Privacy Policy

1. Controller

Email: sandrovogel@pm.me

2. Data processed locally in your browser

Firmspec processes specification names, organizations or teams, overview text, requirements, provenance, open questions, decisions, evaluation content, validation records, and local version history entirely in your browser. This workspace content is not sent to us, Vercel, GitHub, an API, or a language model.

The application stores workspace content and version history in your browser's localStorage. It also stores your light or dark theme preference there. This storage allows the application to work across visits on the same browser and device. The current service has no function that transmits this local storage to us, and we cannot retrieve it remotely.

Markdown exports and JSON backups are created locally and downloaded by your browser. Their later storage, publication, or sharing is controlled by you.

You can remove workspace content by resetting a specification, restoring a different backup, or clearing the site's stored data in your browser. Removing browser data may permanently delete specifications that you have not exported or backed up.

3. Website access and hosting data

When you open the website, technically necessary data is processed to deliver the files securely and keep the service stable. This may include your IP address, date and time of access, requested URL, referring page, browser and device information, response status, and diagnostic or security data.

The production website is intended to be delivered by Vercel Inc. Vercel may process this technical access data as a hosting provider and may also process service-generated data under its own responsibility. Details are available in Vercel's Privacy Notice.

The source code may be maintained in a GitHub repository. GitHub does not receive the content stored in your Firmspec workspace merely because the source code is hosted there. If you follow a link to GitHub, GitHub processes that visit under its own privacy terms.

4. Purposes and legal bases

Technical access data is processed to provide a secure, reliable, and functional website, prevent abuse, diagnose errors, and protect the service. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the operation, security, and stability of the website.

Local browser storage is used only to provide the workspace persistence and theme preference requested through the application. Storing or reading this information on your device is considered strictly necessary for those features; the legal basis is Section 25(2) No. 2 TDDDG. Workspace content that remains exclusively on your device is not received or otherwise processed by us.

5. Cookies, analytics, and external services

Firmspec does not set advertising or analytics cookies and does not use analytics tools, tracking pixels, social-media plugins, external fonts, remote content delivery networks, account systems, or embedded language models.

No consent banner is used because the application does not use optional cookies or comparable tracking technologies. If this changes, this policy and the consent mechanism will need to be updated before the new technology is enabled.

6. Recipients and international transfers

Recipients of technical access data may include Vercel and the subprocessors it uses to provide hosting, security, and infrastructure services. Workspace content is not transmitted to those recipients.

Vercel is based in the United States and may process data in the United States and other countries. Vercel states that it uses recognized transfer mechanisms where required, including the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. See Vercel's Privacy Notice for current details.

7. Retention

We do not retain workspace content because we do not receive it. Locally stored specifications, settings, and history remain in your browser until you delete or replace them, clear the site's browser data, or the browser removes that storage.

Technical hosting and security data is retained only for as long as necessary for delivery, security, troubleshooting, and abuse prevention, or as required by law. Hosting-provider retention is also governed by Vercel's applicable policies and service configuration.

8. Your rights

Subject to the applicable legal requirements, you may have the right to request access to personal data, rectification, erasure, restriction of processing, and data portability. You may also object to processing based on Article 6(1)(f) GDPR. Where processing is based on consent, you may withdraw that consent at any time with effect for the future.

Because we do not receive workspace content, these rights primarily concern technical data processed when the website is accessed. To exercise your rights, contact sandrovogel@pm.me.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible at the controller's place of establishment is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany. You can find its complaint process at datenschutz-berlin.de.

10. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Article 22 GDPR. The suggestions shown in Firmspec are generated by deterministic rules from the state of your local specification, not by an AI model.

11. Security and your responsibility

The public website is intended to be delivered over HTTPS. Local browser storage is not a secure vault: anyone with access to your browser profile or device may be able to access its contents. Avoid entering secrets or personal data that is unnecessary for the specification, protect your device, and store exported files and backups appropriately.

12. Changes to this policy

We may update this policy when Firmspec's features, hosting setup, or legal requirements change. The current version and its revision date are published on this page.