Legal

Privacy policy

Information on the processing of personal data on this website in accordance with Art. 13 GDPR.

Checkout and contract documents are available in German and English. Deutsche Fassung

1. Controller

We have not appointed a separate data protection officer, as there is no legal obligation to do so.

2. Principle: offline-first

The AnnexCREATE apps are designed offline-first: your documents and projects generally stay locally on your Mac. Only if you use team, version, asset or approval-link functions do the apps transmit the data required for them to our server (section 9c). This privacy policy covers the website (including beta sign-up, feedback survey, subscription calculator and withdrawal function) and the server services the apps talk to (licensing, updates and — only if switched on — diagnostic data).

2a. Artificial intelligence in the apps (cloud AI)

Cloud AI is shipped switched off; local providers are the default. Anyone who switches cloud AI on uses their own account with Anthropic or an OpenAI-compatible provider; content goes directly from their Mac to that provider. ma-kom does not see it and does not enter into a data processing agreement for it. Moonshot (Kimi) is never preselected and never an automatic fallback provider; it can only be used if you explicitly choose it and agree before first use. In that case content is processed in China, where there is no EU level of data protection (no adequacy decision, no standard contractual clauses with us).

3. Visiting the website (server log files)

When you visit this website, the hosting server automatically processes technically necessary data (including IP address, date and time of access, page requested, amount of data transferred, referrer, browser and operating system identifier). This processing serves the secure and stable operation of the website and the anonymous count of page views per day: once a day we count from the log how often each page was requested and store only that number — without IP address, without browser identifier, without cookie.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operational security and in knowing which pages are read). The server log files are closed daily and deleted after seven further days, i.e. after eight days at the latest, unless they are needed to investigate a specific security incident.

Protection against mass requests: For functions that accept data or trigger an e-mail — beta sign-up, feedback, support form, withdrawal function, call-back or letter request from the subscription calculator, licence activation, update check and diagnostic data from the apps — we store your IP address together with the function called and a time window of one minute, without any link to your e-mail address. We delete these entries after 24 hours. Legal basis: Art. 6(1)(f) GDPR.

4. Hosting

Website, server services, database and e-mail dispatch run on a server we rent from Webspace-Verkauf.de ISP e.K. (Lichtenfelser Straße 17a, 96271 Grub am Forst, Germany); the data centre is located in Leipzig, Germany. We send e-mails through our own mail server on the same server, not through a mailing service. The provider is our processor under Art. 28 GDPR; a corresponding agreement is in place.

5. Local language setting (localStorage)

To store your chosen language (German, English, Spanish, French or Italian) we use your browser’s local storage (localStorage). The chosen appearance (light/dark) and your decision on audience measurement are stored there as well. Language and appearance are stored only once you choose them yourself; merely opening the page writes nothing to your browser. This information stays in your browser and is not transmitted to us. These are technically necessary functions; no consent dialogue is required for them. Without your consent we do not set any tracking cookies — for audience measurement see section 8b.

6. Sign-up for the free beta

The beta downloads without sign-up. You can voluntarily sign up to receive notices about new beta versions and invitations to give feedback. For this we store your e-mail address, the chosen language, the source of the sign-up and the time. Sign-up uses a double opt-in procedure: you first receive an e-mail with a confirmation link. We store your address as unconfirmed when you sign up. If you do not confirm it within seven days, we delete it.

• Purpose: sending notices about new beta versions and invitations to give feedback.
• Legal basis: Art. 6(1)(a) GDPR (consent).
• Storage period: until the end of the beta programme or until you withdraw your consent.
• Withdrawal of consent: at any time with effect for the future, informally by e-mail to mail@annexcreate.com. The lawfulness of processing carried out until then remains unaffected.
• Protection against mass requests: To protect against mass requests we store your IP address together with the function called and a time window of one minute, without any link to your e-mail address. We delete these entries after 24 hours. Legal basis: Art. 6(1)(f) GDPR.

7. Beta feedback survey

Using the feedback form you can rate five questions on a scale from 1 to 5 and leave us a free text. Optionally you can state which app you used most and an e-mail address for queries.

• Voluntary and anonymous if you wish: An e-mail address is not required. Without it we cannot attribute the feedback to any person.
• Purpose: improving the software; prioritising further development.
• Legal basis: Art. 6(1)(a) GDPR (consent by submitting the form).
• Storage period: until evaluated and implemented, at the latest until the end of product development of the version concerned.
• Protection against mass requests: as in section 6 — IP address, function called and a time window of one minute, without any link to your feedback; deleted after 24 hours.
• Note on the free text: Please do not enter personal data of third parties or confidential content there.

8. Contact by e-mail

If you contact us by e-mail, we process your details to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures / performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in answering).

8a. Support requests via the form

If you submit a request via the support page, we store your e-mail address, the subject, your message and — where provided by you — name, app concerned, app and macOS version and licence key. We need this information to handle your request; the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures / performance of a contract) or Art. 6(1)(f) GDPR.

You receive a confirmation with a link where you can see the status of your case and reply. No account is needed for this — the link contains a random token that is sent only to you. Treat it like a password and do not pass it on.

Cases are deleted once they are closed and no statutory retention periods apply, at the latest after three years. On request we delete them earlier — an informal message is sufficient.

8b. Audience measurement (only with your consent)

We would like to know which pages are read and use Google Analytics 4 for this (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Without your express consent no script is loaded for this and no cookie is set. This is not a promise in the small print but how the page is built: only when you agree is the Google script requested at all — verifiable in your browser’s network panel.

The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Google Analytics 4 does not store or log IP addresses; your IP address is processed only briefly to derive the approximate location. A transfer to the USA cannot be ruled out; it is based on the standard contractual clauses and Google’s certification under the EU-US Data Privacy Framework.

You can change your choice at any time — the following button resets it, after which you will be asked again: Withdraw consent

We use Google Analytics 4 (property “AnnexCREATE”, measurement ID G-FB3RS90NKL) and Google Ads (AW-1033437942). Both services are loaded only after your consent. The accounts are the responsibility of ma-kom agentur UG (haftungsbeschränkt); the Google Ads link is set up without personalisation.

8c. No trial period

The free beta has no trial period. The apps run without an account and without a licence and collect no personal data for this. The 0.7.1 build still being delivered measures the 14-day trial exclusively on your device, without a connection to our servers; the next update removes it. Your documents remain locally on your Mac.

9. Licensing and updates (when using the apps)

If you activate a licence or the apps check for updates, the data required for this (licence key, product and version identifier; when redeeming a key, also device identifier and device name, see section 10) is transmitted to the licence or update server. The same happens automatically when the Hub starts: it queries annexcreate.com for the asset list and, for each app, the update information, transmitting app identifier, version, platform, architecture and, for technical reasons, your IP address. The legal basis is Art. 6(1)(b) GDPR where you use a licence or trial, and otherwise our legitimate interest in working and secure updates (Art. 6(1)(f) GDPR); you may object (section 12). Anyone who imports the licence file instead of redeeming a key sends nothing to us in the process. The processing serves the performance of the contract (Art. 6(1)(b) GDPR). Licences are designed so that the apps remain usable without a permanent server connection.

9a. Payment in the shop (Stripe)

If you buy a licence, we process the payment via Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). You are redirected to a payment page operated by Stripe.

There the following is processed: your e-mail address, name and billing address, your VAT ID if applicable, the purchase amount and your payment details. We do not see your card or account details — they are entered and processed exclusively at Stripe. What comes back to us is the payment status, the billing details and an identifier of the transaction.

Further recipients depending on the payment method: If you choose PayPal, Klarna or Amazon Pay on the payment page, Stripe passes the details required for the payment (name, e-mail address, billing address, amount, order identifier) to that provider. The provider processes them as an independent controller under its own privacy policy:

• PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg,
• Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden — for purchase on invoice or in instalments including an identity and credit check,
• Amazon Payments Europe S.C.A., 38 avenue John F. Kennedy, L-1855 Luxembourg.

For card payment, SEPA direct debit and the other payment methods, the bank or card network concerned receives the payment details required for processing.

We also record your consent to our beginning provision immediately, together with your confirmation that your right of withdrawal thereby expires (Section 356(5) BGB). Without this proof we could not rely on the expiry; we therefore store it together with the invoice record.

Notifications from Stripe: Stripe notifies us of payments, refunds and chargebacks. If a notification concerns your AnnexCREATE purchase, we store it in full (including your e-mail address, your name and your billing address) so that the transaction can be traced, and clear its content after 90 days; after that only the identifier, type and time remain. Notifications about purchases of other products of our company are stored without content, only with identifier, type and time, and deleted after 30 days.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract), and for the billing details additionally Art. 6(1)(c) GDPR in conjunction with the retention obligations under tax and commercial law.

Transfer to third countries: Stripe may transfer data to Stripe, Inc. (USA). This is based on the European Commission’s standard contractual clauses or a certification under the EU-US Data Privacy Framework. Details and Stripe’s privacy policy can be found at stripe.com/privacy.

9b. Diagnostics and feedback from the apps (only if switched on)

In the settings of the apps you can switch on diagnostic data; it is shipped switched off. When switched on, the apps send usage events (such as the program start) and crash reports to our server. Your in-app feedback is only sent if you submit it yourself — with category, text and, if you provide one, a contact address.

• What is stored: app, version, event, time and the details of the event. No IP address, no device identifier; e-mail addresses, file names, paths and licence keys are already discarded by the app and again by the server.
• Purpose: finding and fixing errors, prioritising further development.
• Legal basis: your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR — by switching it on or by submitting. You can withdraw it at any time by switching the setting off again.
• Storage period: until evaluated, at most twelve months; a daily job deletes them afterwards.

9c. Team functions and approval links (only if you use them)

The apps work offline. If, however, you use version synchronisation, the shared asset store, teams or approval links, the apps transmit the data required for this to our server at annexcreate.com (default) or to the server you have set up in the app profile. Without these functions your documents do not leave your Mac.

• What is transmitted: for version synchronisation, document titles, version names, notes, author, approval rounds and comments; for the asset store, the file contents; for team invitations, the e-mail addresses of the invited people (third parties — please inform them); for approval links, the content provided for review together with the reviewers’ comments and status.
• Purpose: collaboration, synchronisation between your devices, approval and sign-off of work in progress.
• Legal basis: Art. 6(1)(b) GDPR (performance of the contract, where you use the function under your licence); for data of third parties (invitees, reviewers), our legitimate interest in the collaboration you initiated, Art. 6(1)(f) GDPR. If you use the functions commercially with data of your customers or employees, you are the controller and we are the processor; our data processing agreement applies.
• Public approval links: Anyone who knows the link can see the shared content, comment and change the status. Pass the link on only to people who may see it. A link expires on the expiry date you chose; without an expiry date it remains until it is deleted.
• Storage period and deletion: until you remove members, dissolve the team or delete the workspace. On request we delete the data earlier (Art. 17 GDPR, informally by e-mail to mail@annexcreate.com; details in section 10).

10. Licence management, invoice and deletion

If you buy a licence, we store the data required for it: your e-mail address, where applicable name, company, billing address and VAT ID (invoicing), the licence keys issued and, for activated devices, a device identifier and the device name. The identifier is formed from the name, the network name and the number of processors of your Mac. The device name is the name your Mac carries in System Settings — it often contains your first name. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

There is no customer account. You receive the licence key, the licence file and the invoice as a PDF with the order confirmation by e-mail. If you need any of it again, write to mail@annexcreate.com; we only send it to the address used for the purchase.

Refund and chargeback: If we refund the purchase price in full or the payment is finally charged back, we record the reason and time on the licence, block it on our server for any further activation and delete its device list. While a chargeback is open, the licence is only marked as disputed. A licence file that has already been imported does not technically stop working, because it is checked on your Mac alone. Legal basis: Art. 6(1)(b) GDPR (reversal of the contract).

Deletion: You can request deletion informally by e-mail at any time. Deleted or anonymised are: your beta sign-up, the query address of your feedback and your user record (the e-mail address is replaced by an undeliverable placeholder; name, company, billing address and VAT ID are cleared). Your licences remain valid — they are checked offline and do not depend on this record.

Exception: if invoices exist for your purchase, we keep the billing details for the duration of the statutory retention periods (Art. 17(3)(b) GDPR in conjunction with Section 257 HGB, Section 147 AO) and otherwise restrict processing.

10a. Withdrawal via the withdrawal function

If you declare your withdrawal using the “Withdraw from contract” button, we store your name, the order or invoice number, your e-mail address, the time of receipt and — if you provide one — the reason. We use this information to confirm receipt to you, to process the withdrawal and to prove its receipt. Legal basis: Art. 6(1)(c) GDPR (obligation to confirm receipt, Section 356a BGB) and (b) (unwinding of the contract). We keep the declaration as long as claims arising from the contract can be asserted; if the withdrawal leads to a refund, together with the invoice until the end of the statutory retention period.

10b. Subscription calculator and prospect file

The subscription calculator calculates only in your browser; your entries do not leave your computer, and you do not have to provide anything to get the result. Only if you then voluntarily ask for a call-back, a letter or an answer by e-mail and consent to it do we store in our prospect file: your name, depending on your request your phone number, your postal address or your e-mail address, the calculator result (ticked categories, totals, recommended bundle), the origin of your visit (for example “flyer” or “LinkedIn”, taken from the campaign parameters of the address you opened), the language chosen, and the wording and time of your consent.

• Purpose: to answer your request: call-back, letter with the result or answer by e-mail. There is no newsletter, and we do not write to you unsolicited.
• Legal basis: Art. 6(1)(a) GDPR (consent).
• Storage period: 24 months from the entry; after that a daily run deletes the entry. If you withdraw earlier, we delete earlier.
• Withdrawal: at any time with effect for the future, informally by e-mail to mail@annexcreate.com or by letter to the address in section 1. The lawfulness of the processing carried out until then remains unaffected.
• Recipients: no one outside ma-kom; the file is kept on our own server (section 4), not with a form or advertising service.

11. Recipients / disclosure

Your data is disclosed to third parties only insofar as this is necessary to provide the services described (to our hosting provider as processor, section 4; during payment to Stripe and the provider of the chosen payment method, section 9a) or we are legally obliged to do so. Data is transferred to countries outside the EU/EEA only during payment (section 9a) and — after your consent — for audience measurement (section 8b). If you switch on cloud AI (section 2a), content goes, at your instigation and with your own account, directly to the provider you have chosen, (Anthropic and OpenAI in the USA; Moonshot only if you explicitly choose it — processing in China without an adequacy decision) also outside the EU/EEA; ma-kom is not involved in this.

12. Your rights

Under the GDPR you have the right to:

• access to the data processed about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing (Art. 21 GDPR),
• withdraw consent given (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Competent authorities include the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

13. Currency

This privacy policy is as of October 2026. Further development of the website or changes in legal requirements may make an update necessary.

Note: This policy describes the functions of the website and the server services (server logs and page count, language storage, audience measurement with consent, beta sign-up with double opt-in, feedback survey, support, payment in the shop, licensing, diagnostic data, withdrawal function, subscription calculator with prospect file).