Privacy Policy.

This Privacy Policy explains how Confir (“Confir”, “we”, “us”) collects, uses and protects personal data when you visit confir.eu, contact us, sign up for an account or use the Confir platform (the “Service”).

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), the German Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”) and the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, “TDDDG”).

1. Controller

The controller for the personal data processed in connection with confir.eu and the Service is:

Confir
Sole proprietorship (Einzelunternehmen) — owner: Daniel Stiegler
Kirchweg 3
92256 Hahnbach, Germany
Email: privacy@confir.eu

We are not required to appoint a data protection officer (§ 38 BDSG). Please direct all privacy enquiries to privacy@confir.eu.

2. Our two roles: controller and processor

2.1 Confir as controller. For the processing described in this Policy — operating the website, handling enquiries, managing accounts, billing, security and communications — Confir is the controller.

2.2 Confir as processor. When a customer organisation uses the Service, the content it enters (AI system registrations, assessments, controls, findings, evidence files and any personal data contained in them) is processed on that customer's behalf and under its instructions. For this content the customer is the controller and Confir is the processor under our Data Processing Agreement. If you use the Service as an employee or contractor of a customer, please also refer to your organisation's own privacy information.

3. Categories of personal data we process

3.1 Website visit and server logs

• IP address, date and time of the request, requested page, referrer URL, browser type and version, operating system
• Stored automatically by our hosting provider for security and fault analysis (see Section 6)

3.2 Enquiries and contact form

• Name, work email, company, and the content of your message
• Contact-form submissions are delivered to us by email through our transactional email provider (see Section 6)

3.3 Account & identity data

• Full name, work email, job title, organisation
• Authentication credentials (password hash, MFA secrets)
• Profile preferences and language settings
• Where you are invited to an existing account, we receive your name and work email from your organisation's administrator

3.4 Service data

• Information you or your organisation enter into the platform (AI system registrations, assessments, controls, findings, attachments)
• Audit log entries (action, actor, timestamp, IP, user agent)
• Comments, evidence files and any other content you upload

3.5 Billing data

• Company name, VAT ID, billing address, billing contact
• Payment metadata processed by our payment provider (we do not store full card details — see Section 6)

3.6 Technical & usage data

• IP address, browser type, operating system, device identifiers
• Pages visited, features used, requests made, error logs, performance telemetry
• Information stored on your device (cookies and local storage) — see Section 11 and our Cookie Policy

3.7 Communications

• Support tickets and correspondence with us
• Marketing preferences and, where you have consented to marketing emails, email engagement (open, click) data

3.8 Website analytics (only with your consent)

• Pages viewed on confir.eu, the referring site or marketing campaign that brought you here, approximate location derived from your IP address, device and browser type, and which calls to action you followed — including the wording of the button or link you clicked
• That the contact form was submitted, and on which page. What you asked about — demo, sales or support — and everything you typed into the form stay out of analytics entirely; they are processed only as described in section 3.2
• Collected by Google Analytics 4 and only after you accept analytics in our cookie banner. Google Analytics 4 does not log or store IP addresses, and we run it with Google Signals and ad personalisation switched off. See our Cookie Policy for the cookies set and how to decline

4. Purposes and legal bases

Where we rely on legitimate interest (Art. 6(1)(f) GDPR), we have weighed our interests in keeping the website and Service secure, detecting abuse and improving the product against the limited and predictable nature of the processing, the safeguards described in Section 10, and your right to object at any time under Section 9. You can request a summary of this balancing test at privacy@confir.eu.

5. How we use personal data

We use personal data to:

• Answer your enquiries and, where relevant, prepare an offer
• Authenticate you and protect your account
• Operate the Service and store the data you submit (AI systems, assessments, controls, evidence)
• Generate audit logs, conformity packages and compliance reports for your organisation
• Bill you correctly and meet our accounting and tax obligations
• Detect, investigate and respond to abuse, fraud and security incidents
• Improve the Service and develop new features
• Send you transactional emails (sign-in alerts, invoices, product notices) and, only with your consent, marketing emails

We do not use automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR.

6. Recipients of personal data

We share personal data with the following categories of recipients, in each case only to the extent necessary:

• Service providers (processors) that host and operate the website and the Service on our behalf under Art. 28 GDPR contracts: Supabase (database, authentication and file storage, hosted on Amazon Web Services in Frankfurt, Germany), Vercel (website and application hosting), Stripe (subscription billing and payment processing; Stripe receives your payment details directly — we never see full card numbers), Cloudflare (Turnstile bot protection on the application's sign-in forms) and Google (website analytics on confir.eu, where you have consented, and delivery of the webfont used in the application interface). Transactional authentication email is sent by Supabase's built-in sender. The full current list is published at confir.eu/legal/subprocessors.
• Professional advisers such as tax advisers, accountants and lawyers, bound by confidentiality
• Authorities where required by law (court order, regulator or tax authority request)
• Successors. If the Confir business is transferred into a company (for example a GmbH or UG) or sold, personal data may be transferred to the successor, which will be bound by this Policy. We will inform you of any such transfer.

We do not sell personal data and we do not share personal data with third-party advertisers.

7. International transfers

Customer data and account data are hosted in the European Union (Frankfurt, Germany — AWS region eu-central-1). Some of our service providers (Supabase, Vercel, Cloudflare, Google) are incorporated in the United States or operate global networks, even where their EU data centres are used, and limited data (for example connection metadata) may be accessed from outside the EEA. For any such transfer we rely on:

• an adequacy decision of the European Commission — including the EU-U.S. Data Privacy Framework where the provider is certified — or
• the EU Standard Contractual Clauses under Implementing Decision (EU) 2021/914, with supplementary measures where required.

You can request a copy of the relevant safeguards at privacy@confir.eu.

8. Retention

We retain personal data only for as long as necessary for the purposes set out above and to comply with our legal obligations:

• Server logs — up to 14 days, unless needed longer to investigate a security incident
• Enquiries and contact-form messages — up to 12 months after our last exchange, unless a contract follows
• Account data — for the duration of the subscription and 30 days after deletion of your account
• Service data and audit logs — for the duration of the subscription and the export window in the DPA; thereafter as instructed by the customer organisation, which is responsible for meeting its own EU AI Act retention duties (typically 10 years for Annex IV documentation)
• Invoices and accounting records — 8 to 10 years under German tax and commercial law (§ 147 AO, § 14b UStG)
• Support tickets — 2 years after closure
• Marketing data — until you withdraw consent

Where data is retained beyond these periods, it is only because a statutory retention duty applies or because it is needed to establish, exercise or defend legal claims.

9. Your rights under the GDPR

You have the right to:

• Access the personal data we hold about you (Art. 15)
• Rectify inaccurate or incomplete data (Art. 16)
• Erasure (“right to be forgotten”) (Art. 17)
• Restrict processing (Art. 18)
• Portability — receive your data in a structured, machine-readable format (Art. 20)
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3))

To exercise any of these rights, email privacy@confir.eu. We respond without undue delay and at the latest within one month. Where the data concerned is customer content we process as a processor (Section 2.2), we will forward your request to the customer organisation that controls it.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The supervisory authority responsible for Confir is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, lda.bayern.de. A list of all German supervisory authorities is available from the Federal Commissioner for Data Protection at bfdi.bund.de.

10. Security

We protect personal data using appropriate technical and organisational measures (Art. 32 GDPR). Details are available in our Trust Hub. Key safeguards include: encryption in transit (TLS 1.2+) and at rest (AES-256), Row-Level Security on every database table, immutable audit logging, MFA, least-privilege access and regular security testing.

11. Cookies and information stored on your device

The website and the Service store information on your device only where this is strictly necessary to provide the service you have requested (§ 25 (2) TDDDG) — for example your login session and your cookie choice. Any non-essential storage, such as analytics, is used only with your prior consent (§ 25 (1) TDDDG), which you can withdraw at any time. Which items are stored, for how long and how to control them is set out in our Cookie Policy.

12. Children

The Service is intended for use by businesses. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided personal data to us, please contact us and we will delete it.

13. Obligation to provide data

You are not legally obliged to provide personal data to us. However, without the data marked as required at sign-up or checkout we cannot create an account, conclude a contract or provide the Service.

14. Changes to this Policy

We may update this Policy from time to time. We will publish the updated version on this page with a new “Effective” date. For material changes, we will notify account holders by email or via the Service before the change takes effect.

15. Contact

For any privacy question, please write to privacy@confir.eu or to our postal address (see Section 1).