BoringOS Privacy Policy

1. An overview of data protection

General information

The following information will provide you with an easy to navigate overview of what will happen with your personal data when you use BoringOS, a designer toolkit that includes Client Review, Brandbook, and Compress & Convert. The term "personal data" comprises all data that can be used to personally identify you. For detailed information about the subject matter of data protection, please consult our Data Protection Declaration below.

Who is the responsible party for the recording of data (i.e., the "controller")?

The data is processed by the operator of BoringOS, whose contact information is available under section "Information about the responsible party (referred to as the "controller" in the GDPR)" in this Privacy Policy.

How do we record your data?

We collect data you provide when you sign in with your Uninspired account, create reviews or brandbooks, upload files, or leave feedback. Other data is recorded automatically when you use the service (primarily technical information such as web browser, operating system, or the time the service was accessed).

Compress & Convert content stays on your device. Files you process with Compress & Convert are handled in your browser and are not uploaded to our servers. See section 6.

What are the purposes we use your data for?

We process data to provide BoringOS: storing the reviews and brandbooks you create, sending client invitations, and publishing brandbooks you choose to make public. We do not use advertising or marketing tracking in BoringOS.

What rights do you have as far as your information is concerned?

You have the right to receive information about the source, recipients, and purposes of your archived personal data at any time without having to pay a fee for such disclosures. You also have the right to demand that your data are rectified or eradicated. If you have consented to data processing, you have the option to revoke this consent at any time, which shall affect all future data processing. Moreover, you have the right to demand that the processing of your data be restricted under certain circumstances. Furthermore, you have the right to log a complaint with the competent supervising agency.

Please do not hesitate to contact us at any time if you have questions about this or any other data protection related issues.

2. Hosting

We host BoringOS with the following provider:

Cloudflare

The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (hereinafter "Cloudflare").

We use Cloudflare to host the service, store your review and brandbook content, and send transactional e-mail (for example client invitations). Cloudflare processes technical connection data (such as IP address and request time) as needed to deliver the service. Review and brandbook content stored with Cloudflare may be stored outside the EU. Your Uninspired account data is stored in the EU — see the Uninspired Accounts Privacy Policy.

For details, please view Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/.

We use Cloudflare on the basis of Art. 6(1)(f) GDPR (secure and reliable provision of our service) and Art. 6(1)(b) GDPR where processing is required to provide the service to you. Data transfer to the US is based on Standard Contractual Clauses and/or Cloudflare's certification under the EU-US Data Privacy Framework, where applicable.

Data processing

Where required, we have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that personal data of our users is processed only based on our instructions and in compliance with the GDPR.

3. General information and mandatory information

Data protection

The operators of BoringOS take the protection of your personal data very seriously. Hence, we handle your personal data as confidential information and in compliance with the statutory data protection regulations and this Data Protection Declaration.

We herewith advise you that the transmission of data via the Internet (i.e., through e-mail communications) may be prone to security gaps. It is not possible to completely protect data against third-party access.

Information about the responsible party (referred to as the "controller" in the GDPR)

The data processing controller is:

Hassel und Kolb GbR

Neuendorfer Straße 102,

13585 Berlin

E-mail: hello@uninspired.studio

The controller is the natural person or legal entity that single-handedly or jointly with others makes decisions as to the purposes of and resources for the processing of personal data (e.g., names, e-mail addresses, etc.).

Storage duration

Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for which it was collected no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.

General information on the legal basis for the data processing

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. If your data is required for the fulfillment of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, if your data is required for the fulfillment of a legal obligation, we process it on the basis of Art. 6(1)(c) GDPR. Furthermore, the data processing may be carried out on the basis of our legitimate interest according to Art. 6(1)(f) GDPR. Information on the relevant legal basis in each individual case is provided in the following paragraphs of this privacy policy.

Recipients of personal data

In the scope of our business activities, we cooperate with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only disclose personal data to external parties where this is required as part of the fulfillment of a contract, where we are legally obligated to do so, where we have a legitimate interest in the disclosure pursuant to Art. 6(1)(f) GDPR, or where another legal basis permits it. When using processors, we only disclose personal data on the basis of a valid data processing agreement.

Revocation of your consent to the processing of data

Many data processing operations are possible only with your express consent. You can revoke consent you have already given at any time. This shall be without prejudice to the lawfulness of any data collection that occurred prior to your revocation.

Right to object to the collection of data in special cases; right to object to direct advertising (Art. 21 GDPR)

IF DATA ARE PROCESSED ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO AT ANY TIME OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA BASED ON GROUNDS ARISING FROM YOUR UNIQUE SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. TO DETERMINE THE LEGAL BASIS ON WHICH ANY PROCESSING OF DATA IS BASED, PLEASE CONSULT THIS DATA PROTECTION DECLARATION. IF YOU LOG AN OBJECTION, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA, UNLESS WE ARE IN A POSITION TO PRESENT COMPELLING PROTECTION WORTHY GROUNDS FOR THE PROCESSING OF YOUR DATA THAT OUTWEIGH YOUR INTERESTS, RIGHTS AND FREEDOMS, OR IF THE PURPOSE OF THE PROCESSING IS THE CLAIMING, EXERCISING OR DEFENCE OF LEGAL ENTITLEMENTS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

Right to log a complaint with the competent supervisory agency

In the event of violations of the GDPR, data subjects are entitled to log a complaint with a supervisory agency, in particular in the member state where they usually maintain their domicile, place of work, or at the place where the alleged violation occurred.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you should demand the direct transfer of the data to another controller, this will be done only if it is technically feasible.

Information about, rectification and eradication of data

Within the scope of the applicable statutory provisions, you have the right to demand information about your archived personal data, their source and recipients, as well as the purpose of the processing of your data at any time. You may also have a right to have your data rectified or eradicated.

Right to demand processing restrictions

You have the right to demand the imposition of restrictions as far as the processing of your personal data is concerned. To do so, you may contact us at any time.

SSL and/or TLS encryption

For security reasons and to protect the transmission of confidential content, BoringOS uses SSL or TLS encryption. You can recognize an encrypted connection by checking whether the address line of the browser switches from "http://" to "https://" and by the lock icon in the browser line. If SSL or TLS encryption is activated, data you transmit to us cannot be read by third parties.

4. Account, sign-in and cookies

Uninspired account

Designers sign in with an Uninspired account. BoringOS does not store your login credentials; it only keeps the identifier needed to attach your projects and files to you. For account data (e-mail, sign-in), see the Uninspired Accounts Privacy Policy.

Clients do not need an account: they open a review through a share link you send them (see section 5).

Cookies

BoringOS uses only cookies that are strictly necessary to run the service (keeping you signed in and protecting the connection). Legal basis: Art. 6(1)(f) and, where applicable, Art. 6(1)(b) GDPR.

BoringOS does not use analytics or advertising cookies, and therefore does not show a cookie-consent banner.

Server log files

The provider of this service automatically collects and stores information in so-called server log files, which your browser communicates to us automatically. The information comprises:

• The type and version of browser used
• The used operating system
• Referrer URL
• The hostname of the accessing computer
• The time of the server inquiry
• The IP address

This data is not merged with other data sources. Legal basis: Art. 6(1)(f) GDPR.

5. Client Review and Brandbook data

Client Review

You can share design work with clients and collect feedback. We store the project, the files you upload, comments and related feedback, and the e-mail addresses of people you invite. Clients open the review via a link; you can revoke that link at any time. Invitation and status e-mails are sent through Cloudflare.

Legal basis: Art. 6(1)(b) GDPR (providing the review) and Art. 6(1)(f) GDPR (notifying the people involved).

Brandbook

You can build brand guidelines and, if you choose, publish them. We store the brandbook and its files. Published brandbooks can be viewed by anyone with the link, without signing in. Drafts stay private to your account.

Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(a) or (f) GDPR for content you choose to publish.

6. Compress & Convert

Compress & Convert runs in your browser. Files you add are processed on your device and are not uploaded to our servers. Closing the tab clears that session. You are responsible for downloading your results.

7. Recipients

We do not use advertising networks in BoringOS.

8. How long we keep your data

Reviews, brandbooks, and uploaded files are kept while they exist on your account. When you delete them — or close your Uninspired account — we delete the associated data, subject to statutory retention periods. Revoking a share link stops access through that link.

To request access to or deletion of your data, contact us at hello@uninspired.studio.