Privacy Policy

When you access PHASMA Cards, only technically necessary connection data is processed. This includes the IP address transmitted by your browser, the date and time of access, the page requested, and details about your browser and operating system. This data is recorded in server logs and serves to ensure stable and secure operation.

For sign-in we use Internet Identity, a decentralized authentication method. No password and no email address is transmitted to us. Instead, you receive an anonymous identifier (principal) that lets us associate your account and portfolio without personally identifying you.

When you create a portfolio or book Pro features, we store this information under your principal. This is usage-related data, not personal data in the strict sense.

Technical connection data is processed on the basis of our legitimate interest in secure and functional operation pursuant to Art. 6(1)(f) GDPR.

Where you voluntarily use features such as the portfolio or Pro, processing takes place to perform the usage relationship concluded with you pursuant to Art. 6(1)(b) GDPR.

No processing takes place for advertising or analytics purposes. We do not use tracking services, advertising networks, or profiling.

Technical server logs are automatically deleted after no more than 30 days, unless they are needed to investigate a specific security incident.

Your portfolio and account settings remain stored for as long as your account exists. You can delete this data yourself at any time in your account. When you delete your account, all associated data is removed without delay.

We retain billing-relevant records for Pro bookings for the legally required period of 10 years, where such a retention obligation exists.

PHASMA Cards does not use cookies for advertising or tracking purposes. For sign-in and session storage we use only technically necessary local storage areas of your browser (local storage).

This storage is required so that you stay signed in and your portfolio can be correctly associated. You can clear local storage at any time through your browser settings; doing so signs you out and your locally stored session is lost.

Because no consent-requiring cookies are set, a cookie banner is not required.

You have the right to information about the data processed concerning you (Art. 15 GDPR). Because we operate without an email address, information is provided via your principal.

You have the right to rectification of inaccurate data (Art. 16 GDPR), to erasure of your data (Art. 17 GDPR), and to restriction of processing (Art. 18 GDPR).

You have the right to object to the processing of your data (Art. 21 GDPR). You also have the right to data portability (Art. 20 GDPR).

You can view and delete your portfolio directly in your account. For any further requests, please use the contact route described below.

You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your data.