Privacy Policy

We are not required to appoint a data protection officer. For all privacy questions and requests, contact us at the address above.

This policy covers the website DiffHub and all its features. It is written to meet the EU General Data Protection Regulation (GDPR), the German Telecommunications Digital Services Data Protection Act (TDDDG), the UK GDPR, the Swiss Federal Act on Data Protection (FADP) and US state privacy laws. Region-specific information is in sections 14 and 15.

Data

IP address, date and time, requested page, referrer, browser and operating system, error information

Purpose

Delivering the website, security (for example preventing abuse and attacks), rate limiting and fixing errors

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in a secure, working website); § 25(2) TDDDG where information is stored on your device only because it is strictly necessary

Retention

Hosting logs are kept for a short period by our hosting provider (usually a few days, at most 30 days), unless needed to investigate a specific security incident

Data

Email address, password (stored only as a hash by our sign-in provider), username, display name, profile picture, bio, links you add, account settings, sign-in times

Purpose

Creating and running your account, signing you in, showing your public profile, sending emails you need (confirmation, password reset, security notices)

Legal basis

Art. 6(1)(b) GDPR (contract)

Retention

Until you delete your account; afterwards deleted within 30 days, except where we must keep data longer by law (section 11)

Your username, display name, profile picture and bio are public. Posts, comments, likes and class activity are visible to others as shown in the interface, either publicly or only to members of a class.

Data

Membership status and role, join date, answers to a class's joining questions, posts, comments, course progress, points and level, event participation, notification settings

Purpose

Providing classes, courses, leaderboards and notifications

Legal basis

Art. 6(1)(b) GDPR (contract)

Retention

As long as you are a member or your account exists; your posts can remain in a class until you or the class deletes them

Data

Name, email, billing address and country, the product purchased, amount, currency, VAT, payment status, transaction ids, and for fraud prevention device and IP information. Card or bank details go directly to Stripe; we never see or store the full numbers

Purpose

Processing payments and subscriptions, receipts, VAT, refunds and chargebacks, preventing fraud, bookkeeping

Legal basis

Art. 6(1)(b) GDPR (contract); Art. 6(1)(c) GDPR (tax and accounting obligations); Art. 6(1)(f) GDPR (fraud prevention)

Retention

Accounting records are kept for 8 years and invoices and annual financial records for up to 10 years (§ 147 German Fiscal Code, § 257 German Commercial Code)

Stripe processes payment data on our behalf and, for fraud prevention and its own legal obligations, also as an independent controller. See the Stripe Privacy Policy.

Data

PayPal email address, balance, earnings per payment, payout requests and their status, PayPal transaction ids, notes. Where required by law, also full name, address, date of birth, tax identification number, VAT number and country of residence

Purpose

Calculating your revenue share, sending payouts via PayPal, preventing payout fraud, meeting tax reporting obligations

Legal basis

Art. 6(1)(b) GDPR (contract); Art. 6(1)(c) GDPR together with the German Platform Tax Transparency Act (PStTG) for DAC7 reporting

Retention

Payout and accounting records: 8 to 10 years (section 6). DAC7 data: 10 years after the end of the reporting year (PStTG)

When you request a payout, all platform administrators receive an email with your name, email address, PayPal address and the amount so they can process it. To send the payout, an administrator enters your PayPal address and the amount at PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, which processes this as an independent controller (PayPal Privacy Statement).

Where the PStTG applies, we report your identification data and earnings to the German Federal Central Tax Office (Bundeszentralamt für Steuern), which may share them with the tax authority of the EU country where you live. We will tell you before the first report.

Emails are sent through Resend, which processes the recipient address, content and delivery status on our behalf.

Data

Name, email address, your message and any information you provide

Purpose

Answering your request

Legal basis

Art. 6(1)(b) GDPR if your request relates to a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in responding)

Retention

Deleted once the request is resolved, unless statutory retention obligations apply

Some links to third-party products (for example GPU cloud providers) are affiliate links. If we earn a commission from a purchase, you do not pay more. When you click such a link, we record the click with the time, link, referrer, IP address, browser type and, if you are signed in, your user id, to count clicks, prevent click fraud and reconcile commissions. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in financing the site through affiliate partnerships). These records are deleted when no longer needed for these purposes, at the latest after 12 months.

After the click, the provider may set its own cookies to attribute a purchase to us. We only receive aggregate information such as order value and our commission, never your payment data. The providers' own privacy policies apply on their websites.

• Account and profile: until account deletion, then within 30 days
• Content in classes: until deleted by you or the class, or when your account is deleted
• Payment, invoice and payout records: 8 to 10 years (tax and commercial law)
• DAC7 creator data: 10 years after the reporting year
• Hosting logs: at most 30 days
• Affiliate click records: at most 12 months
• Analytics: 14 months, only with consent
• Backups: deleted data can remain in backups for a limited period until they are overwritten

Where we must keep data by law, we restrict its use to that purpose.

We use the providers below. Most process data on our behalf under a data processing agreement (Art. 28 GDPR). Some are based in, or use sub-processors in, countries outside the EU/EEA. Such transfers are protected by an adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or by the EU Standard Contractual Clauses (Art. 46 GDPR), with the UK Addendum and Swiss amendments where relevant.

We also disclose data to authorities, courts or professional advisers (such as our tax adviser) where we are legally required to or where it is necessary to establish, exercise or defend legal claims (Art. 6(1)(c) and (f) GDPR). We do not sell personal data.

• Access to the data we hold about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17) and restriction of processing (Art. 18)
• Data portability in a machine-readable format (Art. 20)
• Withdrawal of consent at any time, with effect for the future (Art. 7(3))
• Complaint to a supervisory authority (Art. 77), in particular in the EU country where you live or work

To exercise your rights, email support@diffhub.io. We respond within one month; for complex requests this can be extended by two months. We may ask you to confirm your identity. You can also change your profile, notifications and cookie choices, or delete your account, directly in your account.

Our supervisory authority is: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany, www.lda.brandenburg.de.

We do not use automated decision-making, including profiling, that produces legal effects for you (Art. 22 GDPR).

Providing data is voluntary. Without the data marked as required (for example an email address for an account, or payout details for creators) we cannot provide the respective service.

United Kingdom: under the UK GDPR and the Data Protection Act 2018 you have the rights described in section 13. You can complain to the Information Commissioner's Office (ico.org.uk). Transfers from the UK rely on the UK Extension to the Data Privacy Framework or the UK International Data Transfer Addendum.

Switzerland: the Federal Act on Data Protection (FADP) gives you equivalent rights. You can contact the Federal Data Protection and Information Commissioner (edoeb.admin.ch). Transfers rely on the Swiss-US Data Privacy Framework or Standard Contractual Clauses recognised by the Commissioner.

Categories we collect (in the last 12 months): identifiers (name, email, username, IP address); commercial information (purchases, subscriptions, payouts); internet activity (pages viewed and interactions, the analytics part only with consent); approximate location derived from IP; content you post; and for creators, tax identifiers where required. Sources, purposes and retention are described in sections 2 to 11. We disclose these categories only to the service providers in section 12 and as described in section 7.

No sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and have not done so in the last 12 months. We do not knowingly sell or share personal information of consumers under 16. We use sensitive personal information (account login, tax identifiers) only for purposes permitted by law.

Your rights. Depending on your state, you can ask to know and access the personal information we hold, correct it, delete it, receive a portable copy, and opt out of sale, sharing, targeted advertising and profiling. We will not discriminate against you for exercising these rights. You may use an authorized agent; we may ask the agent for proof of authorization and verify your identity. If we deny a request, you can appeal by replying to our decision; if you are still unsatisfied, you can contact your state attorney general.

Send requests to support@diffhub.io.

We use technical and organisational measures to protect your data, including TLS encryption in transit, encryption at rest by our hosting and database providers, hashed passwords, restricted administrator access, rate limiting and regular updates. No method of transmission or storage is completely secure. If a breach affects you, we will notify you and the authorities as required by law.

DiffHub is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us at support@diffhub.io and we will delete it.

We update this policy when our services or the law change. The date at the top shows the current version. If a change significantly affects how we use your data, we will inform you by email or in your account before it takes effect. Where processing requires your consent, we will ask again.

See also our Terms of Service and Imprint.