Last updated: [date] · The German version (Datenschutz) is binding.
1. Controller
[Name / company], [address], e-mail: [contact@…]. When an organisation uses stickerlist Business, it is the controller for its members' data and we process it on its behalf (Art. 28 GDPR).
2. Data we process
Account: e-mail address, user ID, language (with Apple possibly a relay address; with Google or Microsoft also the name from that account).
Profile: name, colour, sticker symbol, optional photo – visible to the people in your spaces.
Content in spaces: tasks, to-dos (due date, assignee, subtasks, notes), list items, completions with time, stars, thank-you stars with a short message, badges, rewards (optional photos and links), redemption requests and approvals, invite codes.
Notifications: push token, time zone and language if you turn reminders on.
Purchases: subscription status. Premium is paid via Apple/Google, Business via Stripe – we never see full payment details.
Optional features: photos of completions (visible only in the space), absence periods, child profiles without an account (name and colour only), personal calendar link, messages to a Slack/Teams channel set up by the team.
Setup by description: if you use it, only the text you enter is sent to Anthropic PBC (USA) to suggest a task plan; the text is not stored.
Security: in the web version, browser attestation via Firebase App Check (reCAPTCHA Enterprise).
3. Purposes and legal bases
Providing the app (Art. 6(1)(b) GDPR), reminders and invitation e-mails (consent / contract), invoicing (legal obligation), secure operation (legitimate interest). No ads, no advertising tracking.
Projects and time tracking (work spaces): projects with status, dates, budget and milestones; time entries with task, date, duration, note and billable flag; weekly capacity. Clients and invoices (admins and team leads only): client master data, quotes and invoices with line items and amounts, the team's sender details and the generated PDF files.
Anthropic PBC (USA) – only for “setup by description”, based on Standard Contractual Clauses
Apple, Google and Microsoft – sign-in (if chosen); Apple/Google also store purchases and push delivery
Transfers to the USA rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.
5. Retention
Data is kept while your account exists. When you delete your account, your account, profile, push tokens and memberships are deleted and your name in shared spaces is replaced with “Former member”; spaces where you were alone are deleted completely. Invoices are kept as long as tax law requires (up to 10 years).
6. Your rights
Access, rectification, erasure, restriction, portability, objection and complaint to a supervisory authority. In the app: Profile › Export my data and Profile › Delete account (how to).