Information about the processing of your data

Controller within the meaning of the GDPR

PicUpgrades e.U.
Owner Samuel Welte
Nofler Straße 42a, 6800 Feldkirch, Austria

Contact for privacy matters

info@alpenapps.com
+43 681 10746982

Data protection officer

No data protection officer has been appointed. The requirements of Art. 37 GDPR are not met – we neither process on a large scale nor monitor systematically. Please address your concerns directly to the contact details given above.

For a page to be displayed at all, your browser transmits technical details to the server: your IP address, date and time, the address requested, the status code of the response, and browser and operating system identifiers. These details arise on every visit to any website and cannot be avoided technically.

Purpose

Delivering the page, detecting technical faults and defending against attacks

Legal basis

Art. 6(1)(f) GDPR – our legitimate interest in secure and fault-free operation

Retention period

One day in our hosting provider's logs, then automatic deletion

Analysis

None. There is no audience measurement, no profiling, no combination with other data.

The website has three forms: the appointment request, the PDF request and the shop check. For the PDF request you enter only your email address; our server then sends you an email with the link to the PDF “Automation Check”. For the shop check you enter the address of your online shop; our server then retrieves publicly accessible pages of that shop (the home page, one product page and technical files such as robots.txt), rates one product page against fixed technical criteria and sends you the result to the email address you provided. All three forms store your entries – and for the shop check also the check result – in a database whose server is located in Frankfurt. Our mailbox receives only a short notice with your email address so that we can reply to you right away – your name, your message and the check details are not included. Only if the database is temporarily unavailable is your request sent to us in full by email, so that it is not lost.

Data in the appointment request

First name, last name and email address, plus optionally your phone number and your message

Additional data in the shop check

Optionally your company, plus the shop address entered, the product checked and the check result (score and findings)

Analysis without a submitted form

The shop analysis runs before you enter your contact details. If you do not submit the form afterwards, only the shop address with the check result remains stored – without a name and without an email address – and is deleted automatically after 30 days.

Data in the PDF request

Only your email address – this form asks for nothing else. We use it to send you the requested PDF. The email is sent by our service provider Resend. It has the same text for every recipient; the PDF is linked in it and is hosted on this website. We store the request like an appointment request – for 24 months at most, see “Retention period”.

Page from which you sent the request

With every request we store the page of this website from which you submitted the form – for example “/en/break-even-calculator”. Only this path is stored, no other details from the address bar. This tells us which topic brought you to us. The path is also included in the notice to our mailbox.

Click ID of an ad

If you came to this page via a Google ad, Google appends an identifier to the address bar. It is stored together with your request so that we can see which ad led to your request. On its own it says nothing about you, and we return it to Google only if you have consented to measurement.

Purpose

Handling your request, sending the requested PDF, delivering your shop check result and preparing a possible contractual relationship

Legal basis

Art. 6(1)(b) GDPR – taking steps prior to entering into a contract at your request

Necessity

We need your name and email address to reply to you and deliver the result; without them we cannot handle the request. For the PDF request your email address is enough. All other fields are optional and have no effect on whether we reply to you.

Retention period

Until your request has been dealt with conclusively, for 24 months at most – then we delete it in both places where it is held: the database and the mailbox. In the database this is done by a job that runs daily, counted from the day of your request. A deleted request disappears from the daily database backups up to seven days later. If a contract is concluded, this period does not change: only invoices and contracts are kept longer, in our accounting – for seven years under § 132 BAO and § 212 UGB (Austrian tax and commercial law).

So that our mailbox is not flooded with automatically sent requests, the server counts the forms submitted per sender and allows at most five requests per ten minutes from the same connection. The same limit applies to the shop analysis – per sender and additionally per shop address checked, so that nobody can use our server to burden other people's shops with requests. We do not store your IP address itself for this. From it, a secret key that is held exclusively on our server produces a hash that cannot be traced back to any address without that key – only this hash and the time are stored in our database. Both stop counting after ten minutes and are deleted with the next form request. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a working contact channel.

We run ads on Google. To see which of them actually leads to a request and which only costs money, we use the conversion tracking of Google Ads and Google Analytics 4. Both run exclusively with your consent. As long as you have not consented, no Google script is loaded, no cookie is set and no connection to a Google server is established – verifiable in the network tab of your browser's developer tools.

What is measured

Which pages you visit and in what order, how long you stay, which ad or search brought you here, approximate origin (country and region, not your address), device type, browser and screen size – and whether you submitted one of the two forms.

Hashed email address

If you submit a form, we additionally transmit your email address to Google in hashed form (SHA-256). The address itself does not leave your device – it is hashed in the browser before anything is sent. To be honest about the effect of this method: the hash cannot be reversed, but anyone who already knows your address can match it to the hash. That is exactly the purpose – Google compares the value with the addresses of its own signed-in users to connect your click on an ad with your request.

Purpose

Determining which ad led to a request, and directing the advertising budget to what works

Legal basis

Art. 6(1)(a) GDPR and § 165(3) TKG 2021 (Austrian Telecommunications Act) – your consent

Withdrawal

At any time via Cookie settings in the footer of every page – one click, without giving reasons and without a message to us. Afterwards nothing is measured any more, with immediate effect. The lawfulness of the processing carried out until then remains unaffected. Data already stored at Google can be deleted via your Google account or a request to Google.

Recipient

Google Ireland Limited, Dublin – details in the table under “Recipients of your data”

Retention period

14 months for the analytics data; the individual cookies expire after between 90 days and 24 months

Google's privacy policy

policies.google.com/privacy

The following list is complete and verifiable – you will find the same entries in your browser's developer tools under “Application” or “Storage”. Everything except the first row is created only once you consent to measurement.

The first entry stores nothing but your answer to the consent question. It is exempt from the consent requirement (§ 165(3)(2) TKG 2021), because without it we would have to ask you again on every page view. It is held in the browser's local storage and not in a cookie – so it is never transmitted to a server on any request.

In the appointment request and the PDF request you can optionally tick: “Receive tips and new free tools by email”. You receive our reply and the PDF even without this box. To be honest: there is currently no regular mailing. Your tick is a note on file – we will write to you as soon as there is something new. Until then we do not use your address for this.

Legal basis

Art. 6(1)(a) GDPR and § 174 TKG 2021 (Austrian Telecommunications Act) – your consent

Withdrawal

At any time, informally, by email to info@alpenapps.com, without giving reasons. The lawfulness of the processing carried out until then remains unaffected.

Retention period

Until you withdraw, but for 24 months at most. If the mailing does not exist by then, we delete the note – we do not want to keep using a consent that nothing has followed for two years.

Who would write to you

AlpenApps is a project of PicUpgrades e.U.. Should the project be transferred into a company of its own, that company continues the note on file and writes to you – your consent expressly covers this as well. We will name the company in the first message, and your withdrawal naturally applies to it too.

We do not sell your data and do not pass it on for third-party advertising. Five service providers get to see it technically, because they run our website, store your request, deliver our mail, match the column names of your product file in the “Switch to Shopify” tool and – only with your consent – measure advertising effectiveness. A data processing agreement pursuant to Art. 28 GDPR is in place with all five.

Vercel, Resend and OpenRouter are based in the USA, our contractual partner for the database in Singapore. OpenRouter passes the column names on to the provider of the respective AI model – currently DeepSeek, based in China; that is why we send only column names and sample values there, and only at your express request. For the database this is purely a contractual matter: your request is held on a server in Frankfurt and thus in the EU – support, backups and sub-processors, however, may reach beyond that. In these four cases the basis is the standard contractual clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR, which form part of the respective contracts. Our contractual partner for Ads and Analytics, by contrast, is the Irish Google Ireland Limited; a transfer to the US parent company Google LLC is nevertheless not excluded. Google LLC is certified under the EU-US Data Privacy Framework, for which the Commission found an adequate level of protection on 10 July 2023; in addition, the standard contractual clauses apply here too. We point out openly that, despite these bases, US authorities may under certain conditions access data stored there, and that you may not have legal remedies comparable to those in the EU. That is exactly why measurement is a decision you make – and not we.

This list is here because it is verifiable – you can check it in your browser's developer tools:

• Without your consent, none of this: no cookies, no measurement, no call to a Google server. If you decline, the website remains technically the same as before measurement was introduced.
• No embedded third-party content – no maps, no videos, no social network buttons.
• No external fonts. The font used is hosted on our own server; no request goes to Google.
• No resale and no transfer of your contact details to third parties for advertising purposes.
• No automated decision-making and no profiling pursuant to Art. 22 GDPR. The shop check rates publicly accessible pages of your shop against fixed technical criteria – it makes no decision with legal effect about you as a person, and no profile of you is created.

The website can be reached exclusively over an encrypted connection (HTTPS/TLS); requests over unencrypted HTTP are redirected. In addition, a Content Security Policy forbids the browser to load content from third-party servers – with a single, explicitly listed exception for the measurement described above. The browser blocks everything else, even if someone tried to inject it. The access keys for mail delivery and the database are held exclusively server-side and are never delivered to your browser. The database is additionally set up so that not a single row can be read without the secret key – even if someone knows the address of the database.

You have the following rights towards us. An informal email to info@alpenapps.com is enough; we reply within one month.

• Access (Art. 15) – which data we process about you.
• Rectification (Art. 16) – correction of inaccurate details.
• Erasure (Art. 17) – unless a retention obligation prevents it.
• Restriction of processing (Art. 18).
• Data portability (Art. 20) – provision in a common format.
• Objection (Art. 21) – to processing that we base on a legitimate interest.
• Withdrawal of consent (Art. 7(3)) – at any time, with effect for the future.

Independently of this, you can lodge a complaint with the supervisory authority at any time: Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Wien, Austria, phone +43 1 52 152-0, email dsb@dsb.gv.at, dsb.gv.at.

This policy describes the state as of 2 October 2026. If we change anything on the website that affects the processing of your data, we change this page first. For requests already sent, the version that was published here at the time of sending always applies.