Privacy Policy

The controller of your personal data under Article 4(7) of the General Data Protection Regulation (GDPR) is Good Fella Studio GmbH, the company operating Annnimate. Our registered details are in the Legal Notice.

For all privacy matters, contact support@annnimate.com. We are not required to appoint a Data Protection Officer under Article 37 GDPR.

We process personal data on these legal bases under Article 6(1) GDPR:

• Performance of a contract — Article 6(1)(b). To create your account, give you access to the Library and any Landmark Kit you bought, deliver receipts, process refunds, and provide support.
• Compliance with a legal obligation — Article 6(1)(c). To retain billing records for 10 years per § 147 AO (German tax law) and to respond to lawful data-protection requests.
• Legitimate interests — Article 6(1)(f). To run cookieless product analytics, debug errors, prevent fraud and abuse, recover and learn from abandoned checkouts (see 3.1), and improve the product. We balance our interest in running a sustainable product against your interests.
• Consent — Article 6(1)(a). For full-mode analytics with cookies and session recordings, newsletter subscriptions, the optional reply email on roadmap suggestions, and any optional cookies. Consent is recorded with a timestamp and can be revoked any time.

We share your personal data only with processors that help us deliver the Service. Each has a data processing agreement (DPA) in place with us under Article 28 GDPR and processes data only on our instructions.

Several of our sub-processors operate from the United States. When your data is transferred outside the European Economic Area, we rely on the EU-US Data Privacy Framework certification (Stripe, Resend, Vercel, GitHub) or the European Commission's Standard Contractual Clauses (Kit, Supabase). PostHog is hosted in the EU, so no transfer takes place for analytics data.

• Account data: for the duration of your Subscription, plus 12 months after cancellation in case you reactivate.
• Billing and invoice data: 10 years from the invoice date, as required by § 147 of the German Fiscal Code (Abgabenordnung / AO).
• Newsletter subscribers: until you unsubscribe, plus 24 months thereafter as a record of consent.
• Cookieless analytics events: 24 months from the event date.
• Full-mode analytics (consent-based, including session recordings): 30 days for recordings, 24 months for events.
• Server logs: 30 days.
• Support email threads: 36 months after the last reply, then deleted.
• Showcase submissions: until you withdraw them or the showcase is retired.

Under the GDPR and the German Federal Data Protection Act (BDSG), you have the following rights regarding your personal data:

• Right of access — to know what personal data we hold about you (Article 15 GDPR).
• Right to rectification — to have inaccurate data corrected (Article 16).
• Right to erasure — to have data deleted in certain circumstances (Article 17).
• Right to restriction of processing — to limit how we use your data (Article 18).
• Right to data portability — to receive your data in a portable format and have it transmitted to another controller (Article 20).
• Right to object — to processing based on legitimate interests, and to direct marketing at any time (Article 21).
• Right to withdraw consent — at any time, without affecting prior lawful processing (Article 7(3)).
• Right to lodge a complaint — with the Bavarian Data Protection Authority (BayLDA) or your local supervisory authority (Article 77).
• Right not to be subject to automated decision-making — including profiling that significantly affects you (Article 22). We do not make automated decisions about you.

To exercise any of these rights, email support@annnimate.com. We reply within one month per Article 12(3) GDPR. We may extend this by two months for complex requests and tell you within the first month. We may ask for proof of identity proportionate to the request.

See our Cookie Policy for what we store on your device. Our analytics run in cookieless mode by default — no cookies, no localStorage. We only set cookies for sign-in, checkout, and any optional features you actively turn on.

Annnimate is built for professional developers and is not directed at children. Under Germany's implementation of GDPR Article 8, the digital consent age in Germany is 16. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we delete the data without delay.

You only receive marketing emails from us if you subscribed deliberately. We use double opt-in via Kit: when you submit your email, Kit sends a confirmation link, and your subscription becomes active only after you click it.

Every marketing email has an unsubscribe link at the bottom. You can also email support@annnimate.com to be removed. Unsubscribes are processed within a few minutes and we keep a record of the unsubscribe for 24 months as evidence of compliance.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we notify the Bavarian Data Protection Authority (BayLDA) within 72 hours of becoming aware of it (Article 33 GDPR). If the risk is high, we notify affected users without undue delay (Article 34). We maintain an internal record of all data breaches regardless of risk level.

We update this policy when the way we process data materially changes (new processors, new categories of data, new purposes). Material changes are announced in our changelog and via email to active subscribers at least 30 days before they take effect. The last-updated date at the top of the page is always current.

We hope to address any concern you have directly. If you remain unsatisfied, you have the right to lodge a complaint with a supervisory authority. The competent authority for our company is:

• Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
• Promenade 18
• 91522 Ansbach, Germany
• Email: poststelle@lda.bayern.de
• Website: lda.bayern.de