Privacy Policy
Last updated: 8 October 2026
This privacy policy applies to the public website lienks.com, including its German-language pages, and to the web application at app.lienks.com. It explains how personal data is processed when you use these services. Where a section applies only to the website or only to the web application, this is stated expressly.
1. Controller and contact details
The controller responsible for the processing described here is:
Philip Knüppelholtz
Lienks Analytics
Klaus-Groth-Straße 28
23769 Fehmarn
Germany
Email: philip@lienks.com
You can use this email address for privacy questions and to exercise your rights.
2. Operation of the website and web application
The website, the web application, and the application and database servers used for Lienks are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When you access either service, technically necessary information is processed, including your IP address, the time and the requested resource, technical information about your browser and device, and, where applicable, the referring page. Server and security logs may also record the IP address, timestamp, requested resource and HTTP status to help maintain security, stability and troubleshoot errors.
This processing is necessary to provide the web application (Art. 6(1)(b) GDPR). Providing the public website and maintaining the security and stability of both services is based on our legitimate interest in operating secure and functional services (Art. 6(1)(f) GDPR). Technical access and error logs for the website and web application are deleted within 14 days. Individual log entries needed to investigate a specific security incident may be retained longer, until the investigation and any related legal proceedings are concluded. Statutory retention obligations remain unaffected. Where required, a data processing agreement is in place with Hetzner. Connections to our services are encrypted using HTTPS. The product video on lienks.com is served as a file from our own hosting infrastructure; the technical access data described above is processed when it is loaded. We do not use an external video platform for this video.
3. Contact by email
If you email us, we process your email address, your name if provided, and the information in your message to handle and answer your inquiry. For inquiries relating to an existing or potential contract, the legal basis is Art. 6(1)(b) GDPR. For other inquiries, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is communicating with people who contact us. Our email mailbox is hosted by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. netcup processes email messages and technical connection data as needed to operate the mailbox.
We retain correspondence for as long as it is needed to deal with the inquiry or a resulting business relationship. Legal retention duties and the establishment, exercise or defence of legal claims may require longer storage.
4. Analytics on lienks.com
We use Lienks on the public website to understand page views, traffic sources and website use in aggregate and to improve the website. This may involve processing pages viewed, timestamps, referring domains, approximate country, browser and device information, and events configured by us.
Website analytics runs in cookieless mode. Technical information, in particular the IP address and browser user agent, is used on the server to derive a pseudonymous value that changes daily, allowing visits to be distinguished statistically within a day. The IP address is processed transiently for this purpose and is not stored as part of an analytics event. The value is not designed to recognize a visitor across different days. Server logs described in Section 2 may be created separately.
Where this involves personal data, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is understanding how the website is used and functions so we can improve it. The analytics data is not shared with an external analytics provider; it is processed on the infrastructure described in Section 2. The data is deleted when it is no longer needed for these purposes.
5. Language preference on lienks.com
If you change the language of the website, we store your selection locally in your browser so we can display the website in that language on a later visit. The preference is not used for advertising or to recognize you for analytics. You can delete the stored value through your browser settings or change the language again on the website. To the extent this involves the processing of personal data, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is displaying the language you selected.
6. Registration, sign-in and accounts in the web application
We use Firebase Authentication, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for registration and sign-in. You can use an email address and password or Google Sign-In. Your email address, a technical user identifier and the information needed for your chosen sign-in method are processed. Google Sign-In may also provide your display name and profile picture or its URL. Passwords are processed by Firebase Authentication; we do not store plaintext passwords in our own database.
We also store information needed for your Lienks account in the web application, including your email address, user identifier, where applicable your display name and profile picture URL, and your language and time format settings. This is necessary to provide the account and the service (Art. 6(1)(b) GDPR). Art. 6(1)(f) GDPR may additionally apply to security measures and abuse prevention.
Account information is generally stored for as long as your account exists. After deletion of the account it is removed unless legal retention duties or legitimate reasons require continued retention. Additional information about Google’s processing is available in Google’s Firebase privacy information.
7. Cookies in the web application
The web application uses cookies to support sign-in and selected preferences:
| Cookie | Purpose | Retention |
|---|---|---|
session | Keeps you signed in | Up to 14 days |
locale | Remembers the interface language you selected | Up to 1 year |
timeFormat | Remembers your chosen time format | Up to 1 year |
The session cookie does not contain your plaintext password. These cookies are not used for advertising. To the extent processing personal data is necessary to provide the app functions you request, the legal basis is Art. 6(1)(b) GDPR; otherwise, processing is based on our legitimate interest in a secure and usable application under Art. 6(1)(f) GDPR. Storing and accessing information on your device is also subject to Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
8. Workspaces, websites and invitations
Lienks lets you create workspaces, add websites and invite others to collaborate. For this purpose we process workspace names, domains added, the association of user accounts with workspaces and websites, roles and access permissions, and the email addresses of people you invite.
Invitations are valid for seven days. The inviting user receives the invitation link in the web application; as currently implemented, Lienks does not email the invitation itself. Processing is necessary to provide the collaboration features (Art. 6(1)(b) GDPR). Where we process an invitee’s data before they have registered, processing is based on our and the inviting user’s legitimate interest in secure collaboration (Art. 6(1)(f) GDPR). Invitation data is deleted when no longer needed for the invitation and its administration. Membership data is generally deleted when the membership or associated account ends, unless further retention is required.
9. Subscriptions and payments
We use Stripe for paid subscriptions. Subscription checkout and payment method management take place on pages provided by Stripe. You provide payment details such as full card numbers directly to Stripe; we do not store them on our own servers.
To administer your subscription, we process Stripe customer and subscription identifiers, your plan, payment and subscription status, billing periods, and information about scheduled changes or cancellation. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Where records are required for accounting and tax purposes, processing is also based on Art. 6(1)(c) GDPR. Stripe also processes information under its own privacy policy.
To transmit payment events between Stripe and our application server, we use a Google Firebase Cloud Function in the Frankfurt region. Subscription and transaction details necessary to match and verify payments may be processed there. The legal bases are Art. 6(1)(b) GDPR and, for secure processing of payment notifications, Art. 6(1)(f) GDPR.
Billing records are retained for as long as needed for the contract, outstanding transactions or statutory accounting and tax obligations. Depending on the type of record, retention periods of six, eight or ten years may apply under German law.
10. Analytics data from customer websites
Customers may install Lienks on their own websites. For data collected about visitors to those sites, the respective website operator is generally the controller. Lienks processes that data on the customer’s behalf under a data processing agreement pursuant to Art. 28 GDPR. Each customer’s privacy notice must inform its visitors about the use of Lienks. This policy does not replace that notice.
Depending on the setting chosen by the customer, events may be collected without a visitor identifier (minimal mode), with a daily rotating pseudonymous identifier and no cookie (cookieless mode, the default), or with a time-limited cookie identifier following the relevant consent (cookie mode). Data may include page paths, traffic sources, events and approximate country, browser, operating system and device information. IP addresses and browser information may be processed transiently to derive these details. Analytics data is stored on the infrastructure described in Section 2. It is available in the application to the customer and authorized workspace members according to their access rights.
The relevant website operator determines the legal basis for collecting data on its site and obtains any consent needed for cookies. Questions about data collected on a customer website and requests to exercise data subject rights should initially be addressed to that website operator. Retention of data processed on behalf of customers depends on their use of the service and the applicable agreements. In particular, it is removed when the relevant website or workspace is deleted, in accordance with the agreed deletion arrangements. Server logs described in Section 2 may be created separately.
11. Recipients and transfers outside the EEA
For the purposes described, we use in particular Hetzner for hosting, netcup for operating our email mailbox, Google for authentication and the payment webhook function, and Stripe for payments. Where required, data processing agreements under Art. 28 GDPR are in place. A locally stored geolocation database may be used to derive a country from an IP address; the IP address is not sent to the database provider for this lookup.
When Google and Stripe are used, personal data may also be processed outside the European Economic Area or accessed from outside the EEA. Such transfers take place only under the applicable legal conditions, in particular on the basis of an adequacy decision covering the recipient or appropriate safeguards such as the EU Standard Contractual Clauses. You can request information about the safeguards used by emailing the address in Section 1.
12. General retention rule
Where no specific period is given above, we retain personal data only while needed for the relevant purpose, performance of a contract, legal retention duties, or the establishment, exercise or defence of legal claims. We then delete it. Visitor data that we process on behalf of customers is subject to the arrangements agreed with those customers.
13. Your rights
Subject to the applicable legal conditions, you have rights of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You may object, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 21 GDPR). Where processing is based on your consent, you may withdraw it at any time with effect for the future.
You also have the right to lodge a complaint with a data protection supervisory authority. In particular, the Independent Centre for Data Protection Schleswig-Holstein (ULD) is responsible for our location. To exercise your rights in relation to us, email philip@lienks.com. Where we process a customer website’s visitor data solely on the customer’s behalf, we assist the responsible website operator with the handling of relevant requests.
14. Changes to this policy
We update this privacy policy if Lienks or the services we use change. The version published on this page is the current version.