1. Controller

Justus Langowsky
Dailyform
Nicodéstraße 13
01465 Dresden
Deutschland

Email: contact@cartena.studio

We are not required to appoint a data protection officer; the conditions of Art. 37 GDPR and § 38 BDSG are not met.

2. What this is about

Cartena Studio is an online studio in which you design your stationery and download it as a print-ready file. To make that work we process the details you enter and the data needed for access. Nothing more. We do not sell data, we do not run tracking and we do not show advertising.

3. What data we process

a) Access data. Your email address, your first names, the order number. There is no password. You sign in with a six digit code that we send to your address. That code, the sign-in link from the same message and your session keys are held in the database only as SHA-256 hashes, from which the original value cannot be recovered.
Legal basis: Art. 6(1)(b) GDPR, performance of the contract.

b) Your entries. Everything you enter in the studio: names, date, venue, schedule, menu, guest names and any images you upload. This data serves solely to set your cards.
Legal basis: Art. 6(1)(b) GDPR.

If you enter the names of your guests, you are processing third-party data. You remain responsible for being allowed to do so — which is the norm for an invitation. We do not analyse these entries and pass them to no one.

c) Sign-in log. When a sign-in code was sent and used, and when a sign-in succeeded or failed, each with a truncated IP address. We remove the last octet, or the second half of an IPv6 address, before storing it.
Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in secure access and protection against abuse.

4. Cookies

We set three cookies. All three are strictly necessary within the meaning of § 25(2) no. 2 TDDDG and therefore require no consent. None contains a name, none is used for analytics or advertising.

• cartena_sitzung — your sign-in. Contains only a random string, is HttpOnly and SameSite=Lax, expires after 45 days. Without it you cannot sign in.
• cartena_adresse — remembers your email address between requesting a code and entering it, so you do not type it twice. HttpOnly, expires after 15 minutes.
• cartena_sprache — the language you chose yourself. Set only when you actively switch.

We set no other cookies. We measure no analytics, we embed no third party scripts and we show no advertising. That is why there is no consent banner: there would be nothing for you to consent to.

5. Who else processes the data

We use service providers, with each of whom a data processing agreement under Art. 28 GDPR is in place:

• Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA — operation of the website. Delivery is from the Frankfurt region.
• Neon Inc., USA — database. The server location is Frankfurt am Main; your project data does not leave the EU.
• Resend (Plus Five Five, Inc.), USA — sending of emails.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — our mailbox. Whoever writes to us, or replies to one of our emails, has their message stored there.

With Vercel and Resend, processing may take place in the USA. The basis is the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR, insofar as the providers are not certified under the EU-US Data Privacy Framework. Despite these safeguards, a level of protection equivalent to the European one cannot be guaranteed in every case in the USA; in particular, access by US authorities cannot be entirely ruled out.

6. Typefaces

Typefaces are held on our own server and are delivered from there. When you open the site and when your PDFs are produced, no request goes to Google or to any other third party; your IP address is transmitted to no one. The typefaces originate from Google Fonts and are licensed under the SIL Open Font License.

7. How long we store data

• Account and project: twelve months after your last sign-in. We then delete both, including uploaded images, in full.
• Sign-in log: six months.
• Sign-in codes and links: the code expires after ten minutes, the link after 30. Both are deleted after one day.
• Sessions: 45 days, deleted automatically thereafter.
• Invoicing and accounting data: ten years, as required by § 147 AO and § 257 HGB.

Deletion runs automatically, once a day.

8. Your rights

You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21).

You can download your project data yourself at any time — in the studio, via the export as PDF and as SVG.

A message to contact@cartena.studio is enough. We reply within the period set by Art. 12(3) GDPR.

You may also lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Sächsische Datenschutz- und Transparenzbeauftragte, datenschutz.sachsen.de. You may also contact the authority where you live.

9. No automated decision-making

Automated decision-making including profiling under Art. 22 GDPR does not take place. The template suggested during onboarding is based on your own answers and has no legal effect.

10. Changes

We adapt this statement when the processing changes. The version published here applies in each case.

Last updated: 20 August 2026