Privacy Policy

1. Data Controller and Contact Information

Responsible for the processing of personal data on this website (viewnamic.com) and the Viewnamic publishing platform within the meaning of Art. 4 No. 7 of the EU General Data Protection Regulation (GDPR) is:

Dreher, Weiß GbR (Viewnamic)
Start-up Campus OWL, Office SC 2 207, Ausblick 1, 33100 Paderborn, Germany
Represented by the partners: Felix Dreher & Daniel Weiß
VAT ID (USt-IdNr.): DE303700917
Email: info@viewnamic.com
Website: https://viewnamic.com

A Data Protection Officer has not been designated, as the statutory prerequisites pursuant to Art. 37(1) GDPR and Section 38 of the German Federal Data Protection Act (BDSG) are not applicable. For any inquiries regarding data protection and the assertion of your data subject rights, please contact the controller directly via email.

2. Hosting, Database and File Storage (IONOS)

Our website, web application and database are hosted on servers provided by:

IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.

Files uploaded to Viewnamic (PDF documents and their cover images, images, videos, audio files and 3D models) are stored in private IONOS Object Storage in Frankfurt am Main, Germany. Readers' browsers load these files directly from the Object Storage through time-limited links; in doing so, IONOS processes the IP address and the technical browser information required to deliver the files.

When you access our web services, your web browser automatically transmits connection data that is recorded in web server log files. This data includes: your IP address, browser type and version, operating system, referrer URL, the requested resource/file, and the precise timestamp of the server request. In addition, our security software records sign-ins and failed sign-in attempts together with the IP address in order to detect and block attacks on user accounts.

Purpose and Legal Basis: Processing of server log files is carried out to ensure the technical operation, stability, system integrity, and cybersecurity of our platform on the basis of Art. 6(1)(f) GDPR (Legitimate Interest in the secure and efficient provision of our online services).

Data Processing Agreement: We have concluded a Data Processing Agreement (DPA / Auftragsverarbeitungsvertrag) with IONOS SE pursuant to Art. 28 GDPR. IONOS processes this data in data centers in Germany.

3. Backups

To ensure business continuity, data integrity, and the ability to restore our services after technical failures pursuant to Art. 32(1)(c) GDPR, backups of our servers and database are created within the infrastructure of our hosting provider IONOS SE in Germany (see Section 2). Backups are not transferred to any other provider.

Backups may contain the data stored on the platform at the time of the backup, including account data and customer content. They are protected against unauthorized access and are overwritten in the course of the regular backup cycle.

Purpose and Legal Basis: Art. 6(1)(f) GDPR (Legitimate Interest in maintaining effective disaster recovery mechanisms and fulfilling statutory data security mandates under Art. 32 GDPR).

4. Bot Protection and Anti-Abuse (Cloudflare Turnstile)

To protect our forms against malicious bot scripts, automated spam attacks, and credential stuffing, we use the bot-protection technology Cloudflare Turnstile provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile protects the sign-in, the registration, the password reset and the resending of the verification email, our contact and newsletter forms, and the PDF upload without an account ("Try it with your PDF", Section 8). It is loaded only together with these forms, not while you browse our website or read publications. We do not use Cloudflare's content delivery network (CDN) or any other Cloudflare service.

During the check, Cloudflare receives your IP address and technical information about your browser and device to verify human interaction without confronting you with distorted text or image-recognition puzzles. The data processed during verification is used solely for cyber-defense and spam prevention.

Legal Basis: Art. 6(1)(f) GDPR (Legitimate Interest in the protection of our web platform against abusive automated attacks) and Section 25(2) No. 2 TDDDG (strictly necessary for system security).

Data Transfer Safeguards: Data transfers to Cloudflare facilities in the USA are governed by the EU-U.S. Data Privacy Framework (DPF) as well as Cloudflare's standardized Data Processing Addendum incorporating EU Standard Contractual Clauses (SCCs).

5. Fonts, Scripts and Website Statistics

(1) No External Fonts or Third-Party Analytics: The fonts and scripts of our website and of the Viewnamic viewer are hosted on our own servers; the only exception is Cloudflare Turnstile, which is loaded together with the forms named in Section 4. We do not use Google Fonts, Google Analytics or any other third-party analytics, advertising or tracking service.

(2) Website Statistics on Our Own Server: To understand which pages of our website are used, our server counts page views itself, without cookies, without scripts in your browser, and without storing your IP address or any identifier of your device. Only daily totals are kept: the address and language of the page, where the visit came from (the host name of the referring website, a known search engine or social network, or "direct"), campaign labels contained in the page address (utm_source, utm_campaign) and the device class (desktop, tablet or mobile) derived from the browser's user agent. In addition, we count how often previews are started and registrations, newsletter sign-ups and contact requests are submitted, without any personal data. Page views of our staff, of bots, and of visitors whose browser sends a Global Privacy Control or Do Not Track signal are not counted. The daily totals are deleted after 25 months.

Legal Basis: Art. 6(1)(f) GDPR (Legitimate Interest in improving our website). No information is stored on or read from your device.

6. Inquiries, Appointment Scheduling (Calendly), and Newsletter

(1) Contact and Demonstration Inquiries: If you contact us via email or our contact form, we collect the submitted personal data (name, business email, company, and message content) strictly to process and reply to your inquiry. Messages sent through the contact form are delivered to our mailbox via Brevo (Section 7(5)). Legal Basis: Art. 6(1)(a) GDPR (your consent given in the contact form), Art. 6(1)(b) GDPR (Pre-contractual measures) or Art. 6(1)(f) GDPR (Legitimate interest in responsive B2B communication).

(2) Appointment Booking via Calendly Link: Our website contains external buttons/links leading to our scheduling portal on Calendly (Calendly LLC, 271 17th St NW, Atlanta, GA 30363, USA). When clicking this link, you leave our website and are redirected to Calendly's service. Calendly handles your booking data (name, email address, preferred meeting slot) under its own data privacy responsibility.

(3) Newsletter and Product Updates: If you subscribe to our newsletter, we process your email address, your first name if you provide it, and the page on which you subscribed. Our newsletter is sent via Brevo (Section 7(5)), which stores this data for us; the subscription becomes active only after you confirm it via a verified Double Opt-In procedure. You can unsubscribe at any time using the one-click unsubscribe link provided in every newsletter; your data is then no longer used for the newsletter. Legal Basis: Art. 6(1)(a) GDPR.

7. Platform Account, Social Login, Team Members, Emails (Brevo), and Payments (Stripe)

(1) Platform Registration & Administration: To access Viewnamic, Customers register an administrative account. We process business contact details (name, corporate email, company name, and hashed password credentials) to administer the account and fulfill contractual services. We record which version of our Terms of Service and of this Privacy Policy you accepted and how your email address was verified. Login sessions are kept without storing your IP address or browser details. Registrations that are not confirmed via the verification email are deleted after 14 days. Legal Basis: Art. 6(1)(b) GDPR.

(2) Social Login / Single Sign-On (Google & Microsoft): Where offered, users may register or authenticate via third-party OAuth Single Sign-On providers ("Sign in with Google" by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or "Sign in with Microsoft" by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). When utilizing social login, your browser connects directly to the authentication servers of the respective identity provider. The provider authenticates your identity and transmits your verified email address, name, and unique user identifier to Viewnamic to create or link your account; we store this link with your account. No passwords are exchanged. Google LLC and Microsoft Corporation are certified under the EU-U.S. Data Privacy Framework. Legal Basis: Art. 6(1)(b) GDPR (Contract execution) or Art. 6(1)(f) GDPR (Convenient and secure user authentication).

(3) Team Members and Invitations: Account owners can invite team members by email. We then process the invited person's email address, which we receive from the inviting account (Art. 14 GDPR), send the invitation, and process the data of the team member's own account as described in paragraph (1). Invitations are deleted 30 days after they expire or are withdrawn. Legal Basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (Legitimate interest of the account owner in working together).

(4) Activity Log: To support account owners and to keep the platform secure, important actions in an account (for example uploads, changes to publications and settings, and team changes) are recorded together with the acting user and the time. These entries are deleted after 12 months. Legal Basis: Art. 6(1)(f) GDPR.

(5) Emails (Brevo): Our emails are delivered via the email infrastructure of Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany): email verification, password resets, one-time codes for securely shared documents (Section 10), notifications to account owners, team invitations, invoices for customers who pay by bank transfer, the delivery of contact form messages (Section 6(1)) and our newsletter (Section 6(3)). We have concluded a Data Processing Agreement with Brevo pursuant to Art. 28 GDPR. Legal Basis: Art. 6(1)(b) GDPR and, for the newsletter, Art. 6(1)(a) GDPR.

(6) Payment Processing (Stripe): For electronic card and SEPA transactions, billing information is handled directly through the certified payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. When you subscribe to a plan, we transmit your email address, the name of your account, your billing address and, where provided, your VAT ID to Stripe; payment details are entered directly at Stripe. Stripe processes payment data as an independent controller; data may be transferred to Stripe, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework. Viewnamic does not store complete credit card numbers. Legal Basis: Art. 6(1)(b) GDPR (Payment execution) and Art. 6(1)(c) GDPR (Statutory fiscal and accounting duties).

(7) Invoices and Accounting: Invoices, credit notes and invoice addresses are kept for the statutory retention periods under German commercial and tax law (Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB)). Legal Basis: Art. 6(1)(c) GDPR.

8. Trying Viewnamic Without an Account ("Try it with your PDF")

On our website you can try Viewnamic with your own PDF without creating an account. For this purpose, we create a temporary preview access: a login cookie ensures that only your browser can open your preview. The PDF you upload is stored in our Object Storage (Section 2) and processed in the editor and viewer like any other publication. The preview, its temporary access and the uploaded PDF are deleted automatically 24 hours after you started it. If you decide to publish your preview, you register an account (Section 7), and the preview becomes part of your account; while your email address is being verified for this purpose, the deletion is postponed.

To prevent abuse, the number of previews per connection is limited. For this purpose, we store a keyed one-way hash of your IP address (not the IP address itself) for at most 24 hours. The upload is protected by Cloudflare Turnstile (Section 4).

Legal Basis: Art. 6(1)(b) GDPR (measures taken at your request before entering into a contract) and Art. 6(1)(f) GDPR (Legitimate interest in preventing abuse).

9. Processing of Customer Content (Data Processing on Behalf / Art. 28 GDPR)

Viewnamic allows commercial Customers to upload PDF files, images, videos, audio files, 3D models, click dummies and links, together with accessibility texts such as descriptions and transcripts. These materials may contain personal data, for example names, portraits or voices. To the extent Viewnamic hosts, converts, and delivers such content on behalf of our Customers, Viewnamic acts as a Data Processor pursuant to Art. 28 GDPR.

The respective Customer remains the sole Data Controller responsible for ensuring lawful processing grounds and copyright compliance. We conclude a standardized Data Processing Agreement (DPA / AVV) with our Customers.

10. Viewnamic Document Viewer, Reader Statistics and Secure Sharing

When readers access a published document via its individual project URL, a public overview page or a website embed, our web viewer displays the document and records reading statistics for the publisher:

• No Third-Party Advertising Trackers: The Viewnamic viewer does not contain commercial ad-network cookies, marketing tracking pixels, or cross-site profiling beacons. Readers are not tracked across unrelated websites.
• No Cookies for Statistics: The viewer stores nothing on the reader's device for its statistics. A random session identifier exists only in the browser's memory for the duration of the visit and groups the events of one reading session.
• Recorded per Reading Session: pages viewed and reading time, the view modes and zoom used, interactions with videos, audio files, 3D models, click dummies and slideshows, link clicks including the link target, downloads, and clicks on the publisher's badges ("More from …", "powered by Viewnamic"). Browser family, operating system, device type and language are derived on our server from the request headers; no screen sizes or exact browser versions are recorded.
• Public Overview Pages: page views, the publications shown and opened, and the referring website reduced to its host name and path.
• No Recording: No statistics are recorded when the reader's browser sends a Global Privacy Control or Do Not Track signal, for previews without an account (Section 8), and for the example documents embedded on our own website.
• No Permanent IP Storage: IP addresses are processed in volatile memory solely for network transmission and server defense. Complete IP addresses are not stored in the statistics database.
• Secure Sharing: When a publisher shares a document securely with individual recipients, we process the recipient's email address, send one-time access codes by email (Section 7(5)), store these codes only as hashes and delete them one day after they expire, may show the recipient's email address as a watermark on the pages, and record each recipient's accesses for the publisher, who can be notified of them.
• Retention Period: Reading statistics are deleted automatically after twelve (12) months.

Legal Basis: Where Viewnamic provides these statistics and secure sharing for a B2B publisher, processing is carried out on the publisher's behalf under the DPA. Access to the reader's device is limited to technically necessary storage (for example access cookies for password-protected or securely shared documents) and to display settings of the Reading Mode that the reader chooses (Section 11), pursuant to Section 25(2) No. 2 TDDDG.

11. Cookies and Browser Storage

We use only cookies and browser storage that are necessary for the services you use or that store settings you choose. None of them is used for tracking.

Name	Purpose	Lifetime
wordpress_logged_in_*, wordpress_sec_*	Keeps you signed in, including the temporary access of a preview (Section 8)	Until the browser is closed (ended by the server after 2 days); 14 days after "Remember me", email verification, social login, an invitation or a password change
wordpress_test_cookie	Checks that cookies work when signing in	Session
wp-postpass_*	Access to password-protected blog posts (only if used)	10 days
wp-settings-*, wp-settings-time-*	Settings of the administration area (staff only)	1 year
vnm_auth_verify_browser	Continues the registration after the email verification	1 day
vnm_auth_selected_price	The plan chosen before registering	30 minutes
vnm_auth_social_bind	Security of the social login (Section 7(2))	15 minutes
vnm_pending_invite	Accepting a team invitation while signing in	1 hour
pvl_access_*	Access to a password-protected document	30 minutes
pvl_sec_*	Access to a securely shared document after the code check	Up to 1 hour
Local storage vnr-display; session storage vnr-reading, vnr-scale	Width, font, color theme and text size of the Reading Mode, and whether it is open (only after you change them)	Until deleted / until the tab is closed
Local storage vnm-fx-motion	"Pause animations" on our website (only after you choose it)	Until deleted
Local storage imdeEditorTourSeen	The editor's introduction opens by itself only once	Until deleted

12. Retention Periods

We store personal data only as long as necessary for the respective purpose. In particular:

• Reading statistics, public overview statistics and the activity log: 12 months.
• Website statistics (anonymous daily totals): 25 months.
• Registrations that are not confirmed: 14 days.
• Previews without an account: 24 hours after they were started (Section 8).
• Deleted profiles: 30 days after deletion.
• Team invitations: 30 days after they expire or are withdrawn.
• One-time access codes: 1 day after they expire.
• Records of the rate limits (keyed hashes, no IP addresses): 15 minutes to 24 hours.
• Newsletter: until you unsubscribe.
• Account data, publications and uploaded files: as long as the account exists; we delete them when you delete them or ask us to delete your account, unless statutory retention obligations apply.
• Invoices, credit notes and other accounting records: for the statutory retention periods (Section 7(7)).

13. Recipients and Transfers to Third Countries

Besides IONOS SE (hosting, database, file storage and backups in Germany, Sections 2 and 3) and Brevo (emails, EU, Section 7(5)), the following recipients receive personal data as described above: Cloudflare, Inc. (bot protection, Section 4), Stripe (payments, Section 7(6)) and, only if you use them, Google and Microsoft (social login, Section 7(2)) and Calendly (Section 6(2)). Where data is transferred to the USA, the transfer is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, where stated, on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

14. Your Rights as a Data Subject

Under statutory provisions of the GDPR, you have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and withdrawal of consent with effect for the future (Art. 7(3) GDPR).

Right to Object (Art. 21 GDPR): Where we process your personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. You may object to the use of your data for direct marketing at any time without giving reasons.

Provision of Data: The data marked as required in our forms is necessary to conclude and perform the contract or to answer your inquiry; without it, we cannot provide the respective service. You are not otherwise obliged to provide personal data.

No Automated Decision-Making: We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

To exercise any of your rights, please submit an informal notification via email to: info@viewnamic.com.

15. Competent Supervisory Authority

You have the right to lodge a formal complaint with a data protection supervisory authority pursuant to Art. 77 GDPR if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with primary jurisdiction over Viewnamic is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
Website: https://www.ldi.nrw.de

16. Data Security and Updates

(1) SSL/TLS Encryption: For security reasons and to protect the transmission of confidential information, our platform utilizes end-to-end TLS encryption (HTTPS). You can identify an encrypted connection by the "https://" protocol and the lock icon in your browser URL bar.

(2) Updates: We reserve the right to modify this Privacy Policy to ensure continuous alignment with statutory requirements and platform enhancements. The current version is always accessible at viewnamic.com/privacy.