Legal Notice (Impressum)

Last updated: 12 April 2026

This website is operated by:

Marco Land Hauptstrasse 59 10827 Berlin Germany

[email protected]

Privacy Policy

Effective: 12 April 2026 · Last updated: 12 April 2026

1. Introduction

This Privacy Policy explains how dummy.tools ("we", "us", "our") handles personal data when you visit dummy.tools or use the service. It applies to everyone who interacts with dummy.tools — visitors browsing the public pages and registered users on free or paid plans.

The operator is based in Germany and this policy is written in compliance with the EU General Data Protection Regulation (GDPR).

If anything in this policy conflicts with the Terms of Service, the Privacy Policy governs questions about data handling.

2. What we collect

We collect only what is required to run the service.

If you visit dummy.tools without signing in:

• Anonymous, aggregated usage data is recorded by our self-hosted analytics (see section 5). No personal data is collected.
• Nothing else is stored on our servers.

If you create an account:

• Your email address and authentication details (password hash or OAuth identifier).
• Any projects you save, including the uploaded images or PDFs attached to them.
• License status — which plan you purchased and when.
• Account activity — timestamps of logins and project edits, used for session management and troubleshooting.

If you make a purchase:

• Billing details (name, address, payment method) are collected and processed by Paddle as the Merchant of Record. We do not see or store your full payment card details. We receive the transaction confirmation, your email, and the purchased license information.

3. Why we collect it

• To run the service — authenticate your account, save your projects, enforce license limits.
• To process payments — via Paddle, to grant you the license you purchased.
• To communicate with you — license confirmations, service-critical notices (e.g. security or outage announcements), responses to your emails.
• To understand how the service is used — via privacy-preserving, self-hosted analytics, so we can improve it.

We do not sell your data, share it with advertisers, or use your uploaded artwork for anything beyond running the service for you.

4. Where your data lives (sub-processors)

We rely on a small number of service providers to run dummy.tools. All of them hold data either inside the EU or under GDPR-compliant arrangements.

Data shared with each provider is strictly limited to what's needed for their function. We do not transfer personal data to any provider outside this list.

5. Analytics

We use Plausible Analytics, which we self-host on our own Hetzner server. Plausible is a privacy-friendly tool: it collects no personal data and sets no cookies.

The data collected is strictly aggregated and anonymous: page views, referrer source, browser type, and country-level location. It cannot be used to identify you as an individual, and it is not shared with any third party.

You can read about Plausible's approach at plausible.io/privacy.

6. Cookies & local storage

We use only what is strictly necessary to operate the service:

• Authentication session — a secure cookie or local-storage token (set by Supabase) that keeps you logged in.
• UI preferences — local-storage entries that remember your sidebar state, color mode, and similar settings.

We do not use advertising cookies, tracking cookies, or any third-party cookies for analytics.

7. How long we keep your data

• Account data (email, login): kept for as long as your account is active.
• Projects and uploaded files: kept as long as your account exists. Deleting a project removes its files.
• Billing records: retained by Paddle and us as required by tax and accounting law (typically up to 10 years in Germany).
• Analytics data: aggregated and anonymous. Kept indefinitely in anonymous form; no personal identifiers are stored.

If you close your account, we delete your email, projects, and uploaded files within 30 days, except where we are legally required to retain records (e.g. invoices for tax purposes).

8. Legal basis for processing (GDPR)

• Running your account and delivering the service you paid for: performance of a contract (Art. 6(1)(b) GDPR).
• Security, abuse prevention, and anonymous analytics: our legitimate interest in operating a stable service (Art. 6(1)(f) GDPR).
• Billing and tax records: legal obligation (Art. 6(1)(c) GDPR).

Because we do not use advertising or tracking cookies, no separate consent banner is required.

9. Your rights

As a resident of the EU/EEA, you have the following rights under GDPR:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct any data that is inaccurate.
• Erasure — ask us to delete your account and associated data ("right to be forgotten").
• Portability — receive your data in a machine-readable format.
• Restriction or objection — limit or object to how we process your data.

To exercise any of these rights, email [email protected]. We'll respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority. In Germany, this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (for Berlin-based operators like us), or the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) at federal level.

10. Children

dummy.tools is not directed at children under 16. We do not knowingly collect personal data from minors. If you believe a minor has created an account, contact us and we'll remove it.

11. Changes to this policy

We may update this Privacy Policy from time to time. Significant changes will be announced to account holders by email, and the "Last updated" date at the top will change. Continuing to use dummy.tools after a change takes effect means you accept the updated policy.

12. Contact

If you have any questions about this Privacy Policy or want to exercise a data right, contact:

Marco Land [email protected]