Privacy policy

1. Controller

The controller responsible for processing personal data on this website under the General Data Protection Regulation (GDPR) is:

Appdevelz UG (haftungsbeschränkt)
Waldstraße 7a
82319 Starnberg, Germany
Represented by managing director Samuel Rogers
Email: info@appdevelz.com

Please use these contact details for privacy questions.

2. Data minimisation

The website is designed to minimise the data generated when you read it:

• We do not embed advertising pixels, social media plugins or additional analytics scripts such as Google Analytics.
• Fonts and images are served with the website. No external maps, videos or fonts are embedded.
• Cloudflare Turnstile spam protection loads in the final step of the inquiry form. Section 5 describes this processing.
• The form saves a draft in your browser’s local storage. Section 5 explains how this works and how to remove it.

3. Hosting and delivery through Cloudflare

The website is delivered through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. We use Cloudflare Pages for the website and server-side functions to process inquiries. Its content delivery network serves pages and protects the technical infrastructure.

Data processed: For each request, Cloudflare necessarily processes connection and request data, including IP address, time, requested URL and HTTP headers sent by the browser, such as the user agent and, where present, the referring URL. Operational and security data supports delivery, attack prevention and troubleshooting.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is providing a secure, fast and stable website.

Retention: Cloudflare’s retention depends on the relevant operational or security purpose and legal obligations. Its general privacy policy does not state one fixed deletion period covering all connection and security data. Our separate form rate-limit counters are explained in section 5.

International transfers: Processing is not restricted to the EU and may occur in the United States. Cloudflare’s Self-Serve Terms incorporate its Data Processing Addendum, which addresses processing on behalf of customers and international transfers, including EU Standard Contractual Clauses. The safeguards can be reviewed there.

4. Analytics and inquiry attribution

We do not use an additional analytics script to measure audience reach. Section 3 describes hosting operational data.

A project inquiry can include information about how you found us: your optional answer in the form, the entry page, the hostname of a referring website and selected campaign parameters from the visited URL, such as UTM source, campaign or search term. These values are passed through links to the form and transmitted with the submitted inquiry. Individual advertising click identifiers such as gclid, msclkid or fbclid are not copied. The full path of an external referring page is not stored as attribution data.

This function uses neither cookies nor local browser storage. Its purpose is understanding where inquiries originate, based on Article 6(1)(f) GDPR. It does not create a profile across visits. Attribution stored with an inquiry follows that inquiry’s retention period.

5. Project inquiry form

The inquiry form lets you describe a project and request a concept and fixed-price proposal. We process the information you enter:

• Contact: name and email address; optionally company, telephone number, preferred contact method and your role.
• Project: working title, description, goal, audience, references, existing materials, timing, budget and requests for rush start or support.
• Project-specific details: website type, pages, features, languages, content, design, domain/hosting and existing URL; app platforms, type, features, backend, integrations, design, user count, stores and special requirements; or game platforms, dimensions, genre, art style, scope, multiplayer, monetisation, engine, assets and distribution.
• Technical details: submission time, the time you acknowledged the privacy notice, browser user agent, the spam-protection result and an inquiry reference we assign in the format APZ-YYYYMMDD-XXXX.

Purpose and legal basis: We use this information to prepare a concept and proposal, answer the inquiry and take steps towards a possible contract under Article 6(1)(b) GDPR. If an inquiry is not directed towards a contract, our basis is the legitimate interest in communicating with you under Article 6(1)(f) GDPR. Providing data is voluntary, but we cannot prepare a concept without your name, email address and project description.

Browser draft (localStorage)

Your browser saves your form entries as a draft in local storage on your device so you can pause and return. Draft content is only sent to us when you submit it. Attribution data, privacy acknowledgement and spam-protection tokens are not saved in the draft.

The draft is deleted after successful submission. You can also remove it with the form’s “Delete draft” control or by clearing the website’s browser data. When you reopen the form, drafts last saved more than seven days earlier are discarded. Without another visit, the entry can remain until it is deleted in the browser. Storage supports the requested draft function under section 25(2)(2) of Germany’s TDDDG.

Cloudflare Turnstile spam protection

We use Cloudflare Turnstile to protect against automated inquiries; provider details are in section 3. The external script loads only at the last form step. Cloudflare receives technical signals such as IP address, browser user agent, TLS characteristics and the originating website. Our server asks Cloudflare to verify the resulting token. We use managed mode without pre-clearance; the optional cf_clearance cookie function is not enabled.

Our legal basis is Article 6(1)(f) GDPR, protecting against spam and abuse. Cloudflare processes signals to provide this protection for us and, as a controller in its own right, to improve bot detection. Its Turnstile privacy policy explains this processing, including international processing. If JavaScript is unavailable or spam protection fails, you can email us directly. There is no unprotected automatic form submission fallback.

Protection against bulk submissions

Our server limits inquiries per internet connection. It derives an hourly changing pseudonymous identifier from your IP address using a server-side secret. A Cloudflare database stores only this identifier, a counter and an expiry time, not the raw IP address or inquiry content. Counters apply until the end of the relevant hour. Expired entries are removed during the next quota check of a formally valid inquiry verified by Turnstile; without further inquiries, they may remain longer. The legal basis is Article 6(1)(f) GDPR, preventing abuse.

Delivery to us and confirmation to you

Our server emails your information to info@appdevelz.com as a readable summary and a structured dataset for further handling. We send a confirmation to your supplied email address containing the reference, a short summary and next steps. This is a transactional message about your inquiry, not a newsletter.

We use Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, to send these messages. It processes recipient addresses, message content and delivery data.

Resend stores messages and sending logs in the United States. Our selected Ireland sending region (eu-west-1) determines the sending route, not the storage location. Its DPA forms part of its contractual terms and includes EU Standard Contractual Clauses for international transfers. See its privacy policy and processing and retention information.

Our mailbox uses Google Workspace, where incoming inquiries and correspondence are stored and handled. Processing may occur outside the EU, including in the United States. Google’s Cloud Data Processing Addendum describes customer-data processing and safeguards for international transfers.

Price estimates and personal review

Website price estimates follow defined calculation rules. They are not binding offers and do not decide whether a contract is entered into. We have not enabled transmission of website inquiries to an external AI service to prepare concepts. We handle inquiries and issue binding proposals ourselves. This describes our inquiry process; the infrastructure and email providers’ linked terms describe their own processing and subprocessors.

If you choose to carry your estimate into the inquiry form, the selected calculator options are temporarily stored in your browser tab’s session storage. This happens only when you request the transfer; it contains predefined choices, not contact details or free text. The form removes the transfer when it reads it and does not apply transfers older than 30 minutes. If you do not open the form, the entry can remain for the browser tab’s session or until you clear it. It supports the transfer function you requested under section 25(2)(2) TDDDG. Transferring options does not submit an inquiry.

Retention

Retention depends on the inquiry process, any subsequent contract, statutory retention duties and the need to preserve legal claims. Data must be deleted when these purposes and obligations no longer apply. This also covers attribution saved with an inquiry.

For our Free plan, Resend states a 30-day retention period for email and log data, plus separate backup retention of seven days. The copy in our Google Workspace mailbox follows the purpose-based retention described above, not Resend’s sending-data period.

You can alternatively contact us directly by email as described in section 6.

6. Contact by email or telephone

If you contact us by email or telephone, we process your name, contact details and message to handle your request. The basis is Article 6(1)(b) GDPR for steps towards a contract, or Article 6(1)(f) GDPR for communication. Emails are stored in our Google Workspace mailbox. Retention follows section 5.

7. Appointments

No external appointment-booking service is currently embedded in this website. You can arrange a conversation by email. Section 6 applies to that contact.

8. External links

We link to our LinkedIn and Instagram profiles and other external pages. These are ordinary links: their plugins or scripts are not loaded, and visiting our pages does not transmit data to those platforms. Once you follow a link, the provider processes your data under its own privacy policy.

9. Data security

The public website and inquiry form use HTTPS (TLS) to encrypt transmission. The form validates input on the server and protects sending with Turnstile and rate limits. Please do not include passwords, access keys or particularly sensitive information that is unnecessary for an initial inquiry.

10. Your rights

You have the following rights concerning your personal data:

• Access under Article 15 GDPR to processed data, its source, recipients and processing purposes.
• Rectification or completion under Article 16 GDPR.
• Erasure under Article 17 GDPR where statutory retention obligations do not prevent it.
• Restriction of processing under Article 18 GDPR.
• Data portability under Article 20 GDPR: receiving your data in a commonly used, machine-readable format.
• Withdrawal of consent for the future under Article 7(3) GDPR.

Right to object under Article 21 GDPR: Where we rely on legitimate interests under Article 6(1)(f), you may object at any time on grounds relating to your particular situation. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, send an informal request to info@appdevelz.com or the postal address in section 1.

Complaints: You may complain to a data protection supervisory authority under Article 77 GDPR. Our competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Postfach 1349, 91504 Ansbach, Germany. See its contact and complaints information (German). You may also contact the supervisory authority where you live.

11. Changes to this policy

We update this policy when the website, services used or legal framework changes. The version published here applies.

Updated: 22 September 2026.