Privacy Policy

1. Controller

logostream UG

36124 Eichenzell, Germany

Email: contact@logostream.dev

2. What we process and why

Visiting the website and API requests

When you open our website or send a request to the API, your browser or client transmits technical data that is processed to deliver the response: IP address, date and time, requested URL or logo identifier, HTTP headers (such as user agent and referrer), and the response status. For authenticated API calls this also includes your API key.

We do not store IP addresses in our own usage records. For each authenticated API request we record only your API key, the request category (for example stocks or banks), the source that served the logo, the response status and the response time. IP addresses are processed by Cloudflare while the request is served (Section 4).

Purposes: delivering the website and API, security and abuse prevention, rate limiting, error analysis, and measuring API usage per key for plan limits and billing.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and reliable service) and, for API customers, Art. 6(1)(b) GDPR (performance of the contract).

Subscription and API key

Subscriptions and API keys are issued through Polar (Section 4). Polar emails your API key to you and gives you a customer portal to manage your subscription. On our side we store your API key together with its plan limit, its status and the number of requests made with it. Legal basis: Art. 6(1)(b) GDPR.

Payments and invoicing

Subscriptions are sold through Polar (Section 4). We can see the information needed to provide your plan and to meet our accounting duties, such as name, email address, billing address, plan and transaction reference, in our Polar account. We never receive your full card details. Legal basis: Art. 6(1)(b) and 6(1)(c) GDPR (statutory retention duties under German commercial and tax law).

Product update emails

If you are a customer, we may use the email address you provided when purchasing to send you emails about changes to our own products and the logostream API. You can object to this use at any time, free of charge and with effect for the future, via the unsubscribe link in every email or by emailing us. Legal basis: Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG (legitimate interest in informing existing customers about similar products).

Contact

If you email us, we process your message and email address to answer you. Legal basis: Art. 6(1)(b) or 6(1)(f) GDPR.

3. Cookies, local storage and tracking

We do not use advertising cookies, analytics or tracking tools, and we do not build user profiles. The website may store technically necessary data in your browser (for example local or session storage to keep the interface working). This does not require consent under § 25(2) TDDDG.

4. Service providers

We use the following processors and recipients. Where data is transferred outside the EU/EEA, we rely on the EU–US Data Privacy Framework or Standard Contractual Clauses (Art. 45, 46 GDPR).

Cloudflare (hosting, CDN, security)

The website and API run on Cloudflare (Workers, CDN, DNS, DDoS protection) by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare processes request data including IP addresses as described in Section 2 to deliver content and protect against attacks. Requests are served from the data center closest to you, which may be outside the EU. Privacy policy: https://www.cloudflare.com/privacypolicy/

Supabase (database, edge functions, storage)

We use Supabase (Supabase, Inc.) for our database, serverless functions and file storage. It stores our company and logo data and processes requests to the logo functions on this website. Our Supabase project is hosted in the EU (Frankfurt, Germany). Privacy policy: https://supabase.com/privacy

TwicPics (image conversion)

TwicPics is operated by Frontify AG, Unterstrasse 4, 9000 St. Gallen, Switzerland. Switzerland is covered by an adequacy decision of the European Commission (Art. 45 GDPR).

When you request a logo as PNG, WebP, JPG or AVIF, our API fetches the converted image from TwicPics. This happens server-to-server: TwicPics receives the image request from our infrastructure, not your IP address or browser information. Privacy policy: https://www.twicpics.com/legal/privacy

beehiiv (product update emails)

Product update emails are sent through beehiiv (beehiiv, Inc., USA). beehiiv processes your email address and subscription data, and may record technical data such as opens and clicks of the emails it delivers, on our behalf. Privacy policy: https://www.beehiiv.com/privacy

Polar (payments)

Checkout and subscription billing are handled by Polar, which acts as merchant of record for your purchase and processes payment and billing data under its own responsibility. After checkout you are redirected to our website; the redirect URL contains a checkout ID and a session token issued by Polar. Privacy policy: https://polar.sh/legal/privacy

5. If you embed logostream in your application

When logo URLs are loaded directly in your users' browsers, those users' IP addresses and browser information reach Cloudflare and our API (Sections 2 and 4). If you are an API customer, please account for this in your own privacy information. We process this data only to deliver the logos and for the purposes listed above, not for advertising or profiling. If you require a data processing agreement, contact us.

6. Retention

Technical request data is kept only as long as needed for the purposes above and then deleted or anonymized. Account and API key data is kept for the duration of the contract and deleted afterwards, unless statutory retention duties apply. Invoicing records are kept for the periods required by German commercial and tax law (up to ten years).

7. Your rights

You have the right to:

• access your data (Art. 15 GDPR),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interests (Art. 21).

To exercise your rights, email contact@logostream.dev. You can also lodge a complaint with a supervisory authority, in particular the one responsible for our registered office: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany.

8. Security

We protect data with appropriate technical and organizational measures, including encrypted connections (HTTPS) and access restrictions. API keys are kept server-side and must not be shared or published.

9. Changes to this policy

We may update this policy when our service or the legal situation changes. The current version is always available on this page.

Contact

If you have any questions about data privacy, you can reach us at: