 months
`branddoq_consent_session` (SessionStorage)	Stores the choice “None” for the current session only	Until the browser tab is closed
`branddock_cookie_notice` (LocalStorage, alt.branddoq.io only)	Remembers that you have closed the cookie notice on the old start page	Until browser data is deleted

5.2 Cookie dialog and consent

On the website www.branddoq.io (not in our customers’ brand guides and not in the customer portal) we use the services described in Sections 5.3 to 5.5 for audience measurement and for measuring the performance of our advertisements. These services load only after you have given consent in the cookie dialog. The legal basis is your consent (Section 25 (1) TDDDG for storing and reading information on your device, Article 6 (1) (a) GDPR for the subsequent processing). The basis on which each provider transfers data to the USA is stated under “Third country” in Sections 5.3 to 5.5.

On its first level, the dialog offers “Accept all”, “Essential only” and “None” on an equal footing and, under “Adjust selection”, a choice per category (statistics, marketing). As long as you have not decided, no service is loaded. We remember “Essential only” and an adjusted selection in your browser for six months, “None” only for the current session. If the dialog text changes or a service is added, we ask again.

Withdrawal: You can withdraw or change your consent at any time with effect for the future by clicking “Cookie settings” in the footer of every page. Cookies already set by the services are deleted in the process insofar as they are accessible from our domain; the page is then reloaded.

Proof: To prove your consent (Article 7 (1) GDPR) we log the time, the selection made, the text version of the dialog, the language, the page accessed, your truncated IP address (last octet removed) and the browser identifier as well as the random identifier from the browser storage. The legal basis is Article 6 (1) (c) GDPR in conjunction with Article 7 (1) GDPR. We delete these records after three years.

5.3 Google Analytics 4 (category statistics)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), processor on the basis of the Google Ads Data Processing Terms.
Data: pseudonymous user identifier in the cookie, pages accessed, time spent, origin of the visit (referrer, campaign parameters), approximate location, device, browser and operating system, screen resolution, interactions. Google Analytics 4 uses the IP address only to determine the location, truncates it in the process and does not store it; according to Google, truncation takes place on servers in the EU.
Purpose: analysis of the use of our website, improvement of content and offering, measurement of the effectiveness of our campaigns.
Cookies: _ga (2 years), _ga_<ID> (2 years).
Retention period: User and event data at Google Analytics 14 months, after which they are deleted automatically. Aggregated reports do not contain personal data.
Third country: Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; in addition, the EU Commission’s Standard Contractual Clauses apply.
We have deactivated Google Signals (cross-device linking with Google accounts) and the sharing of data with other Google products. Further information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245.

5.4 Meta Pixel (category marketing)

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”).
Data: pseudonymous identifier in the cookie, pages accessed, events (for example page view, registration, purchase), referrer, HTTP headers including IP address, browser and device information. If you are logged in to Facebook or Instagram, Meta can associate this data with your account. We do not transmit any additional contact data to Meta (no “advanced matching”).
Purpose: measuring whether our advertisements on Facebook and Instagram lead to visits and registrations (conversion measurement) and building audiences in order to show visitors of our website advertisements there again (retargeting).
Cookies: _fbp (3 months), _fbc (3 months, only after clicking on an advertisement).
Joint controllership: For the collection and transmission of the data to Meta, we are joint controllers with Meta (Article 26 GDPR). The basis is Meta’s “Controller Addendum” (https://www.facebook.com/legal/controller_addendum); under it, Meta is responsible for fulfilling data subject rights with regard to the data stored at Meta. The subsequent processing by Meta for its own purposes takes place under Meta’s sole responsibility.
Third country: Meta may transfer data to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework; in addition, the EU Commission’s Standard Contractual Clauses apply.
Further information: https://www.facebook.com/privacy/policy and https://www.facebook.com/privacy/policies/cookies.

5.5 LinkedIn Insight Tag (category marketing)

Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”).
Data: URL of the page accessed, referrer, IP address (truncated or hashed by LinkedIn), device and browser properties, timestamp, pseudonymous identifiers in cookies. If you are logged in to LinkedIn, LinkedIn can associate the data with your member account; we ourselves receive only aggregated reports without personal reference.
Purpose: measuring whether our advertisements on LinkedIn lead to visits and registrations (conversion measurement), aggregated reports on the professional characteristics of our visitors (website demographics) and re-engaging visitors with advertisements on LinkedIn (retargeting).
Cookies: li_sugr (90 days), bcookie (1 year), lidc (1 day), UserMatchHistory (30 days), AnalyticsSyncHistory (30 days), ln_or (1 day).
Retention period: LinkedIn pseudonymises the direct identifiers within seven days and deletes the pseudonymised data after 180 days.
Responsibility: For the collection of data on our website and its transmission to LinkedIn we are joint controllers with LinkedIn (Article 26 GDPR). The basis is the LinkedIn Ads Agreement including the data protection terms for the Insight Tag contained therein (https://www.linkedin.com/legal/sas-terms); under it, LinkedIn is responsible for fulfilling data subject rights with regard to the data stored at LinkedIn. The subsequent processing for LinkedIn’s own purposes (for example linking to the member account, ad delivery) takes place under LinkedIn’s sole responsibility.
Third country: LinkedIn may transfer data to LinkedIn Corporation in the USA. LinkedIn Corporation is certified under the EU-US Data Privacy Framework; in addition, the EU Commission’s Standard Contractual Clauses apply.
Further information: https://www.linkedin.com/legal/privacy-policy and https://www.linkedin.com/legal/cookie-policy. You can additionally opt out of processing by LinkedIn at https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

6. Fonts and media

All fonts of the website and the platform (including Gilroy, Inter and Space Grotesk) are loaded from our own servers. Your browser does not connect to Google Fonts or other font providers. If a customer selects a Google Font in the builder, our server downloads the font file once and then serves it itself; only the address of our server reaches Google in the process, no data of the customer or of visitors.

7. Contact and support

Contact by email, phone or contact form: We process the details you provide to us (name, email address, company if applicable, subject and content of the enquiry) in order to handle your enquiry. The contact form on the website transmits your message by email to our mailbox contact@branddoq.io (sent via IONOS, Section 9); you receive a confirmation of receipt with a reference number. The legal basis is Article 6 (1) (b) GDPR (pre-contractual measures) or Article 6 (1) (f) GDPR (legitimate interest in responding to enquiries). We delete the data as soon as the enquiry has been dealt with and no retention obligations exist.

Support and feedback from the customer portal: Logged-in users can send support requests and feedback in the help centre. In addition to your details (subject, message, type of request, urgency, rating if applicable), we transmit your plan, the project name, your user ID, the page concerned and the browser identifier for classification. These requests are sent by email to support@branddoq.io and are additionally created as tasks in the task management service Asana for processing (Asana, Inc., 633 Folsom Street, Suite 100, San Francisco, CA 94107, USA, processor). The transfer to the USA is based on the adequacy decision on the EU-US Data Privacy Framework, of which Asana, Inc. is a participant, and additionally on the EU Commission’s Standard Contractual Clauses in Asana’s Data Processing Addendum. The legal basis is Article 6 (1) (b) GDPR (support as part of the contract). We delete the request in Asana and in the mailbox as soon as it is closed and no retention obligations exist. Asana is also a sub-processor within the meaning of our Data Processing Agreement (Section 9), because support requests may contain details about our customers’ users and content.

8. Newsletter and discount code

You can sign up for our newsletter on the website. As a thank-you, you receive a discount code for the first three months of a paid plan.

Data: name, company, email address, country, language of the sign-up, time of sign-up and confirmation, IP address and browser identifier at sign-up, wording of the consent including the version of this policy, time of unsubscription and a note on whether the discount code has been redeemed.
Confirmation (double opt-in): After signing up, we send you an email with a confirmation link. The sign-up becomes effective only when you click this link; you then receive the welcome email with the discount code. Without confirmation we do not send a newsletter; we delete unconfirmed sign-ups after 30 days.
Purpose: sending information about Branddoq (news, features, tips, offers) by email and providing and redeeming the discount code. We use the country to tailor the language and content of the newsletter to your region.
Legal basis: your consent, Article 6 (1) (a) GDPR in conjunction with Section 7 (2) no. 2 of the German Act against Unfair Competition (UWG). Logging of sign-up and confirmation (IP address, timestamps, consent text) serves to prove your consent and is based on Article 6 (1) (f) GDPR in conjunction with Article 7 (1) GDPR.
Sending and measurement: Newsletters are sent via the mail server of IONOS SE (processor, Section 9). We do not use tracking pixels and measure neither opens nor clicks. Links in the newsletter do not contain any personal identifier; only the unsubscribe link is associated with your sign-up.
Discount code: The discount code is the same for all subscribers and is stored as a promotion code with our payment service provider Stripe (Section 11). When you book, we check on the basis of the email address whether a confirmed newsletter sign-up exists and apply the discount automatically; Stripe limits redemption to once per customer. We note the redemption in your newsletter sign-up. We do not transmit any other newsletter data to Stripe.
Withdrawal and unsubscription: You can unsubscribe from the newsletter at any time via the unsubscribe link at the end of every email, via the unsubscribe function of your email program (List-Unsubscribe) or by email to hello@branddoq.io. The lawfulness of the processing carried out until withdrawal remains unaffected.
Retention period: For the duration of your subscription. After unsubscription, we retain the sign-up data for the regular limitation period of three years to prove your consent (Article 6 (1) (f) GDPR) and delete it thereafter.

9. Registration, customer account and contract performance

Data: first and last name, email address, password (stored only as a hash), company, billing address, VAT identification number, selected plan, project name, time of registration and logins, subscription status.
Purpose: provision of the customer account, performance of the contract, billing, support, security.
Legal basis: Article 6 (1) (b) GDPR (contract); for the retention of invoice data Article 6 (1) (c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).
Retention period: account data for the duration of the contract and 30 days thereafter. We retain invoices and accounting records for eight years (Section 147 (1) no. 4, (3) AO, Section 14b of the German VAT Act, UStG) and the commercial books and annual financial statements into which this data flows for ten years (Section 257 HGB, Section 147 (1) no. 1 AO); the period begins at the end of the calendar year in which the invoice was issued or the last entry was made. We retain the proof of your acceptance of the Terms and Conditions and the Data Processing Agreement at registration (time, IP address, version of the texts) for the duration of the contract and the subsequent regular limitation period of three years (Article 6 (1) (f) GDPR, legitimate interest in preserving evidence).

Trial account: For the free Trial we do not collect a billing address. We delete inactive Trial accounts after prior notice by email (see Terms and Conditions).

Transactional emails: We send emails concerning registration, passwords, billing, support requests and the newsletter via the mail server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (processor, data centres in Germany).

10. Use of the platform: brand guides, media pool, users

Customer content: Customers upload logos, images, videos, fonts, documents and texts and publish brand guides. Insofar as these contain personal data (for example photos of employees, contact persons in contact modules), the customer is the controller; we process this data as processor in accordance with its instructions.

User management: Customers can create editors and viewers. For this we store name, email address, password hash, role and guide assignment. The customer is the controller; we are the processor. Data subjects should contact the customer for access, rectification or erasure.

Visitors of published brand guides: When a brand guide is accessed, we process the server log files in accordance with Section 4 and set the strictly necessary cookies in accordance with Section 5. For password-protected guides, we store in the session that the password has been entered. For guides with user login, the information on user management applies. The respective customer is responsible for the content of the brand guide; its privacy information is provided within the guide.

Downloads: Downloads from the media pool are counted per file but not logged with personal reference.

Demo environment (www.branddoq.io/demo): The demo can be used without registration. We store the demo session only via the session cookie. Uploaded images are automatically deleted together with the sandbox no later than two hours after creation. The legal basis is Article 6 (1) (b) GDPR (provision of the requested service).

PDF export: During PDF export, the content of the brand guide is compiled into a file on the server side; no additional personal data is collected.

11. Payment processing with Stripe

Paid plans are processed via the payment service provider Stripe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, together with Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA.

Data: name, email address, billing address, VAT identification number, payment method (collected directly by Stripe; we do not receive complete card data), payment history, Stripe customer and subscription identifiers.
Purpose: payment processing, fraud prevention, invoicing, subscription management.
Legal basis: Article 6 (1) (b) GDPR. Stripe processes payment data partly as an independent controller (in particular for fraud prevention and to fulfil its own legal obligations) and otherwise as a processor on our behalf.
Third country: Insofar as data is transferred to the USA, this is based on the adequacy decision on the EU-US Data Privacy Framework, of which Stripe, Inc. is a participant, and additionally on the EU Commission’s Standard Contractual Clauses.
Retention period: For the duration of the contract and the retention periods under commercial and tax law (eight years for invoices and accounting records, ten years for books and financial statements, Section 9).
Further information: https://stripe.com/privacy

12. AI features (Anthropic Claude)

Depending on the plan, the platform offers AI features: AI set-up and AI editing of pages, AI guide generator from existing CI documents and CI check (design check) of materials. For this we use language models of the provider Anthropic, PBC, 548 Market St, San Francisco, CA 94104, USA, via its programming interface.

Data: the texts entered by the user and uploaded documents and images. For the CI check we additionally transmit, together with the file under review, the brand guide’s check profile (colour values, fonts, rules from logo, colour and principles modules) and up to 20 reference images from the guide (logos, application examples, imagery) so that the model can check the file against the guide. The user’s account data is not transmitted.
Purpose: generation of the requested content and check results.
Legal basis: Article 6 (1) (b) GDPR (provision of the feature requested by the customer); insofar as we act for the customer, we act as processor and Anthropic is a sub-processor.
Third country: The transfer to the USA is based on the EU Commission’s Standard Contractual Clauses (Article 46 (2) (c) GDPR), which form part of Anthropic’s Data Processing Addendum. Insofar as Anthropic is certified under the EU-US Data Privacy Framework, we additionally base the transfer on the EU Commission’s adequacy decision (Article 45 GDPR).
Retention at Anthropic: Under the terms of use applicable to the programming interface, Anthropic does not use inputs and outputs to train its models. According to its own information, Anthropic normally deletes inputs and outputs within 30 days. It retains them longer only where its automated safety systems suspect a violation of its usage policy (then for up to two years) or where legal obligations so require. No agreement on complete waiver of retention (zero data retention) is currently in place. Further information: https://privacy.claude.com
Note: Please do not enter special categories of personal data (Article 9 GDPR) into AI features. AI-generated content in the demo guide “VANTIC” is labelled in accordance with Article 50 of the EU AI Act.

13. Other recipients

Apart from the processors mentioned, we disclose personal data only to

our parent company VON HELDEN UND GESTALTEN GmbH, Rotebühlstraße 44, 70178 Stuttgart, Germany (Stuttgart Local Court, HRB 733701), which handles bookkeeping, accounting and customer care for us, and the tax advisors it engages, for the fulfilment of legal obligations and the performance of the contract (Article 6 (1) (b) and (c) GDPR; for customer care Article 6 (1) (f) GDPR, legitimate interest in efficient organisation within the group of companies),
authorities and courts insofar as we are legally obliged to do so (Article 6 (1) (c) GDPR),
legal advisors for asserting or defending claims (Article 6 (1) (f) GDPR).

Transfers to third countries take place only in the cases described in Sections 5 (Google, Meta, LinkedIn – only with your consent), 7 (Asana), 11 (Stripe) and 12 (Anthropic).

14. Retention periods at a glance

Unless stated otherwise above, we delete personal data as soon as the purpose of its processing ceases to apply and no statutory retention obligations prevent deletion. We delete customer content and user data 30 days after the end of the contract; backups are overwritten in the regular cycle of about four weeks, so that the data is completely removed no later than eight weeks after the end of the contract. We retain invoices and accounting records for eight years and commercial books and annual financial statements for ten years (Section 147 AO, Section 14b UStG, Section 257 HGB). We delete records of cookie consent after three years (Section 5.2). If proceedings are pending in which data is required as evidence, retention is extended until they are concluded.

15. Your rights

You have the following rights vis-à-vis us with regard to the personal data concerning you:

Access (Article 15 GDPR) to the data processed,
Rectification (Article 16 GDPR) of inaccurate data,
Erasure (Article 17 GDPR) and restriction of processing (Article 18 GDPR) where the statutory requirements are met,
Data portability (Article 20 GDPR) for data you have provided to us on the basis of a contract or consent,
Objection (Article 21 GDPR) to processing based on Article 6 (1) (f) GDPR on grounds relating to your particular situation; to direct marketing at any time without stating reasons,
Withdrawal of consent given, with effect for the future (Article 7 (3) GDPR); cookie consent via “Cookie settings” in the footer of the website (Section 5.2).

Automated individual decision-making, including profiling (Article 22 GDPR), does not take place.

To exercise your rights, an email to hello@branddoq.io is sufficient. If you wish to exercise your rights with regard to a brand guide of one of our customers, we will forward your request to the customer or inform you of the controller.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, poststelle@lfdi.bwl.de, www.baden-wuerttemberg.datenschutz.de.

16. Obligation to provide data

The details marked as mandatory fields in the registration form are required for registration and performance of the contract. Without them we cannot create the customer account or perform the contract. All other details are voluntary.

17. Data security

All data is transmitted encrypted via TLS. We store passwords exclusively as hashes. Uploaded files are checked for their file type on the server side; SVG files are cleaned of active content. Access to customer content is restricted on a role basis. Our technical and organisational measures are described in the Data Processing Agreement.

18. Changes to this policy

We adapt this privacy policy when our processing operations or the legal situation change. The current version is available at www.branddoq.io/legal/datenschutz. In the event of material changes, we inform registered customers by email.

This is the English version of our privacy policy. The German version is available at https://www.branddoq.io/legal/datenschutz.