Privacy Policy

The data controller responsible for your personal data is: Juliette Grieneisen, trading as Lutheis, Schützenstrasse 34, 8280 Kreuzlingen, Switzerland. Contact: contact@lutheis.com.

Account data: When you create an account, we collect your username, email address, country, and a hashed password (if you register with email) or your Google profile identifier (if you sign in with Google).

Order data: When you place an order, we collect your brand name, brand description, industry, target audience, website goals, domain information, design preferences, logo files, color references, and any additional attachments you provide.

Payment data: We use Stripe to process payments. Lutheis never sees or stores your full card number. Stripe collects and processes your payment details directly. See stripe.com/privacy.

Contact form data: When you use the contact form, we collect your name, email address, and message content.

Order communication: Messages you exchange with us through the order chat are stored together with the related order.

Waitlist data: If you join the waitlist, we store your email address to notify you at launch.

Technical data: We may collect your IP address and browser information through our hosting provider (Cloudflare) for security and performance purposes, including short-lived rate-limiting counters to prevent abuse.

Account and order data: Processing is necessary for the performance of a contract (FADP Art. 31(2)(a); GDPR Art. 6(1)(b)) — we need this data to deliver your project.

Payment processing: Processing is necessary for the performance of a contract and compliance with legal obligations (FADP Art. 31(2)(a) and (b); GDPR Art. 6(1)(b) and (c)).

Contact form: Processing is based on your consent and our legitimate interest in responding to enquiries (FADP Art. 31(1); GDPR Art. 6(1)(a) and (f)).

Technical/security data: Based on our legitimate interest in maintaining a secure and functional service (FADP Art. 31(1); GDPR Art. 6(1)(f)).

Your data is stored in Supabase (PostgreSQL database and file storage), in the European Union (Ireland). Our website is delivered through Cloudflare's global network, which means that requests are processed at the point closest to the visitor; those transfers are covered by the standard contractual clauses and, where applicable, by the Data Privacy Framework.

Account data is retained for as long as your account is active. You may request deletion at any time.

Orders, invoices and contracts are retained for a minimum of ten years, in order to comply with our legal and accounting obligations (Swiss Code of Obligations, Art. 958f) and for the duration of the limitation period applying to contractual claims (Art. 127).

Project files, including design sources, previews, exported assets and the messages exchanged about your order, are retained for as long as we host, maintain or further develop your website, because they are necessary in order to do so. This purpose is distinct from the accounting retention above: these files serve an operational purpose, not only a legal one. If we cease hosting your website, they are retained for the remainder of the applicable legal retention period and are then deleted.

The data of your website itself (its database, its content and its backups) is retained for as long as your Hosting and Care subscription is in force, and thereafter in accordance with Article 8 of our terms of sale.

Contact form messages are retained for up to 12 months.

Supabase (supabase.com) — database, authentication, and file storage. EU-hosted, GDPR-compliant.

Stripe (stripe.com) — payment processing. Certified PCI-DSS Level 1.

Google (google.com) — OAuth sign-in (optional). Google's privacy policy applies to this flow.

Cloudflare (cloudflare.com) — website hosting, content delivery network and DNS. May process request logs and IP addresses for security and performance purposes. Our visit statistics (daily visitor and page view totals) are aggregate figures derived from these request logs: no cookie is set, no script runs in your browser for this purpose, and no individual visitor is identified. GDPR-compliant data processing addendum in place.

Resend (resend.com) — email delivery for order confirmations and verification emails.

We do not sell, rent, or share your personal data with any third party for marketing purposes.

We use a session cookie (managed by NextAuth) to keep you signed in. This is a strictly necessary cookie and does not require consent.

We store your language preference in your browser's localStorage under the key 'lutheis_lang'. This contains no personal data.

Stripe may set cookies during the payment process for fraud prevention and security purposes.

We do not use advertising cookies or third-party tracking cookies.

Note for visitors from the EU: If you are accessing this site from a country subject to the GDPR, the use of Stripe's payment cookies may require your consent under EU law. By proceeding to the payment step, you acknowledge that Stripe processes payment data on our behalf.

Under the Swiss FADP (nDSG) and, where applicable, the GDPR, you have the following rights regarding your personal data:

Right of access: You can request a copy of the data we hold about you (FADP Art. 25; GDPR Art. 15).

Right to rectification: You can request correction of inaccurate data (FADP Art. 32; GDPR Art. 16).

Right to erasure: You can request deletion of your data, subject to our legal retention obligations (FADP Art. 32; GDPR Art. 17).

Right to restriction: You can request that we restrict processing of your data (GDPR Art. 18).

Right to data portability: You can request your data in a machine-readable format (FADP Art. 28; GDPR Art. 20).

Right to object: You can object to processing based on legitimate interest (FADP Art. 32; GDPR Art. 21).

To exercise any of these rights, contact us at contact@lutheis.com. We will respond within 30 days.

If you believe we are not handling your data in compliance with applicable law, you have the right to lodge a complaint with the relevant supervisory authority.

Switzerland: Federal Data Protection and Information Commissioner (FDPIC) — fdpic.ch

France: Commission Nationale de l'Informatique et des Libertés (CNIL) — cnil.fr

Germany: The relevant state data protection authority (Landesbeauftragter für Datenschutz).

We may update this privacy policy from time to time. The date at the top of this page reflects the most recent revision. Continued use of the site after any update constitutes acceptance of the revised policy.