AnnexEdit Pro AnnexEdit

Privacy Policy

Last updated: 7 October 2026

1. Data Controller

ma-kom agentur UG (haftungsbeschränkt)
Merkelbach 12
74541 Vellberg
Germany

Email: mail@annexedit.com
Managing Director: Pascal Sanwald

We have not appointed a data protection officer. The controller named above is the contact for all data protection questions.

2. Collection and Processing of Personal Data

We collect personal data only when it is technically necessary for fulfilling contracts or operating the website:

  • Email address: For sending license keys and order confirmations (Art. 6(1)(b) GDPR)
  • License activations: Device identifier (hash only), device name and device model, time of activation — for license control and to manage your devices (Art. 6(1)(b) GDPR). We do not store the IP address in this process. The device name may contain your name if you named the device that way. Deactivated activations are deleted after 3 years.
  • Payment data: Processed exclusively by Stripe or PayPal; we do not store credit card or bank details. We receive the order details (product, amount, payment reference, billing address).
  • Support requests: Name, email, and message text via contact form (Art. 6(1)(b) and (f) GDPR)
  • Gift vouchers: Email address of the buyer and the recipient and an optional message, to deliver the voucher (Art. 6(1)(b) GDPR)
  • Education proof (edu discount): Email address, its domain, IP address and browser identifier, to verify the discount and prevent abuse (Art. 6(1)(b) and (f) GDPR)
  • Team licenses: Email addresses of invited people and the invitation status (Art. 6(1)(b) GDPR)
  • Withdrawal and cancellation: The details you enter in the withdrawal form, to assign and process your declaration (Art. 6(1)(b) and (c) GDPR)
  • Server logs: When you open the website, the web server log records IP address, time, requested address and browser identifier (Art. 6(1)(f) GDPR: operation, troubleshooting, security). The host overwrites them in its usual log rotation.
  • Internal business events: We report purchases and refunds with email address, product and amount to our own operations system (Console of ma-kom agentur UG) to process orders and payments and keep the books (Art. 6(1)(b), (c) and (f) GDPR). It is under our own responsibility and is not passed on to third parties.

Retention: We keep license and customer data for the term of the contract; invoice and accounting data are kept for 8 years (section 147 AO, section 257 HGB; Art. 6(1)(c) GDPR). Contact requests are deleted once handled and no retention duty applies.

Obligation to provide data: A purchase and a license require an email address and payment details; without them we cannot perform the contract. All other details are voluntary. No decision based solely on automated processing with legal effect (Art. 22 GDPR) takes place.

3. Cookies and Tracking

Our website uses cookies and similar technologies. You can consent or decline via our cookie banner. The legal basis for everything that is not strictly necessary is your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG); you can withdraw it at any time with effect for the future.

Cookie / Technology Purpose Duration Provider
PHPSESSID Session management (cart, login status) Session AnnexEdit (own)
admin_authenticated Admin login status Session AnnexEdit (own)
cookieConsent_v2 Stores your cookie consent choice 1 year AnnexEdit (own)
_gclid Google Click Identifier for conversion measurement (only after consent) 90 days Google
_ga, _gid, _gat Google Analytics: web analytics (only after consent) up to 2 years Google

Google Ads and Google Analytics are only activated after your explicit consent (Consent Mode v2, basic mode): the Google tag is only loaded after you consent. Before you choose and after you decline, no connection to Google servers is made and no marketing or analytics cookies are set. You can change your choice at any time via the “Cookie settings” link in the footer.

The server-side purchase report to Google Analytics (transaction ID, amount, hashed email address) and the storage of the Google click ID (gclid) also only take place if you agreed to marketing consent at purchase ("Accept all").

4. Processors and Third-Party Providers

To provide our services, we use the following processors:

  • Webspace-Verkauf.de ISP e.K., Grub am Forst — hosting (Plesk server in Germany), processor under Art. 28 GDPR. Website, database and server logs are stored there.
  • Stripe Payments Europe, Ltd. — Payment processing (credit card, SEPA, Apple Pay). Based in Ireland. Processing may also take place at Stripe, Inc. in the USA (third country, see section 9). Stripe Privacy Policy
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. — PayPal payment processing. Based in Luxembourg. Processing may also take place at PayPal companies in the USA (third country, see section 9). PayPal Privacy Policy
  • Google Ireland Limited — Marketing measurement and web analytics (only after consent). Based in Ireland. Google Privacy Policy

5. AI-Powered Features (Promptopoly Integration)

AnnexEdit Pro offers optional AI-powered features via the Promptopoly integration (prompt optimization, auto-tags, workspace mirror). These features:

  • are opt-in and require an active Promptopoly account
  • send text data to the Promptopoly API only upon explicit user action (Art. 6(1)(a) GDPR — consent)
  • are not used for AI model training
  • are subject to the separate Promptopoly Privacy Policy

6. Hosting and Data Storage

Our website is hosted on a server of Webspace-Verkauf.de ISP e.K. in Germany (Plesk server). The website data is stored there. Data you have transmitted to Stripe, PayPal or Google is processed by these providers under their own terms, also outside the EU (section 9).

7. Prospect List (Subscription Cost Calculator)

On the page annexedit.com/rechner you can have a cost comparison (result report) sent to you as a PDF by email. In doing so, we process:

  • Email address — exclusively to deliver the requested report (Art. 6(1)(a) GDPR — consent)
  • Proof of consent — timestamp and version of the consent text (Art. 7(1) GDPR)
  • Language and calculator selection (chosen subscription, time frame) — so the report reflects your selection
  • Campaign parameters (UTM) from the link through which you reached the page (e.g., flyer QR code) — to evaluate which advertising resonates
  • IP address and browser identifier — within server logs and as a security feature (Art. 6(1)(f) GDPR)

Delivery uses double opt-in: only after you click the confirmation link in the requested email does the entry become active and the report get sent. The confirmation email contains no advertising. No further emails follow (no newsletter, no marketing) unless you separately consent. Every report email contains an unsubscribe link; unsubscribing anonymises the entry immediately.

You may withdraw your consent at any time with effect for the future — via the unsubscribe link in the email or a message to mail@annexedit.com. Your entry is then anonymised immediately (email address replaced by a hash marker; IP address, browser identifier, calculator selection and links deleted; only the origin statistics without personal reference remain). Unconfirmed entries are deleted when the confirmation link expires (7 days); confirmed entries with no contact are anonymised after 12 months. Your rights and the complaint route are described in section 8.

8. Your Rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent (Art. 7(3) GDPR). Contact us at mail@annexedit.com.

Right to object (Art. 21 GDPR): You may object at any time, on grounds relating to your particular situation, to processing we base on legitimate interests (Art. 6(1)(f) GDPR). We will then stop processing the data unless we demonstrate compelling legitimate grounds.

You also have the right to lodge a complaint with a supervisory authority. The competent authority is the Baden-Württemberg State Data Protection Authority.

9. Data Transfers to Third Countries

Google Ireland Limited (Analytics/Ads) may transfer data to the USA; likewise Stripe (Stripe, Inc.) and PayPal may process data in the USA during payment processing. The basis is the EU Standard Contractual Clauses (SCC) and, where the recipient is certified, the adequacy decision on the Data Privacy Framework (DPF). US authorities may access data under US law; legal remedies equivalent to European standards are not guaranteed in every case. You can prevent the transfer to Google by declining marketing cookies; for payment you can choose between Stripe and PayPal.

10. The Mac App

The AnnexEdit app runs locally on your Mac. It opens network connections only for these purposes:

  • License and subscription check: When you activate your license key, the app sends the key, the app version, the platform (macOS) and the processor architecture to the Promptopoly interface (promptopoly.com, also operated by ma-kom agentur UG). After that, about every 6 hours and at launch, it sends only the license key to the same interface to check your subscription status. The response tells us your subscription tier and expiry date. Purpose: performance of the contract, namely unlocking the features you bought (Art. 6(1)(b) GDPR). Your IP address and the time appear in the server log (rotated by the host, see section 2). The app stores the result encrypted on your Mac (Keychain) and keeps using it offline for up to 14 days. Without a license key the app does not call this interface.
  • Update check: At launch (after about 5 seconds) and then at most once every 24 hours, the app queries annexedit.com (address /api/v1/updates/check, HTTPS). It transmits the app version, platform, processor architecture, update channel, app language and your license key (to check that your license includes updates); your IP address arises as a connection datum. If a new version is offered, we store an entry containing the SHA-256 hash of your license key, platform, app version and time, without the IP address, for the duration of the contractual relationship. The IP address appears only in the server log (section 2). Purpose: delivering updates, license control, security and currency of the app (Art. 6(1)(b) and (f) GDPR). The app downloads the new version from annexedit.com and verifies it with a SHA-256 checksum. You can switch the check off in the settings; you then receive updates only via the download page.
  • Git providers (repository connection): Only if you connect GitHub, Bitbucket, Gitea or GitBucket in the settings. The connection runs directly from your Mac to the provider or to the server you specify (for Gitea and GitBucket usually your own server); we are not in between and receive none of this data. The app calls the provider's interface with your access token (connection check, user query) and uses the Git installed on your Mac to clone and push; your user name, your access token and the contents of your repository go to the provider. The token is kept in your Mac's Keychain and leaves it only in these calls. The legal basis is your instruction to the app (Art. 6(1)(b) GDPR); processing at the provider is governed by your contract with it and its privacy policy (GitHub and Bitbucket partly in the USA).
  • AI, sync and Promptopoly functions: Only if you have connected a Promptopoly account and trigger the function yourself: writing assistant, sync and workspace mirror, sharing and locks in shared workspaces, template catalogue and skills. Your licence key and the content the function needs are sent to promptopoly.com (Art. 6(1)(b) GDPR, for AI text processing point (a); see section 5). After a skill run the app also reports skill, status, duration and output format (no document content) so that we can detect errors. The preview shows images from the internet if your document contains such addresses; your Mac then fetches each image address directly.

The app does not send general usage statistics (telemetry) or automatic crash reports. Your documents stay on your device as long as you do not use any of the functions above.

11. Social Media Profile

We maintain a profile on Mastodon (mastodon.social/@AnnexEdit). When you visit the profile, the instance operator (Mastodon gGmbH, Germany) processes data under its own privacy policy; for processing on the platform we and the operator are partly jointly responsible (Art. 26 GDPR). We only receive what you send us publicly via the profile (replies, mentions). We use no Mastodon scripts on this website; the link is a plain link.

12. Changes

We reserve the right to update this privacy policy as needed. The current version is always available on this page. For significant changes, we will inform active customers by email.