Privacy

Controller

We are responsible for accounts, payment, the website and support. The customer who owns the account is responsible for board content and guest data; we only process them on the customer's behalf.
Data processing agreement

Account: e-mail address, password (hash only), optional name, language, trial or subscription status. To provide Vauri (Art. 6(1)(b) GDPR), until the account is deleted.
Boards: title and elements, on the customer's behalf. After a trial or subscription ends: 90 days read-only, then deleted.
Live session: the guest's pseudonym and an anonymous ID, for the session only, deleted within 2 days.
Payment: through Stripe, we never see card details. Invoices are kept for 8 years (Art. 6(1)(b) and (c) GDPR, § 147 AO).
E-mails: sign-in, notice and deletion e-mails through Brevo (Art. 6(1)(b) GDPR).
Referrals: whoever books through a referral link is linked to the referring account, which only sees the number (Art. 6(1)(b) GDPR).
Support: e-mails and calls booked through Calendly are used for your request only (Art. 6(1)(b) and (f) GDPR).
Website: the server briefly keeps IP address, time and page requested to keep the service secure (Art. 6(1)(f) GDPR). The sample board saves nothing.
Account deletion takes effect immediately; backups are overwritten within 30 days.

Vauri is not meant for identifying or health data. For boards and guests use codes or anonymised names only: no real names, dates of birth, health information or contact details.
Pseudonyms remain personal data for the customer. Professional duties, such as confidentiality obligations (§ 203 German Criminal Code), remain with the customer; we are bound to secrecy by contract.

Only technically required cookies (sign-in, language) and your appearance choice in the browser (§ 25(2) no. 2 TDDDG). No tracking, no advertising.

Encrypted transfer, storage in Frankfurt, access to your own data only, logs without board content.

Access, rectification, erasure, restriction and portability (Art. 15–20 GDPR). Export and deletion directly in your account.
Objection: you can object at any time to processing based on legitimate interests (Art. 21 GDPR).
Complaint: Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.
An account requires an e-mail address. There is no automated decision-making and no profiling.

When you join through an invitation we only store the pseudonym you choose and an anonymous ID, deleted within 2 days. A first name or pseudonym is enough.
The person who invited you is the controller. Please contact them with questions and to exercise your rights.