Privacy policy

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):

Email: yaroslavnashyvan@gmail.com
Phone: +491627491111

2. Overview

Coready is a platform companies use to run their catalog, orders, customers and websites. This policy covers two different roles. For the people who sign in to Coready, and for visitors of these public pages, we are the controller. For the data a company keeps in Coready about its own customers — and for the visitors and shoppers of the websites Coready serves for that company — the company is the controller and we process the data on its behalf (section 7). There is no advertising, no tracking and no analytics or marketing cookies.

3. Hosting and server

Coready and the websites it serves run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centers in Germany. Hetzner processes the data on our behalf (Art. 28 GDPR). When you open a page, the server necessarily processes your IP address and the requested address to deliver it and to protect the service from abuse. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

4. Your account

You sign in through our sign-in service, the SSO, which has its own privacy policy. Coready receives your account ID there, your email address, whether it is verified, and your name. Coready stores them with the companies you work in and your role in each, your interface language, when your account was created and set up, and a log of sign-ins and changes made in a company (who changed what, and when), which that company's admins can see. The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR); the change log also serves our and the company's legitimate interest in traceable records (Art. 6(1)(f) GDPR).

When an admin invites you to a company, Coready stores your email address and the invitation, and sends the invitation by email through our email service provider (section 8).

5. AI assistance

When someone in a company uses the AI assistant, the product texts and pictures they give it are sent to Google (Gemini, Google LLC, USA) to produce product data. Do not include personal data in them. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

6. Integrations a company switches on

A company may connect other systems, such as an inventory system or an older shop it imports from. Coready then exchanges the company's data with that system on the company's instruction (section 7).

7. Data we process on behalf of companies

A company keeps its catalog, orders, counterparties and customer accounts in Coready, and Coready serves its websites, their shopper accounts (signed in with a one-time code by email), carts and orders. For all of this the company is the controller; we process the data only on its instructions (Art. 28 GDPR), and a data processing agreement is available on request. Shoppers and website visitors should direct requests about their data to the company that runs the website.

8. Recipients and transfers to third countries

Recipients are Hetzner as our host, the SSO for signing in, our email service provider for invitations (Resend, Inc., USA) and, for the AI assistant, Google (USA). Transfers to the USA are based on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. Beyond that we do not pass your data on unless we are legally obliged to.

9. Cookies and browser storage

We only use what is strictly necessary (§ 25(2) no. 2 TDDDG); no consent is required for it:

• coready_session: keeps you signed in, up to 30 days;
• coready_oauth_state, coready_oauth_pkce, coready_oauth_return: protect a sign-in in progress, 10 minutes;
• core_admin_hint: tells the websites Coready serves that someone is signed in here, so they can offer the editor; it carries no value about you, up to 7 days;
• admin-locale: your interface language;
• your choice of light or dark theme, in your browser's local storage.

10. Storage period

We keep your account until it is deleted, and a company's data until the company is deleted or the contract ends. Database backups are kept for 14 days at most. Records we must keep by law (invoices) are kept for the statutory period.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Write to the email address in section 1. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

There is no automated decision-making within the meaning of Art. 22 GDPR.

12. Changes

We update this policy when Coready or the law changes. The version published here applies. See also the terms of service and the imprint.