Privacy Policy

As of 6 October 2026. This policy applies to annexshow.com, the editor, accounts, the agent API (REST and MCP) and related pages. The German version is the authoritative text.

1. Controller

AnnexShow
A service of ma-kom agentur UG (haftungsbeschränkt)
Managing director: Pascal Sanwald
Merkelbach 12
74541 Vellberg
Germany
Phone: (07907) 4090918
Email: mail@annexshow.com

No data protection officer has been appointed because the law does not require one for us. The controller above is the contact for all privacy questions.

2. Data we process

• Visiting the site: IP address, date and time, requested address, browser identifier (server log files at the hosting provider).
• Account: name, email address, password (hash only), language, plan, optionally a two-factor secret, and the Apple identifier if you sign in with Apple. On your first visit we automatically create a guest account without name or email so that you can use the editor immediately.
• User content: your projects, diagrams, presentations, comments, favourites, folders and brand kits (colours, fonts, logos), files you upload or import through the agent API (images, CSV and JSON data) and generated exports. We do not read this content; it is used only to operate the service for you. Please do not upload third-party personal data unless you have a legal basis for it.
• API access: API keys (only a hash is stored), permissions, time of last use, webhook addresses you configure.
• Billing: plan, invoice data and payment status; payment details themselves (card, bank) are processed by the payment provider (section 4).
• Communication: support tickets and emails, team invitations (email address of the invited person), withdrawal and cancellation statements (name, email address, contract reference, reason, IP address, browser identifier, time of receipt).
• Logs: security and activity log (sign-ins, failed sign-ins, API key use, consents, each with IP address and browser identifier), error and performance reports.
• Consent: your cookie choice (in your browser; for signed-in users also in the account with a timestamp).

3. Purposes and legal bases

• Providing the service, account, user content, billing, support, withdrawal and cancellation: performance of a contract, Art. 6(1)(b) GDPR.
• Retention of invoices and accounting records: legal obligation, Art. 6(1)(c) GDPR.
• Server log files, security and error logs, abuse and attack prevention, guest account, access counting without personal data: legitimate interest in secure and stable operation, Art. 6(1)(f) GDPR.
• Audience and advertising measurement with Google, and contact requests via "Text to diagram": your consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
• Strictly necessary storage access (session, sign-in, language, your cookie choice): Section 25(2) no. 2 TDDDG.

Right to object (Art. 21 GDPR): Where we process data based on legitimate interests (Art. 6(1)(f) GDPR) you may object at any time on grounds relating to your particular situation. An informal message to mail@annexshow.com is sufficient.

4. Recipients and processors

We use external service providers that process personal data on our behalf (processors under Art. 28 GDPR) or act as independent controllers. Processing agreements under Art. 28 GDPR are in place with our processors.

4.1 Hosting and email

The service runs on a server in Germany at Webspace-Verkauf.de ISP e.K., Grub am Forst, Germany (hosting provider, processor). The provider processes server log files (IP address, time, requested address, browser identifier) and the database with all account and user data. System emails (registration, password reset, invoices, support, confirmations) are sent through the same provider's mail server. Legal basis: Art. 6(1)(b) and (f) GDPR. No transfer to third countries takes place.

4.2 Payments - Stripe

We use Stripe (Stripe Payments Europe Ltd., Ireland; sub-processors include Stripe, Inc., USA) to process payments. Payment and master data are processed. Depending on country and amount Stripe offers methods such as card, SEPA direct debit, Klarna or Link; other payment services may then be recipients. Legal basis: Art. 6(1)(b) GDPR. Transfers to the USA rely on the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCC).

4.3 Payments - PayPal (existing subscriptions)

New bookings via PayPal have not been possible since 7 September 2026. For existing PayPal subscriptions we continue to process the payment and subscription events transmitted by PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg): subscription ID, payment status, amount, time and, where needed, the payer's name and email, to assign and manage your subscription and invoices. Legal basis: Art. 6(1)(b) GDPR; retention of invoice data: Art. 6(1)(c) GDPR. PayPal's own privacy notice also applies; third-country transfers by PayPal are governed by it.

4.4 Sign in with Apple

If you register with "Sign in with Apple" (currently in the native apps) we verify the sign-in token issued by Apple (Apple Distribution International Ltd., Ireland; Apple Inc., USA) and store the Apple identifier and the email address supplied by Apple (possibly a private relay address). Legal basis: Art. 6(1)(b) GDPR. Transfers to the USA rely on the DPF.

4.5 Internal administration (ma-kom Console)

For accounting and customer care we report events such as registration, payment and cancellation (email address, plan, amount, payment provider, time) to our own administration system operated by ma-kom agentur UG (haftungsbeschränkt) (console.ma-kom.biz). There is no external recipient. Legal basis: Art. 6(1)(b) and (f) GDPR.

4.6 Cookies and similar technologies

Set without consent because they are strictly necessary:

• cookies annexshow_session and XSRF-TOKEN (session and protection against forged requests; session lifetime 120 minutes),
• local storage of your browser: annexshow_token (sign-in or guest session; 24 hours for guests), i18nextLng (language), annexshow_cookie_consent (your cookie choice).

Everything else (section 4.7) is loaded only after your consent in the cookie banner. "Essential only" and "Accept all" are equivalent. You can change or withdraw your choice at any time via the "Cookie settings" link in the footer; processing carried out before withdrawal remains lawful.

4.7 Audience and advertising measurement - Google (consent only)

If you consent in the banner we load services of Google Ireland Limited (Ireland):

• Google Analytics 4 for audience measurement. Google sets the cookies _ga and _ga_* (up to two years). Google Analytics 4 does not log IP addresses; the IP address is nevertheless transmitted to Google when the script is loaded. No clear data (name, email) is sent to Google.
• Google Ads conversion tracking to measure the success of our ads.

The sole legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). Data may be transferred to Google LLC, USA, on the basis of the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCC).

We use Google Consent Mode v2: before your consent all signals (analytics and ad storage) are set to "denied" and no Google scripts are loaded. Only after you agree are the services activated; on withdrawal the signals are set back to "denied".

Own access counting: Independently of this we count page views from the server access log. Only the time and the requested address (without parameters) are taken over; IP address, browser identifier and referrer are not stored. Individual timestamps are deleted after 90 days; only the daily count remains. Legal basis: Art. 6(1)(f) GDPR.

4.8 Contact requests via "Text to diagram"

The tool at /text-zu-diagramm processes your entered bullet points only to create the diagram; they are not stored. If you voluntarily request a reply there, we store your email address, optionally name, organisation and message, your request, the source of your visit (for example a flyer) and the wording and time of your consent. Legal basis: your consent (Art. 6(1)(a) GDPR). The data is used only to answer your request, not for a newsletter. We first send a confirmation email (double opt-in); unconfirmed requests are deleted after seven days, confirmed ones after 24 months at the latest. Withdraw your consent at any time informally at mail@annexshow.com.

4.9 AI-assisted diagram generation via the agent API

If you send only a text request ("brief") instead of a finished structure to the agent API (/api/v1/agent/visualize), we derive a diagram structure with an AI model. The brief (free text up to 4,000 characters) is forwarded through the gateway Promptopoly (promptopoly.com, a service of ma-kom agentur UG (haftungsbeschränkt)) to the language model "gpt-5.6-luna" of OpenAI (OpenAI Ireland Ltd.; processing by OpenAI OpCo, LLC, USA); no account master data (name, email) goes to these recipients. The "Text to diagram" tool (section 4.8) does not use this AI path. Purpose: creating the diagram you requested. Legal basis: Art. 6(1)(b) GDPR. Please do not enter unnecessary third-party personal data in briefs. The transfer to the USA relies on Standard Contractual Clauses (Decision (EU) 2021/914) from our processing agreement with OpenAI; there is no DPF certification. Results are AI-generated (labelling under Art. 50 AI Act). No decision based solely on automated processing with legal effect for you, including profiling, takes place.

4.10 Share links and embeds

"Share" creates a link (/s/..., /embed/...) with a random, unguessable token. Anyone who knows the link can view the shared presentation or diagram without signing in (and download it, depending on the share). The links are blocked for search engines (noindex) but not password protected. We count views per link without IP address. Shares created by an AI agent through the agent API expire after 90 days unless you set your own expiry date. You can delete a link at any time or give it an expiry date; sharing then ends immediately. You are responsible for the content you share.

4.11 Webhooks, API keys and MCP

If you set up webhooks we send event data to the address you specify; you choose the recipient. API keys apply only to your account; every use is recorded with time, path and IP address in the security log (section 5).

4.12 Presence on Mastodon

We maintain a profile on mastodon.social (@AnnexShow). Our pages only link to it; no data is transferred to Mastodon when you visit our pages. If you visit or interact with our profile, the operator (Mastodon gGmbH, Germany) processes your data under its own privacy policy; for reach and interactions on the profile we and the operator are jointly responsible (Art. 26 GDPR) where applicable. Legal basis for our presence: Art. 6(1)(f) GDPR.

4.13 No other external content

Fonts, scripts and images are loaded from our own server. There are no maps, videos, social media plugins or third-party error tracking services.

5. Storage periods

• Account and user content: until your account is deleted. After a deletion request we delete content, files and credentials and anonymise the account after a 30-day grace period (immediately on request).
• Invoices and payment records: 10 years (Sections 147 AO, 14b UStG), also after account deletion, then without link to your account.
• Guest accounts: the guest session expires after 24 hours. Guest accounts are deleted 30 days after last use together with all content and share links; the editor tells guests about this. With an account you keep your content.
• Security and activity log (IP address, browser identifier): 365 days.
• Error and performance reports: 90 days.
• Withdrawal and cancellation: the statement with name and email as long as needed for contract handling and proof (limitation periods, tax duties); IP address and browser identifier are removed after 90 days.
• Data exports (Art. 15/20): the generated file 30 days.
• Contact requests "Text to diagram": see section 4.8.
• Server log files at the hosting provider: rotating, according to the provider's usual period.
• Backups: daily, kept 14 days; deleted data disappears from backups after 14 days at the latest.

6. Security

Transmission is encrypted via HTTPS. Passwords are stored only as hashes and must have at least 12 characters; sign-in can be protected with a second factor (TOTP). Uploaded SVG files are sanitised.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR, see section 3). You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

In the editor under Settings (section "Privacy") you can export your data as a JSON file ("Export my data") and delete your account ("Delete account", deletion after a 30-day grace period). Both are also available via API (/api/v1/me/data/export, /api/v1/me/data/delete); alternatively an email to mail@annexshow.com is enough. We answer within one month.

Right to lodge a complaint: You may complain to a supervisory authority, in particular the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, poststelle@lfdi.bwl.de.

8. Obligation to provide data

Guest use requires no data. For an account and paid plans we need name, email address and payment details; without them we cannot conclude the contract. Consent to measurement and advertising measurement is voluntary and not required to use the service.

9. Changes

We update this policy when the service or the legal situation changes. The version published here with the date above applies.