Privacy Policy
Transparent disclosure regarding the collection, processing, and protection of your personal data.
Our Philosophy
The protection of your personal data is the highest priority for us at appamass LLC (hereinafter referred to as "appamass", "we", or "us").
We are a US company operating globally. To ensure the highest security standards for our international clients, your personal data is primarily stored on our infrastructure situated within the European Union.
This policy transparently explains what data we collect, why we do so, and how we protect it.
This Privacy Policy applies to all services, websites, applications, and platforms operated by appamass LLC (hereinafter referred to as "Services").
Who Is Responsible for Your Data?
The Data Controller responsible for data processing is:
appamass LLC 304 S Jones Blvd, #8248 Las Vegas, NV 89107 USA Email for privacy inquiries: info@appamass.com
Representative in the European Union pursuant to Art. 27 GDPR: Rainer Dechet Rennbahnweg 27/46/56 1220 Vienna Austria
Pursuant to Art. 27 GDPR, this representative serves as our official point of contact for supervisory authorities and data subjects regarding all matters relating to the processing of personal data for the safeguarding of rights under the GDPR.
Your Data Protection Rights
We recognize and respect that you retain control over your data. Under the General Data Protection Regulation (GDPR) and applicable national laws, you are entitled to the following rights:
- Right to Information (Art. 13 & 14 GDPR)
- Before processing begins, you are informed of the nature, scope, purposes, legal bases, and recipients of your personal data, as well as your statutory rights – generally through this Privacy Policy.
- Right of Access (Art. 15 GDPR)
- You may at any time request information regarding whether and which personal data we process about you, including the purposes of processing, data categories, and recipients.
- Right to Rectification (Art. 16 GDPR)
- You have the right to request the correction of inaccurate data or the completion of incomplete personal data.
- Right to Erasure (Art. 17 GDPR)
- Under specific statutory conditions, you can request the erasure of your data, such as when it is no longer necessary for the original purposes or when you revoke your consent. Statutory retention obligations or legitimate interests may override erasure requests.
- Right to Restriction of Processing (Art. 18 GDPR)
- Under certain conditions, you may demand that your data only be stored and not subjected to further active processing.
- Right to Data Portability (Art. 20 GDPR)
- You may receive the data you provided to us in a structured, commonly used, and machine-readable format, or have it transferred to a third party where technically feasible.
- Right to Object (Art. 21 GDPR)
- You can object to data processing at any time, particularly regarding direct marketing or processing grounded in legitimate interests.
- Right to Revoke Consent (Art. 7(3) GDPR)
- You may revoke previously granted consent at any time with prospective effect.
- Protection Against Automated Decisions (Art. 22 GDPR)
- You have the right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects concerning you or similarly significantly affects you.
For residents in Austria, a right to confidentiality of personal data also applies pursuant to § 1 DSG.
Exercising Your Rights & Complaints: To exercise your rights or if you have questions, please reach out via the contact details in Section 11. We typically respond within one month. You also retain the right to lodge a complaint with a supervisory data protection authority of your choice within the EEA or UK.
3.1Specific Rights for California Residents (CCPA/CPRA)
In addition to the rights above, we afford you all protections established under the California Consumer Privacy Act (CCPA/CPRA). This notably includes the right to know collected data categories and sources, as well as the right to opt-out of the sale or sharing ("Do Not Sell or Share") of your personal information.
We explicitly clarify that we do not sell or share personal data. You are also entitled to submit complaints to the California Privacy Protection Agency (CPPA).
3.2Users in Other Jurisdictions
We respect data protection legislation globally. The European GDPR provisions remain our benchmark framework, while also honoring local statutory requirements tailored to your jurisdiction.
How and Why We Process Your Data
4.1Website Hosting (Google Cloud in the EU)
Our website and its databases run on Google Cloud Platform (Google Cloud Run and Google Cloud SQL) provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Data is stored and processed in the europe-west4 region (Netherlands).
When you open a page, the server processes technically necessary data such as your IP address, the time, the requested address and your browser identifier in order to deliver the page and protect it against misuse. Google processes this data as a processor under the Cloud Data Processing Addendum. The legal basis is our legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR).
4.2Blog Images (Google Cloud Storage)
The cover images of our blog posts are stored in Google Cloud Storage and loaded from storage.googleapis.com. In doing so, your browser transmits your IP address and technical details to Google so the images can be delivered. The legal basis is our legitimate interest in fast and reliable image delivery (Art. 6(1)(f) GDPR).
4.3Cookies and Your Consent
We serve fonts and videos ourselves; we do not embed third-party content such as maps or external video players. Technically necessary cookies are set only by the protected area for our team after sign-in (session and selected language).
For visitors from the European Union, the European Economic Area, the United Kingdom and Switzerland, cookies and services for analytics (Google Analytics, see 4.4) are used only with explicit consent, which you give or refuse on your first visit via our cookie notice (Art. 6(1)(a) GDPR). Whether the notice appears is decided solely by your browser based on its language and time zone settings; nothing is transmitted to us in the process. If the country of your browser language or your time zone belongs to one of these regions, we ask.
Visitors outside these regions do not see a notice; for them, Google Analytics is loaded without asking first. You can object to this at any time via the cookie settings at the bottom of every page.
Your browser stores your choice in local storage so that the notice does not appear on every visit; this entry does not leave your device. In the cookie settings you can change your choice at any time and withdraw consent with effect for the future; this also deletes the Google Analytics cookies. You can also delete or block cookies in your browser.
4.4User Analytics (Google Analytics)
We use Google Analytics 4 – for visitors from the EU, the EEA, the United Kingdom and Switzerland only with your consent (see 4.3) – a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, embedded directly without other tag services. It helps us understand which pages are read and how to improve the website. Pseudonymous usage data such as visited pages, time on page, device, browser and approximate location is processed; Google Analytics 4 does not store IP addresses. The data is deleted after at most 14 months.
Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the European Commission's Standard Contractual Clauses apply in addition. The legal basis is your consent (Art. 6(1)(a) GDPR); outside the scope of the GDPR, our interest in improving the website.
In these regions, Google Analytics is not loaded without your consent, and after an objection via the cookie settings it is not loaded anywhere. Independently of this, you can prevent collection with Google's browser add-on.
4.5Blog View Counter
To show the most-read posts, we count views of blog posts on our own server. Only the address of the post is sent, nothing about you. So that a view is not counted twice, your browser remembers the address and the time for the duration of the session (session storage); this entry does not leave your device and is deleted when you close the tab. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
4.6Contact Form and Inquiries
When you write to us via the contact form, we store your name, your email address, your message and optionally the budget range and desired start in our database (Google Cloud SQL, EU) in order to answer your inquiry. We process inquiries by email for the same purpose.
In addition, an internal service (Google Cloud Run, EU) forwards each inquiry by email via Gmail of Google LLC to our mailbox (info@appamass.com) so that we notice it promptly. All details you entered are transmitted; Google processes them as a processor, and the European Commission's Standard Contractual Clauses apply.
The legal basis is taking steps prior to entering into a contract (Art. 6(1)(b) GDPR), and for other matters our legitimate interest in answering (Art. 6(1)(f) GDPR). We delete the data once your matter has been resolved and no statutory retention obligations apply.
4.7Technical Logs for Error Analysis and Security
We keep server and error logs (Google Cloud Logging, EU) for at most 90 days to ensure stability and security. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
International Data Transfers
Your data is hosted primarily in the European Union. Because we are a US entity, cross-border data transfers to countries outside the EU/EEA may occur (notably via administrative access from the US).
For transfers to countries lacking an adequacy decision recognized by the European Commission, we implement appropriate safeguards. These are the approved Standard Contractual Clauses (SCCs) executed with our service partners.
Notwithstanding these precautions, a residual risk may persist that third-country authorities (e.g., US agencies) could seek data access under specific lawful grounds.
Data Retention and Erasure
We observe the principle of data minimization and delete personal records as soon as the processing purpose has been fulfilled and no statutory record-keeping duties apply.
Data Security
We enforce state-of-the-art technical and organizational measures to safeguard your information, including full HTTPS/TLS transport encryption, role-based least-privilege access, physical access barriers, pseudonymization where applicable, and regular audits and secure backups.
Children's Privacy
Our services are strictly targeted at professionals and enterprises, not children. We do not knowingly gather data from minors under 16 years of age (or the relevant statutory threshold in your jurisdiction).
No Automated Decision-Making
We do not employ your personal data for automated decision-making or profiling that yields legal effects or similarly affects you.
Amendments to this Policy
This Privacy Policy may be updated periodically. Material revisions will be visibly highlighted on our website and, where mandatory, communicated via email.
Contact Us
For any inquiries, requests, or to exercise your privacy rights, you may reach us through the footer links or by email at the address designated in the imprint (info@appamass.com).