1. 1. Controller
The controller is Neithra Technologies – Fabian Lorenz, Thaler Weg 2a, 51647 Gummersbach, Germany, email support@geckify.dev, phone +49 2266 4889976 (Germany), +1 332 287 9966 (USA). Please direct privacy enquiries to this contact.
2. 2. Hosting and infrastructure
geckify.dev runs on Cloudflare, Inc. (San Francisco, USA) and its EU subsidiary: Workers run the application, D1 stores accounts and cloud workspaces, R2 stores project files and uploaded images. Cloudflare processes data on our behalf under a data processing agreement. EU users' data can be processed on Cloudflare's global network, including in the United States; the safeguards are described in section 10. Legal basis: our legitimate interest in a fast, secure service (Art. 6 (1) (f) GDPR) and, for signed-in customers, performance of the contract (Art. 6 (1) (b)).
When you publish a project with Geckify hosting, its build runs on a server of our own at netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany (data centre in Nuremberg, Germany), which processes the project files needed for the build on our behalf under a data processing agreement. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR).
3. 3. Server logs
Each request is recorded in server logs: URL, date and time, HTTP status, bytes transferred, referrer if your browser sends one, browser and operating system, and your IP address. We use the logs to keep the service running, to detect abuse and to investigate errors — never to build profiles. They are deleted after 30 days at the latest unless an entry is needed as evidence of an attack. Legal basis: legitimate interest in security and stability (Art. 6 (1) (f) GDPR).
4. 4. Local preview without an account
You can use the builder without an account. In that mode your projects, prompts and uploaded images are stored only in your own browser (localStorage and IndexedDB). They are never sent to our servers and we cannot see them. Clearing your browser data deletes them; there is no copy on our side.
5. 5. Account and sign-in
With an account we process your email address, sign-up and sign-in times, and the projects you save to your private cloud workspace. Sign-in uses your email address and a six-digit one-time code that we send by email — there is no password. The code is valid for ten minutes and only once; we keep it solely as a keyed hash, never in clear text, and limit code requests per address and per network address to stop abuse; before a code is sent, Cloudflare Turnstile checks that the request comes from a person. Plus Five Five, Inc. (Resend) (USA) delivers the code email as our processor and receives your email address and the content of that email for this purpose only. A session cookie (httpOnly) keeps you signed in and contains a random identifier only. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR). Accounts are closed on request: write to support@geckify.dev and we close the account and delete the account data within 30 days, except invoices subject to statutory retention.
6. 6. Payments
Paid plans are billed through Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA) on a checkout page hosted by Stripe. Card numbers never reach our servers; there is no card field on geckify.dev. From Stripe we receive a customer reference, the plan, the billing country, the card brand and last four digits, and the payment status, so that we can activate your plan and keep our records. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR) and our accounting obligations (Art. 6 (1) (c)); billing records are kept for eight years for invoices and accounting vouchers; books and annual accounts for ten years by law.
Every purchase is handled by Sold through Link, LLC ("Link"), a Stripe service, as merchant of record: Link and Stripe process your name, billing address, payment details and tax data to collect the payment, calculate the tax of your billing country and issue the invoice — as independent controllers under their own privacy notices, which the checkout page links, not as our processors.
Before a new order starts, Cloudflare Turnstile checks that it comes from a person, and orders per network address are limited. Legal basis: our legitimate interest in preventing abuse of the order process (Art. 6 (1) (f) GDPR).
7. 7. Your model provider API key and model runs
Geckify has no AI model of its own. For AI editing you connect your own provider API key — execution supports OpenAI, Anthropic, Google (Gemini) and Moonshot AI (Kimi). We store the key encrypted and use it only for runs you explicitly approve in the builder. The first approved step receives your prompt and language; later editing and review steps also receive project text, screen and element structure, layout and style data, existing image references and earlier step results. A separately approved repair also includes its original request and earlier review findings. These are structured presentation data; this editing path does not transmit source-code files or image files for visual analysis. The selected provider receives the data on your instruction, under its terms and privacy notice. We send nothing on our own initiative, never use your prompts or projects for training, and removing the key in your account settings deletes it immediately. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR). Because you choose the provider and the moment, you are responsible for being allowed to share the content — for example other people's personal data in a project. For Google connections we record a separate declaration of adulthood, professional/business use and use of the required Paid Services: wording version, time, user/account reference and affected key connection, without a birth date or identity-document copy. This evidence is retained for at most 365 days; a new declaration is then required before further relevant use. The basis is performance of the requested integration and our legitimate interest in complying with the service conditions (Article 6(1)(b) and (f) GDPR).
8. 8. Contact form and email
The contact form asks for your name, email address, a topic and your message. It is delivered to us by email so that we can answer you; the message itself is not stored in a database. To keep automated abuse out, the form uses Cloudflare Turnstile, a bot check that evaluates technical signals of the request (such as the IP address and browser characteristics) without a tracking cookie, and we count requests per IP address and per sender address for a limited time — both only as keyed hashes, never in clear text. In addition, the contact form and the cancellation button contain a field that stays invisible to people, check how long the form took to fill in, and have your browser solve a small computing task when you send — without a third party and without cookies. We keep the correspondence as long as needed for your request and delete it afterwards, at the latest after twelve months, unless a statutory retention obligation applies. The same goes for direct mail to support@geckify.dev. Transactional emails — sign-in codes, receipts, account notices and subscription reminders — are delivered by Plus Five Five, Inc. (Resend) (USA) as our processor, which receives your address and the message. Legal basis: legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR) or, where a contract is concerned, Art. 6 (1) (b).
Cancellations made with the cancellation button and withdrawals made with the "Withdraw from contract" function are, in addition to the email to us, stored in our database at Cloudflare (D1): time of receipt, name, email address, contract details, for a cancellation also its type, the requested date and the cause, the language, whether the form was sent with or without JavaScript, whether the form protection described above marked it as possibly automated, and whether our emails were delivered — not your IP address. The withdrawal function uses the same form protection. We keep this record to prove that and when your declaration reached us and to process it. If you are signed in when you send the form and enter the address of your account, we also link the declaration with your account and initiate cancellation at period end for an unambiguously matched monthly contract; different dates, termination for cause and existing consumer annual contracts receive a separate review. Legal basis: Article 6(1)(b) GDPR for handling, (c) for statutory retention of contractual correspondence and (f) for clarification and proof of receipt. We keep these entries for six years from the end of the year in which the declaration was received, unless a longer statutory retention obligation applies (for example section 147 of the German Fiscal Code, section 257 of the German Commercial Code), and then delete or anonymise them.
9. 8a. Optional website support assistant
Without enabling the AI option in the website chat, answers come from the product guide in your browser. If the AI option is offered and you tick it, your question, page language and market/currency are sent through our central Neithra Technologies support service to OpenAI. Google Gemini is not used in this public website assistant. Processing outside the EU, including in the United States, is possible. This website assistant uses our provider access; you do not need to connect your own API key.
We do not automatically attach account details, email address, IP address, workspace files or earlier chat messages to the central support request. Please do not enter passwords, payment details or confidential information in your question. Your consent applies to submitted questions and can be withdrawn for future questions by unticking the AI option. The local product guide remains available. Legal basis: consent (Art. 6 (1) (a) GDPR). The safeguards for international transfers are described in section 10. Public AI support requires a separate confirmation that you are at least 18. We retain its wording version, time and a random evidence identifier for 30 days, without a birth date or identity-document copy, and transmit signed evidence to the central service. This supports and evidences permitted use under Article 6(1)(b) and (f) GDPR. Consent to AI processing remains separate and voluntary; without it you can use local product help.
10. 9. Cookies and browser storage
We use only what the site needs: a cookie and a localStorage entry for your language, a cookie and localStorage entry for your consent choice, a session cookie for signed-in accounts, and localStorage/IndexedDB for local projects and images. None of it is used for tracking. We set no analytics cookies. The consent banner offers "analytics" and "marketing"; both stay off unless you enable them. "Marketing" loads only the PromoteKit script of our partner programme, which notes in a cookie which partner link brought you here (see the Cookie policy); "analytics" currently loads nothing. Necessary storage relies on § 25 (2) TDDDG and Art. 6 (1) (f) GDPR; any optional category would rely on your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can withdraw via the cookie settings link in the footer.
11. 10. Recipients and international transfers
We share personal data only with the processors listed below, each bound by an agreement under Art. 28 GDPR, with the independent controllers marked as such, and with authorities where the law requires it. Several providers process data in the United States. Where a provider is certified under the EU-US Data Privacy Framework, transfers rely on the Commission's adequacy decision for that framework; otherwise we rely on the Standard Contractual Clauses plus safeguards such as encryption in transit and at rest. A copy of the clauses is available from support@geckify.dev.
- Cloudflare, Inc. — hosting, database, file storage, network security and the Turnstile bot check on forms (USA / EU)
- netcup GmbH, Karlsruhe — our own build server for publishing with Geckify hosting (data centre in Nuremberg, Germany)
- Plus Five Five, Inc. (Resend) — delivery of sign-in codes and other transactional emails (USA)
- PromoteKit — attribution of purchases to partner links, only after your consent to marketing cookies
- Stripe Payments Europe, Ltd. and Stripe, Inc. — payment processing and invoicing, including Link, Stripe's saved-payment service, if you choose to use it (Ireland / USA)
- Sold through Link, LLC ("Link"), a Stripe service, as merchant of record (Stripe "Managed Payments") for every purchase — sale, payment collection, tax and invoice, as independent controller, not as our processor
- The AI provider you connect yourself (OpenAI, Anthropic, Google or Moonshot AI) — receives prompts and the structured presentation data described above only on your instruction, under its own terms
12. 11. Retention
In short: server logs up to 30 days; account and workspace data for the life of the account plus up to 30 days from the closure you requested and we confirmed; contact correspondence up to twelve months; cancellations and withdrawals received through our forms six years from the end of the year of receipt, unless a longer statutory retention obligation applies; invoices and accounting vouchers eight years, books and annual accounts ten years, each from the applicable year end; your provider key until you remove it or close the account; consent choices twelve months. Local browser data stays on your device until you delete it.
13. 12. Your rights
Under the GDPR you may request access to your data (Art. 15), correction (Art. 16), erasure (Art. 17), restriction (Art. 18) and portability (Art. 20), and you may object to processing based on legitimate interest (Art. 21). Consent can be withdrawn at any time without affecting earlier processing. Email support@geckify.dev; we answer within one month and may ask you to confirm that you control the account's email address.
14. 13. Right to lodge a complaint
You can complain to a supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.
15. 14. Notice for California and other US residents
This notice also addresses California online-privacy transparency requirements (CalOPPA), which are distinct from the applicability thresholds of the CCPA/CPRA. Rights under the CCPA/CPRA or other US state laws apply where their statutory scope and conditions are met, including where applicable to business contacts. We process identifiers and account/contact details, purchase and subscription information, necessary connection logs, project contents and support communications as described above. Sources, recipients, purposes and retention are described in the corresponding sections. We do not sell personal information or share it for cross-context behavioural advertising. The optional affiliate attribution described in the cookie section is disabled unless you opt in; Global Privacy Control overrides marketing consent.
You can request access, correction or deletion at support@geckify.dev without opening a new account. We verify requests proportionately; an authorised agent may act with appropriate authority. Where applicable, you may opt out of sale/sharing and exercise rights without discrimination. We respond within the applicable statutory deadline: ordinarily one month under the GDPR and UK GDPR, 30 days for Swiss access requests, or 45 calendar days for covered California requests; permitted extensions are explained in time. You may contact the competent authority, including the ICO in the UK or the FDPIC in Switzerland. Cookie settings let you withdraw optional marketing consent. We honour Global Privacy Control by disabling affiliate tracking; Do Not Track alone does not change optional cookie consent. Necessary account and security processing continues. Material privacy changes are announced on this page with the updated date and, where required, directly to affected users before taking effect.
16. 15. Changes to this notice
We revise this notice when the service, the law or our providers change; the date at the top shows the current version. Material changes affecting signed-in customers are announced by email before they take effect.