Privacy policy
How we handle personal data when you visit this website, contact us, or receive a website concept from us.
We are a company based in Germany. The EU General Data Protection Regulation (GDPR) and German data protection law apply to everything described here, regardless of where you are located.
Data controller
Plainbase GbR
Represented by its partners Kevin Schmidt and Esra Neuhofer
Zugmantelstr. 34B
65510 Idstein, Germany
Phone: +49 611 9491 0997
Email: contact@plainbase.com
We have not appointed a data protection officer, as there is no legal requirement to do so.
Hosting and server logs
This website is hosted on Firebase Hosting, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (together “Google”). Firebase Hosting delivers the website through a global content delivery network. When you visit, technically necessary data is processed, including your IP address, the date and time of access, the requested address, the referring page, and browser and operating system information. This processing is necessary to operate and secure the website. The legal basis is our legitimate interest in safe and stable operation under Article 6(1)(f) GDPR.
A data processing agreement under Article 28 GDPR is in place with Google. Processing may take place in the United States. Transfers rely on Google’s certification under the EU–US Data Privacy Framework and on the EU Standard Contractual Clauses. Server logs are retained by Google for a short period and then deleted.
Domain and spam protection (Cloudflare)
The domain name system (DNS) for plainbase.com is provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (“Cloudflare”). Resolving our domain name involves Cloudflare’s DNS servers; no personal data beyond what is technically required for DNS resolution is transferred to us.
Our contact form is protected against automated spam with Cloudflare Turnstile. When the form is displayed, your browser loads a script from Cloudflare, and Cloudflare analyzes technical signals such as your IP address, browser characteristics, and interaction with the page to distinguish people from bots. The result is a token that our server verifies with Cloudflare when you submit the form. The legal basis is our legitimate interest in preventing spam and abuse under Article 6(1)(f) GDPR. Cloudflare is certified under the EU–US Data Privacy Framework and offers the EU Standard Contractual Clauses.
Contact form, email, and phone inquiries
When you contact us using the form, we process your name, email address, phone number (if provided), and message to respond to your inquiry. The submission is handled by a server function running on Google Cloud (Cloud Functions for Firebase, region Belgium, EU) and delivered to our mailbox by email through Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA (“Resend”). A data processing agreement including the EU Standard Contractual Clauses is in place with Resend. The legal basis is taking steps before entering into a contract under Article 6(1)(b) GDPR, or our legitimate interest in responding to your inquiry under Article 6(1)(f) GDPR.
The same applies if you contact us directly by email or phone. We delete inquiry data once the inquiry has been fully answered and no statutory retention requirements apply, and no later than twelve months after our last contact.
Preview codes
The preview code you enter is sent to a server function on Google Cloud. It checks the code assignment and availability in our customer database, then redirects you to the matching preview. The code may appear in technical logs as part of the requested address. We do not use this information to build visitor profiles and set no cookies for it. The legal basis is our legitimate interest in providing requested concepts under Article 6(1)(f) GDPR.
Website concepts for businesses we contact
As part of our service we create website concepts for businesses before we contact them. For this we use information that is publicly available about the business, such as its current website or business directory entries. This can include personal data of owners, partners, or staff to the extent it is published there: typically names, business roles, business addresses, phone numbers, and email addresses.
We use this data to prepare the concept and to contact the business once, by phone, email, or mail, with our offer. In the concept itself, identifying details are replaced with sample data. The legal basis is our legitimate interest in offering our services to businesses (direct marketing, Article 6(1)(f) GDPR in conjunction with Recital 47). We do not sell or share this data with third parties for their own purposes.
If a business does not order, we delete the concept and the data collected for it no later than six months after our last contact. You can object to this processing at any time, for example by email tocontact@plainbase.com. We will then delete your data and will not contact you again.
Cookies, analytics, and external services
This website does not use cookies for analytics or advertising and does not embed analytics tools, mapping services, or social networks. Fonts are served from our own hosting, with no connection to an external font service. The only third-party script is Cloudflare Turnstile on the contact form, as described above.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and objection, as well as the right to withdraw any consent you have given. To exercise your rights, contact the data controller listed above, for example by email atcontact@plainbase.com.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.
Last updated
September 2026