Privacy Policy

1. Introduction

wrkstatt UG (haftungsbeschränkt) ("we", "our", or "us") operates the ⌘CC macOS application and the website at usecmd.cc. We are committed to protecting your privacy and being transparent about how we handle your data.

This Privacy Policy explains what data we collect, why, and how we process it when you use ⌘CC.

2. Controller & Contact

The controller responsible for data processing is:

Data Protection Officer: marvin@wrkstatt.de

3. Data Collected in the macOS App

⌘CC is designed with privacy in mind. The app runs locally on your Mac and stores your preferences and API keys on your device only. We do not have access to your API keys.

When you activate a license, the app communicates with our server to validate your license key.

4. AI Processing

When you use ⌘CC to enhance, simplify, translate, or fix grammar in your text, the selected text is sent to third-party AI models for processing.

If you use our credits plan: Your text is routed through our server to OpenRouter. We do not log or store your text content. The request is proxied in real time and discarded.

If you bring your own API key (BYOK): Your text is sent directly from the app to OpenAI using your personal API key. We never see your text.

Purpose: Providing AI-powered text transformation.

Legal basis: Contract performance (Art. 6(1)(b) GDPR).

5. Payment Processing via Stripe

Payments are processed by Stripe. When you purchase a license or subscribe, Stripe collects:

• Payment details (card number, expiry, CVC)
• Email address
• Billing address (if applicable)

We do not store your payment details. We receive a customer ID, subscription status, and email from Stripe to manage your license.

Purpose: Processing purchases and managing subscriptions.

Legal basis: Contract performance (Art. 6(1)(b) GDPR).

6. Data Storage via Supabase

We use Supabase (hosted in the EU) to store:

• License keys and their activation status
• Stripe customer IDs (linked to your license)
• Subscription type and status
• Credit balances and usage history (for credits plan users)
• API keys (for credits plan users only, to proxy requests on your behalf)

We do not store your text content or browsing activity in our database. API keys for BYOK users are stored locally on your device only.

Purpose: License management and subscription tracking.

Legal basis: Contract performance (Art. 6(1)(b) GDPR).

7. Website Analytics via Umami

Our website uses Umami, a privacy-focused analytics tool. Umami:

• Does not use cookies
• Does not collect personally identifiable information
• Does not track users across websites
• Collects only anonymized page view and referrer data

Purpose: Understanding aggregate website usage to improve our content.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).

8. Live Chat Support via Telegram

Our website offers a live chat widget for support inquiries. If you choose to use the live chat, the following applies:

• A random, anonymous user ID is generated and stored in your browser's local storage to maintain the conversation. This ID is not linked to your name, email, or any other personal data unless you voluntarily share such information in the chat.
• Messages you send are forwarded to a private Telegram group where our team responds. This means your chat messages are transmitted through and stored on Telegram's servers.
• We do not store chat messages on our own servers. Messages exist only in the Telegram conversation and in your browser session. If you close the browser tab, the chat history on your side is cleared.
• Your IP address is used temporarily for rate limiting and abuse prevention. It is held in server memory only and is not persisted to disk or any database.

If you do not use the live chat, none of the above data is collected or transmitted.

Purpose: Providing customer support.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — enabling direct communication for support purposes.

9. Legal Basis for Data Processing

We process personal data based on the following grounds under the GDPR:

• Contract performance (Art. 6(1)(b)): Processing payments, managing licenses, and providing the AI text transformation service.
• Legitimate interest (Art. 6(1)(f)): Website analytics, security, and service improvement.

10. Data Retention

• License and subscription data is retained for as long as your license is active, plus any statutory retention periods.
• Stripe transaction records are retained as required by tax and accounting law (typically 10 years under German law).
• Website analytics data is aggregated and anonymized — no personal data is retained.
• Text submitted for AI processing is not stored by us.
• Live chat messages are not stored on our servers. They persist only in the Telegram conversation and are subject to Telegram's retention policies.

11. Your Rights

Under the GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your data ("right to be forgotten").
• Portability — receive your data in a structured, machine-readable format.
• Restriction — request restricted processing of your data.
• Objection — object to processing based on legitimate interest.

To exercise any of these rights, email us at marvin@wrkstatt.de.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence.

12. Children's Privacy

⌘CC is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

14. Contact