Datenschutzerklärung

Privacy policy

At Sushi Dev GmbH, we take your privacy seriously. We are committed to protecting your personal data and ensuring that it is handled responsibly and transparently.

Data Collection and Use

We collect and use your personal data only to provide and improve our services. This may include information necessary to process your requests, deliver services, and enhance your user experience. Private information like name, email is only stored to ensure a secure access to the data stored within our systems.

Every user an delete the account at any time. For further information on how to achieve this please go to our

How We Use Personal Information

We use Personal Information for the following purposes and according to the legal rules explained below:

• To provide and improve our services — to create or update your account and make the services better based on the data we collect. Legal basis: contract or legitimate interest.
• To process your payments — to work with payment providers to manage your transactions. Legal basis: contract or legitimate interest.
• To measure usage and bill for it — to meter stored volume, delivered traffic, API operations and other metered resources, to apply the quotas of your package, and to substantiate invoices. Legal basis: contract or legitimate interest.
• To keep an audit trail of your assets — to record what changed on a file, when, and who changed it. Legal basis: legitimate interest and, where applicable, legal obligation.
• To get feedback or conduct research — to ask you for your opinion or develop new services. Legal basis: legitimate interest.
• To communicate with you — to reply to your requests, give you support, or provide information you need. Legal basis: steps to enter a contract or performance of a contract.
• To prevent fraud and protect our systems — to detect and stop fraud, solve disputes, or handle security issues. Legal basis: legitimate interest.
• To follow legal requirements and protect rights — to follow laws, process your data requests, or ensure safety and privacy. Legal basis: legal obligations.

Tracking on Our Website, and Why

We keep tracking on our public website to a minimum, and nothing that is not required to serve the page runs before you have switched it on.

• What is required: a session cookie and a CSRF token. Without them we cannot keep you signed in or protect forms against forgery, so these are not presented as a choice.
• Fathom Analytics: a privacy-focused, cookie-free analytics service. We use it to see which pages are actually read, which entry points work, and where visitors leave — the information we need to decide what to write and what to fix. Fathom stores no cookie and no identifier that would let us recognise you on a later visit or build a profile of you, and the reports we see are aggregated counts, not individual journeys.
• Front chat: the support widget. It sets its own cookies so that a conversation you started stays attached to you between visits, which is what makes support continuous rather than starting from zero every time.

Every third party we allow is listed individually in the consent banner, by vendor, by the host your browser would connect to, and by the names of the cookies it sets, so that the list can be checked rather than believed. Consent is asked for per service, not per category. Your decision is stored in your browser and can be changed or withdrawn at any time; withdrawing it reloads the page so that the service in question is not started again. Nothing on this list is loaded before you agree to it.

Delivery and Access Logs

Assets stored on fairu.app are delivered through our file proxy. Every request for an asset is recorded, and we want to be explicit about it because these requests are usually made by our tenants' visitors rather than by our tenants themselves.

• What we record: the requested file, the time of the request, the volume transferred, and technical data that is part of every HTTP request — the IP address and the user agent of the requesting client.
• Why we record it: to calculate and substantiate usage-based fees, to apply the quotas of the tenant's package, to detect and stop abuse and attacks on the service, and to produce the delivery statistics we show tenants about their own assets.
• How long we keep it: request-level records, including IP addresses, are deleted automatically after 30 days. What remains after that are aggregated counters per day, per tenant and per file, which carry no information about individual requesters and are kept for billing, accounting and statutory retention purposes.
• Who is responsible for what: where the requesters are a tenant's own visitors, that tenant is the controller for the delivery of those assets and is responsible for describing this processing in their own privacy notice.

Audit Logs for Files

We keep an audit log for every file stored on the platform. Its purpose is to make it possible to establish, after the fact, whether a file was changed — and if so, when, by whom, and from what to what.

• What is recorded: creation, updates to the file and its metadata, replacement of the stored object, blocking and unblocking, changes to licences and copyright information, tags, comments, signature requests, exports to backup targets, deletion, and restoration. Each entry holds the action, the time, the values that changed, and the actor — the user account that triggered it, or the system where the change came from an automated process.
• Why we do it: assets managed here are published, licensed and invoiced. When a question arises later — whether a licence was in place at the time of use, whether a copyright notice was removed, whether an approved image was quietly replaced afterwards — the audit log is the record that answers it. It is also what allows us to respond to copyright and DMCA notices with facts instead of assumptions, and what allows a tenant to see for themselves that nothing has been altered without their knowledge.
• How long we keep it: the audit log of a file holds its most recent entries — currently the latest 100 — and is deleted together with the file.
• Workspace-level audit log: account and configuration events, such as sign-ins, permission and role changes, and changes to workspace settings, are recorded separately together with the acting user, the IP address and the user agent. Passwords, tokens, API keys and other secrets are never written to an audit log, even when the change concerned them.

Data Storage and Retention

We store your data only for as long as it is necessary to fulfill the purpose for which it was collected, or as required by applicable laws and regulations. Once the data is no longer needed, we securely delete or anonymize it.

User Control and Consent

You have full control over your personal data. At any time, you may request access to, modification, or deletion of your data. If you no longer wish for us to retain your information, you can let us know, and we will take appropriate steps to remove it from our systems.

Deleting or blocking an asset removes it from delivery, but the caches it has already been served from are cleared in the background rather than at the moment of the request. Depending on the current load of the platform this can take a while, so a copy may still be delivered for a period after the change. See Section 8 of our

Security

We implement robust security measures to protect your data from unauthorized access, loss, or misuse. Our practices are regularly reviewed and updated to ensure compliance with the highest standards.

User Responsibility for Uploaded Content

Users of fairu.app are solely responsible for ensuring compliance with all applicable data protection laws and regulations regarding the files and content they upload, store, share, or process through our platform. This includes, but is not limited to:

• Ensuring that any personal data contained in uploaded files is collected and processed lawfully
• Obtaining all necessary consents from data subjects before uploading their personal data
• Complying with applicable data protection regulations (such as GDPR, CCPA, or other local laws)
• Implementing appropriate access controls and sharing settings for sensitive content

For information regarding liability limitations and indemnification obligations, please refer to our

If you have any questions or concerns about your privacy or how we handle your data, please feel free to contact us at

Thank you for trusting Sushi Dev GmbH with your information. Please do not hesitate to contact us if you have further questions about data privacy within fairu.

Hosting

We store our data inwithin the infrastructure of DigitalOcean (https://www.digitalocean.com/legal/privacy-policy) in Frankfurt am Main (DE).