KROMA UG (haftungsbeschränkt) processes personal data in accordance with the GDPR (EU 2016/679), German BDSG, TDDDG and DDG. This policy describes all processing carried out on the WTFB platform (wtfb.site).
1. Data Controller
KROMA UG (haftungsbeschränkt)
Halberstädter Str. 17, 28215 Bremen, Germany
Managing Director: Roman Koliada
Amtsgericht Bremen, HRB 41879 HB · USt-IdNr. DE457760972
Email: [email protected] · Phone: +49 174 3503631
2. Data protection contact
An external Data Protection Officer (DPO) under § 38 BDSG is not mandatory for the current processing structure, and no DPO has been appointed. For all privacy questions and data-subject requests, contact [email protected].
3. Categories of data processed
- Account data: email, name/nickname, avatar, selected language, role, UI locale.
- Authentication: hashed password, session tokens, OAuth provider IDs (Google).
- Profile and public data: bio, social links, task completion stats, ratings, badges.
- Payment data: transaction metadata (ID, amount, currency, status), invoice; card numbers are processed by Stripe and not visible to us.
- Content: projects, audit URLs, tasks, reports, checklists, screenshots, videos, task-chat messages.
- Technical data: IP, user-agent, device type, referrer, timestamps, access logs, error logs.
- Behavioural data with consent: Session Replay (Sentry/Datadog) with input-field masking, marketing-pixel events.
- Cookies and similar technologies: see separate Cookies Policy.
4. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Registration, account, contract performance | Art. 6(1)(b) GDPR | Active account + 90 days |
| Payment processing, invoicing, tax records | Art. 6(1)(b), (c) GDPR; § 257 HGB; § 147 AO | 10 years |
| Email and support | Art. 6(1)(b), (f) GDPR | 3 years from last contact |
| Security, anti-fraud, bot/DDoS protection | Art. 6(1)(f) GDPR | Up to 12 months logs |
| Cookieless analytics (Plausible) | Art. 6(1)(a) GDPR | Aggregates indefinitely |
| Diagnostics, Session Replay (Sentry/Datadog) | Art. 6(1)(a) GDPR + § 25(1) TDDDG | Until withdrawal or 90 days |
| Marketing, ad pixels, attribution | Art. 6(1)(a) GDPR + § 25(1) TDDDG | Until withdrawal, max 30 days attribution |
| AI processing of tasks, reports and URL audit | Art. 6(1)(b), (f) GDPR | Provider retention depends on product, access channel and agreement; no-training does not mean zero retention. Results, including roast archives, remain in WTFB until deletion or the applicable retention period ends. |
| Moderation, disputes, audit logs | Art. 6(1)(c), (f) GDPR | Up to 3 years |
| Transactional email | Art. 6(1)(b) GDPR | Send logs — 6 months |
5. Recipients (processors)
The service register and region information is available on Subprocessors.
Lovable Cloud provides hosting, accounts and files; the primary database is in Frankfurt, which does not guarantee all processing stays in the EEA. The register also discloses Stripe, AI providers, Firecrawl, Google sign-in, email delivery, diagnostics, monitoring and conditional advertising services. Downstream recipients, entities and contractual chains require confirmation; recipient roles depend on the operation.
6. International data transfers
Some services may process data outside the EEA. Transfers require assessment of the specific recipient, agreement and applicable GDPR Chapter V basis. DPF applies only to an eligible, currently certified recipient within its certification scope; SCCs require appropriate terms and a transfer assessment. Encryption alone is not a legal transfer basis. This document does not certify that those checks have been completed for every service; contact our privacy address for applicable safeguard information.
7. Profiling and automated decisions
AI models are used to generate test cases, score report quality and audit URLs. These processes assist but do not have legal effects or similarly significant effects within the meaning of Art. 22 GDPR: final decisions (accept/reject, WTFx crediting, ban) are made by humans (moderator or Developer). You can challenge a decision and request human review by writing to [email protected]. See also AI Disclosure.
8. Cookies and trackers
Detailed categories and retention — see Cookies Policy. You can change cookie preferences at any time via the footer link.
9. Retention
Detailed retention is in the section 4 table. General rule: data is deleted or anonymised once the purpose is achieved, unless overriding legal obligations apply (bookkeeping/tax — 10 years per § 257 HGB and § 147 AO; anti-fraud logs — up to 12 months; moderation actions — up to 3 years).
10. Your rights (Art. 12–22 GDPR)
- Right of access to your data (Art. 15).
- Rectification of inaccurate data (Art. 16).
- Erasure (right to be forgotten, Art. 17).
- Restriction of processing (Art. 18).
- Data portability in a machine-readable format (Art. 20).
- Right to object to processing based on Art. 6(1)(f), including direct marketing (Art. 21).
- Right not to be subject to solely automated decision-making (Art. 22).
- Right to withdraw consent at any time without retroactive effect (Art. 7(3)).
- Right to lodge a complaint with a supervisory authority.
To exercise your rights, contact [email protected]. We respond within 1 month (Art. 12(3) GDPR), extendable to 3 months. See also Data deletion.
11. Supervisory authority
If you believe processing of your data infringes the GDPR, you may lodge a complaint. The competent authority for Bremen:
Die Landesbeauftragte für Datenschutz und Informationsfreiheit (LfDI) der Freien Hansestadt Bremen
Arndtstraße 1, 27570 Bremerhaven, Germany
Tel.: +49 421 361-2010 · Email: [email protected]
Web: www.datenschutz.bremen.de
12. Security
Technical and organisational measures (TOMs): TLS 1.2+ in transit, encryption at rest, Row-Level Security in DB, hashed passwords (bcrypt/scrypt), MFA for admins, environment separation, access logging, key rotation, least-privilege access, regular vulnerability scans. See Security page.
13. Minors
The service is not intended for persons under 18. We do not knowingly collect minors' data. If you are a guardian and believe your child registered, contact us and we will delete the account.
14. Policy changes
We may update this policy due to legal or product changes. The current version is always at /legal/privacy with an update date. Material changes are announced by email and/or in-app at least 30 days in advance.
15. Contact
Privacy: [email protected]
Security: [email protected]
Cookies: [email protected]