Data Protection Overview
This privacy policy explains how Savault processes personal data when you visit or use the platform.
Personal data means any information relating to an identified or identifiable person.
We process personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR).
Controller
The controller responsible for data processing is:
Benjamin Michael Bremer
Gartenstraße 58a
29525 Uelzen
Germany
Email: legal@savault.de
How We Collect Data
Personal data may be collected in different ways.
Data you provide voluntarily:
Emails sent to us
Newsletter subscriptions
Copyright or removal requests
Support inquiries
Form submissions (e.g. contact, support, or removal requests)
Automatically collected technical data:
When you visit Savault, certain technical information may automatically be processed, including:
IP address
Browser type and version
Operating system
Device information
Requested pages
Date and time of access
Referring website
This information is required to provide, maintain, and secure the website.
Purpose of Data Processing
We process personal data for the following purposes:
Providing and maintaining Savault functionality
Improving website performance and reliability
Preventing abuse and misuse
Handling user inquiries and form submissions
Managing newsletter subscriptions
Operating community features such as voting and saved resources
Protecting the security of our infrastructure
Legal Basis for Processing
We process personal data based on the following legal grounds:
Art. 6(1)(a) GDPR — Consent
Used when you voluntarily provide information or subscribe to services such as newsletters.
Art. 6(1)(b) GDPR — Contract / Pre-contractual measures
Used where processing is necessary for handling inquiries related to services or potential collaborations.
Art. 6(1)(f) GDPR — Legitimate Interest
Used for operating, securing, improving, and maintaining Savault.
Our legitimate interests include:
Providing a reliable platform
Improving user experience
Preventing fraudulent activity and spam
Maintaining technical security
Hosting Provider — Framer
Savault is hosted using Framer.
Provider:
Framer B.V.
Rozengracht 207
1016 LZ Amsterdam
Netherlands
Website: https://www.framer.com
Framer provides the infrastructure required to operate Savault.
During website usage, technical information may be processed, including:
IP address
Server logs
Browser information
Technical request data
The processing is required to deliver the website securely and reliably.
Legal basis: Art. 6(1)(f) GDPR
A Data Processing Agreement (Art. 28 GDPR) has been concluded. Where data is transferred outside the EU/EEA, appropriate safeguards (in particular EU Standard Contractual Clauses) are in place.
Supabase Backend Services
Savault uses Supabase for backend functionality, including community features such as voting and database storage.
Provider:
Supabase Inc.
Supabase may process technical and functional data required for these features.
Depending on usage, processed data may include:
Resource identifiers
Vote information
Timestamps
Technical request information
Anonymous identifiers
Savault does not require user accounts for voting functionality and does not intentionally collect names, passwords, or personal profiles through voting.
Legal basis: Art. 6(1)(f) GDPR
Local Storage
Savault uses browser local storage to provide certain features.
Stored information may include:
Saved websites
Collections
User preferences
Anonymous voting identifiers
This data remains stored locally on your device and is not transmitted unless required for a specific feature.
You can remove local storage data at any time through your browser settings.
Legal basis: Art. 6(1)(f) GDPR
Cloudflare Workers
Savault uses Cloudflare Workers for secure API communication and backend processing.
Provider:
Cloudflare, Inc.
101 Townsend St.
San Francisco, CA 94107
USA
Website: https://www.cloudflare.com
Cloudflare may process:
IP addresses
Request metadata
Browser information
Timestamps
Cloudflare helps provide secure and reliable communication between Savault services.
Legal basis: Art. 6(1)(f) GDPR
Where personal data is transferred to the United States, the transfer is based on the EU Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR and additional safeguards implemented by Cloudflare.
Contact Forms (LazyForms)
Savault uses LazyForms (operated by DamnGoodTools) to process form submissions such as support inquiries, copyright/removal requests, and general contact requests.
When you submit a form on Savault, the data you provide (for example name, email address, message content, and any other fields you fill in) as well as technical metadata (IP address, timestamp, and browser information) are transmitted to and processed by LazyForms.
LazyForms acts as a data processor on our behalf. A Data Processing Agreement pursuant to Art. 28 GDPR is in place where required. Submissions are stored securely, can be viewed in a dashboard, forwarded by email, and optionally synced to Google Sheets.
According to LazyForms, form processing runs on Cloudflare Workers and data is stored in a PocketBase database. Spam protection may include honeypot fields or Cloudflare Turnstile.
Legal basis:
• Art. 6(1)(b) GDPR where the inquiry relates to a contractual or pre-contractual matter
• Art. 6(1)(f) GDPR for general communication, spam prevention, and secure form handling
• Art. 6(1)(a) GDPR where consent is required (e.g. for optional fields or specific purposes)
More information:
https://lazyforms.com/privacy
GitHub and jsDelivr CDN
Savault may use GitHub and jsDelivr to deliver static assets such as:
Website screenshots
Images
Icons
Other media files
When these assets are loaded, technical information may be processed, including:
IP address
Browser information
Requested files
Time of request
Legal basis: Art. 6(1)(f) GDPR
External Websites and Third-Party Links
Savault is a directory that contains links to external websites and services.
When you click an external link, you leave Savault.
The respective provider of the external website is responsible for:
Their own data processing
Cookies
Privacy practices
Website content
Services offered
Savault has no control over third-party privacy practices.
Website Screenshots, Logos, and Metadata
Savault may display publicly available information about third-party websites, including:
Screenshots
Logos
Favicons
Website descriptions
Technical information
This information is used for website discovery, identification, and presentation purposes.
All third-party intellectual property remains the property of its respective owners.
Requests regarding displayed content can be submitted to: legal@savault.de
Sponsored Listings and Referral Links
Savault may contain sponsored listings or referral links.
Sponsored content is clearly marked where applicable.
Referral links may contain tracking parameters such as UTM parameters.
These parameters are used to understand traffic sources and improve platform performance.
They are not used to create personal profiles.
Legal basis: Art. 6(1)(f) GDPR
Newsletter
If you subscribe to the Savault newsletter, your email address is processed to send updates about new resources, websites, and platform updates.
Newsletter subscriptions require confirmation through a double opt-in process.
The newsletter is sent via Brevo (formerly Sendinblue).
Provider:
Brevo
Sendinblue SAS
106 boulevard Haussmann
75008 Paris
France
Website: https://www.brevo.com
Privacy Policy: https://www.brevo.com/legal/privacypolicy/
Stored information may include:
Email address
Subscription status
Registration date
Confirmation date
Consent records
Opening and click rates (if tracking is enabled)
You may unsubscribe at any time using the unsubscribe link included in every newsletter or by contacting us at legal@savault.de.
Legal basis: Art. 6(1)(a) GDPR (consent)
A Data Processing Agreement pursuant to Art. 28 GDPR is in place with Brevo.
Cookies
Savault only uses technically necessary cookies and similar technologies required for website functionality.
No advertising cookies or personalized tracking technologies are used unless explicitly stated.
Data Transfers Outside the European Union
Some service providers used by Savault (in particular Cloudflare and LazyForms infrastructure) may process data outside the European Union or the European Economic Area, including the United States.
Where data is transferred to countries outside the EU/EEA, such transfers are carried out only on the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular the EU Standard Contractual Clauses (SCCs). A Transfer Impact Assessment is taken into account for providers located in the USA.
Data Retention
Personal data is stored only for as long as necessary for the purpose it was collected.
When data is no longer required, it is deleted unless legal obligations require longer retention.
Your Rights
Under the GDPR, you have the right to:
Request access to your personal data
Request correction of inaccurate data
Request deletion of your data (“right to be forgotten”)
Restrict processing
Object to processing based on legitimate interests
Data portability
Withdraw consent at any time with future effect
Lodge a complaint with a supervisory authority
To exercise these rights, please contact us at:
legal@savault.de
Data Protection Officer
We have not appointed a Data Protection Officer, as this is not required under Art. 37 GDPR for Savault (operated by a single individual without systematic large-scale processing of personal data).
SSL/TLS Encryption
Savault uses SSL/TLS encryption to protect communication between your browser and our infrastructure.
Changes to This Privacy Policy
We may update this privacy policy when our services, technologies, or legal requirements change.
The latest version will always be published on this page.
Last updated: July 2026
