Privacy Policy

Last updated: 13.10.2026

This is a translation provided for convenience. The German version of this page is the legally binding one; in case of any discrepancy, the German text prevails.

Controller

Platte Software UG (haftungsbeschränkt)
Am Krögel 2
10179 Berlin
Germany

Represented by: Lucas Oliver Pilzen, Friedrich Theodor Gies

Email: hello@platte.ai

Contact for data protection matters: Friedrich Theodor Gies

General principles

We process personal data exclusively on the basis of the applicable data protection legislation, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). Personal data means any information relating to an identified or identifiable natural person.

We process personal data in accordance with the principle of data minimisation: only data necessary for the respective purpose is processed.

Legal bases

Where we obtain your consent for processing operations, Article 6 (1)(a) GDPR is the legal basis. Where processing is necessary for the performance of a contract or in order to take pre-contractual steps, Article 6 (1)(b) GDPR is the legal basis. Where we are subject to a legal obligation, Article 6 (1)(c) GDPR is the legal basis. Where processing is necessary for the purposes of our legitimate interests and your interests or fundamental rights do not override them, Article 6 (1)(f) GDPR is the legal basis. The basis that applies in each case is stated explicitly with each processing activity below.

Retention

Unless an explicit retention period is stated in this policy, we delete personal data as soon as the purpose of processing no longer applies and no statutory retention obligations prevent deletion. Such obligations arise in particular from Section 147 of the German Fiscal Code and Section 257 of the German Commercial Code; for the duration of those periods, processing is restricted rather than continued.

Recipients and categories of recipients

We disclose personal data only where this is necessary for the purposes described. The following categories of recipients may be involved:

our hosting provider, as a processor pursuant to Article 28 GDPR,
providers used to send email to people who have signed up for it, likewise as processors,
tax and legal advisers, where legally required,
authorities and courts, where we are legally obliged to disclose.

We do not sell personal data. We do not disclose personal data to third parties for advertising purposes.

Transfers to third countries

We do not transfer personal data to countries outside the European Union or the European Economic Area. All processing described in this policy takes place on servers within the EU.

No obligation to provide data

You are under no statutory or contractual obligation to provide us with personal data. However, without the information marked as required we cannot process your enquiry or sign you up for the newsletter. No other disadvantage arises for you.

Hosting

This website is hosted by:

Scaleway SAS, 8 rue de la Ville-l’Évêque, 75008 Paris, France

The servers are located in France and therefore within the European Union. A data processing agreement pursuant to Article 28 GDPR is in place with the provider, who processes the data arising when the website is accessed solely on our instructions.

Legal basis: Article 6 (1)(f) GDPR. Our legitimate interest lies in the secure and reliable provision of this website.

Server log files

Each time this website is accessed, the server automatically collects information transmitted by your browser that is technically necessary to deliver the page. The following is collected:

the address requested,
the date and time of the request,
the volume of data transferred,
notification of successful retrieval,
browser type and version,
the operating system,
the previously visited page (referrer),
the IP address of the requesting device.

This data is not combined with other data sources and is not evaluated to identify individual people.

Purpose: delivering the website, ensuring system security and stability, and detecting and defending against attacks.

Legal basis: Article 6 (1)(f) GDPR. Our legitimate interest lies in the secure and uninterrupted operation of this website.

Retention period: to be determined.

Encryption

For security reasons and to protect the transmission of confidential content, this website uses TLS encryption. You can identify an encrypted connection by the “https://” prefix in your browser’s address bar and by the padlock symbol. While encryption is active, the data you transmit to us cannot be read by third parties.

Audience measurement with Umami

We use Umami, an open-source audience measurement tool, to understand how this website is used and to improve it on that basis. Visitors whose browser sends the “Do Not Track” signal are excluded from measurement.

Self-hosted, no disclosure to third parties

We run Umami on our own infrastructure at Scaleway in France. This is not a cloud service of the vendor. The data collected does not leave our servers and is not transmitted to the vendor or to any other third party.

What data is collected

Each page view transmits and stores the following anonymised information:

the page accessed (path and query parameters) and its title,
the previously visited page (referrer),
browser type, operating system, device type and screen size,
the language set in your browser,
the country (and, where available, region and city), derived from the IP address at the time of measurement.

Names, email addresses or any other information that could identify individual people are not collected.

Interaction data (events)

Beyond page views, the measurement collects anonymised interaction data: clicks on interactive elements (buttons or links), how far a page is scrolled, and when the website is left via an external link. Only technical information is transmitted — a label for the element, the section of the page it sits in, its position within that section and, for external links, their address (URL). Input into form fields never enters the measurement.

Cookieless

Audience measurement operates without cookies. No cookies are set, no data is stored in localStorage or comparable storage on your device, and no device fingerprinting takes place.

How IP addresses are handled

The IP address is processed only while the measurement request is being handled: it is used solely to derive the approximate location and to form an anonymised session identifier, which groups successive requests into a single visit. The IP address itself is not stored. The session identifier is a random value with no plain-text reference; the secret value (“salt”) used to form it rotates regularly, monthly by default, so that your device cannot be inferred across longer periods either.

Heatmaps

To improve the usability of these pages, a heatmap is additionally collected: the click and scroll positions from a sample of visits (currently 15% of sessions) are aggregated and displayed per page. The evaluation takes place at the level of whole pages; individual sessions or people cannot be recognised in it. The recording transmits no form input; the associated script and the measurement data run, as described above, exclusively through our own measurement server.

This collection also works without cookies and without storing information on your device, so consent under Section 25 (1) TDDDG is not required. Session replays, which would reproduce individual visits, are not currently created; if that ever changes, this paragraph will be adjusted beforehand.

Because audience measurement neither stores information on your device nor accesses information already stored there, consent under Section 25 (1) TDDDG is not required for it — the measurement runs without a consent banner. The consent banner this website carries (Cookie settings, reachable from the footer at any time) concerns only the optional advertising tracking described below, the Reddit Pixel.

Legal basis and right to object

Legal basis: Article 6 (1)(f) GDPR. Our legitimate interest lies in being able to understand the use of this website in aggregate form and to improve what we offer.

Objection: under Article 21 (1) GDPR you have the right to object at any time, on grounds relating to your particular situation, to this processing. A message to the contact address below is sufficient. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

Retention period

The measurement data is stored in the database of the measurement software on our server. Because neither IP addresses nor cookies nor any other personal identifiers are stored, the data cannot be clearly attributed to individuals. We delete it as soon as we no longer need it for evaluation.

Advertising tracking with the Reddit Pixel

To measure the reach and the success of our ads on Reddit and to steer our campaigns, this website — on the basis of your consent alone — uses the Reddit Pixel of Reddit Inc., 548 Market St, 160931 San Francisco, CA 94104, USA. Without your consent the pixel is not loaded: in that case your browser establishes no connection to Reddit servers, and no information is stored on or read from your device.

Scope of processing: after consent, the pixel reports a PageVisit event on every page view, and a Lead event for the corresponding actions on this website — for example clicking one of our call-to-action controls or successfully submitting one of the forms. For this purpose Reddit sets the _rdt_uuid cookie on your device, through which your device can be recognised again on later visits and your page visits matched with your ad contact on Reddit. The pixel transmits no identifiers such as names or email addresses; so-called Advanced Matching is deactivated.

Legal basis: your consent — Section 25 (1) TDDDG for access to, or storage of, information on your device, and Article 6 (1)(a) GDPR for the processing of the data itself. Consent is voluntary: the website is fully usable without a marketing consent.

Recipients and third countries: Reddit processes the data as an independent controller, not as our processor. Processing takes place, in substance, in the USA. Reddit Inc. is certified under the Data Privacy Framework of the EU Commission; that certification is the guarantee for the data transfer to the USA (Article 45 GDPR).

Withdrawal and opt-out: you can withdraw your consent at any time with effect for the future (Article 7 (3) GDPR) — via the Cookie settings link in the footer of every page. On withdrawal we delete the Reddit cookie from your device to the best of our ability; data already transmitted cannot be recalled, and the lawfulness of the processing carried out before the withdrawal remains unaffected. In addition you can make advertising-related settings directly at Reddit under reddit.com/prefs/ads.

Storage period: the cookie’s lifetime is set by Reddit and lies in the range of months. As Reddit processes the data as its own controller, we have no influence over deletion there; the data is deleted once Reddit no longer needs it for the purpose named above.

On this website you can subscribe to news about Platte using the form in the footer. The form submits your entry to our own API server (api.platte.ai), which — like the measurement software described above — runs on our infrastructure at Scaleway.

Data collected: your email address. We collect no further information at this point. To document your consent, we additionally log the time of sign-up as well as the time and the IP address of the confirmation.

Double opt-in: sign-up uses the double opt-in procedure. After you sign up, you receive an email asking you to confirm via the button on our confirmation page. Only after that confirmation do we add you to the list. If no confirmation follows, we delete the sign-up automatically after 30 days.

Sending: confirmation emails are sent via Scaleway Transactional Email, a service of Scaleway S.A.S., headquartered in Paris. Processing takes place exclusively within the European Union.

Legal basis: Article 6 (1)(a) GDPR.

Withdrawal: you may withdraw your consent at any time, for example via the unsubscribe link in every email or by a message to the contact address below. Unsubscribing via the link deletes your email address completely. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

Retention period: until withdrawal. We additionally keep the record of consent for up to three years in order to meet our accountability obligation under Article 5 (2) GDPR.

Contacting us

If you contact us by email or via the contact form, we process your email address together with the content and information you provide, for the purpose of handling your enquiry.

Contact form: The form on the “Contact” page submits your details — name, email address and your message, plus optionally your company, phone number, company size and how you heard about us — to our own API server (api.platte.ai), which runs on our infrastructure at Scaleway like the analytics software described above. Your enquiry is stored there for handling. To notify us internally, we forward the details to our own contact address; like the newsletter, the send runs via Scaleway Transactional Email inside the EU. To ward off spam, the form contains an invisible field that people cannot fill in and which we use solely to discard automated submissions.

Legal basis: Article 6 (1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract; otherwise Article 6 (1)(f) GDPR, our legitimate interest being in responding to enquiries.

Retention period: we delete your enquiry once it has been dealt with conclusively, unless statutory retention obligations apply.

Fonts, external content and embeds

This website embeds no third-party services. Every file required to render it is served from our own server:

Fonts. The typefaces used, Bricolage Grotesque and Inter, are self-hosted. There is no connection to Google Fonts or any other font service.
Images and icons. All images, icons and illustrations are served from our own server. No third-party content delivery network is used.
Embedded content. No maps, videos, scheduling tools, social media widgets or other third-party content are embedded.

Two exceptions apply. The audience measurement described above runs, with its script and its measurement data, exclusively through our own measurement server (umami.platte.ai), which likewise runs on our infrastructure at Scaleway. And the script call described in the section Advertising tracking with the Reddit Pixel connects to Reddit servers (redditstatic.com) once you have consented; without your consent that contact does not take place either.

When you visit this website your browser therefore establishes no connection to third-party servers, and no data is transmitted to third parties — except for the two cases named above, described there in detail.

Your rights as a data subject

You have the following rights in relation to personal data concerning you:

Access (Article 15 GDPR): you may request confirmation of whether, and which, data we process about you.
Rectification (Article 16 GDPR): you may request that inaccurate data be corrected and incomplete data completed.
Erasure (Article 17 GDPR): you may request erasure of your data where the statutory conditions are met.
Restriction of processing (Article 18 GDPR): you may request that processing of your data be restricted.
Data portability (Article 20 GDPR): you may request the data you provided in a structured, commonly used and machine-readable format.
Objection (Article 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on Article 6 (1)(f) GDPR.

To exercise these rights, a message to the contact address below is sufficient.

Where processing is based on your consent, you may withdraw it at any time with effect for the future (Article 7 (3) GDPR). The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

Right to lodge a complaint with a supervisory authority

Under Article 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin, Germany

Website: datenschutz-berlin.de

Changes to this privacy policy

We update this privacy policy when the legal situation or our processing activities change. The version published on this page applies. The date of the last change is shown at the top of this page. Where material changes occur, we will inform affected data subjects to the extent necessary.

Contact