Comic4u

Privacy Policy

Last updated: 27 October 2026

This Privacy Policy explains how Comic4u collects, uses and protects your personal data when you use our website and services. We process your data in accordance with the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

1. Controller

The binding details of the controller and the contact details will be verified and completed before the public launch. Until then, this version is a draft.

2. Data Collected

We collect and process the following categories of personal data:

2.1 Account Data

  • Confirmed email address, internal customer number and preferred language
  • First and last name as well as delivery and billing details, only where necessary
  • Short-lived sign-in challenges, session data and usage counters; no password for new customer accounts

2.2 Usage and Content Data

  • Story configurations and inputs for comic creation
  • Generated comic pages and images
  • Order and payment history

2.3 Payment Data

Payments are processed via Stripe. Full card details are not stored on our servers. The specific Stripe contracting parties used, the roles under data protection law and the bases for transfers will be documented before launch.

2.4 Technical Data

  • Security and session data including IP address and browser information; this metadata is removed after seven days
  • Short-lived pseudonymized email and IP keys for limiting sign-in requests, for at most 24 hours
  • Preview quotas and cost reservations for protection against abuse

2.5 Contact Form Data

  • Name
  • Email address
  • Phone number (optional)
  • Subject and message content

Passwordless access and abuse protection

Before the first paid processing, we confirm your email by code and create a customer account without a password. This links your preview and later your books and orders. For later sign-ins, you receive a single-use link.

Provision is made for the requested service or for the performance of the contract. Cost and usage limits serve the legitimate interest in preventing abuse and in a secure platform; the necessity and the balancing of interests will be documented before launch. The privacy notice is not marketing consent.

For preview tokens, we store credits, reservations, usage and reversals with reference to the customer profile and book project. After a full refund, bonus tokens already used may be offset against later credits. The journal remains stored until the account is deleted; we handle billing-relevant records separately.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Art. 6 GDPR:

  • Art. 6(1)(b) GDPR (performance of a contract). Processing to provide our comic creation services and to manage your account.
  • Art. 6(1)(c) GDPR (legal obligation). Processing to comply with tax, accounting and other statutory obligations.
  • Art. 6(1)(f) GDPR (legitimate interests). Improving service quality, securing the platform, preventing fraud and keeping server logs.
  • Art. 6(1)(a) GDPR (consent). Where you have given explicit consent (e.g. marketing emails or non-essential cookies). Consent may be withdrawn at any time.

4. Purposes of Data Processing

  • Creating and managing your user account
  • Processing and delivering comic creation orders
  • Processing payments for your orders
  • Handling support and contact form requests
  • Sending transactional emails (account confirmations, payment receipts)
  • Sending marketing emails where you have consented; you may unsubscribe at any time
  • Improving and securing our platform
  • Complying with legal and regulatory obligations

5. Data Retention

We store personal data only for as long as is necessary for the purposes described in this Policy or as required by statutory retention periods:

  • Sign-in codes are valid for ten minutes, sign-in links for 60 minutes. Expired challenges are deleted no later than 24 hours after expiry.
  • Sending and abuse counters are removed after 24 hours at the latest; security metadata after seven days.
  • New customer accounts without a purchase and their unpaid drafts are deleted after 30 days of inactivity.
  • Photos are additionally subject to the selected retention period; a shorter period takes precedence.
  • Purchased books remain available until deletion. Legally required order and invoice records are handled separately in accordance with the applicable retention obligations.

6. Disclosure of Data

We do not sell your personal data. Data is disclosed only in the following cases:

  • Stripe, Inc. (payment processing), as a processor under a data processing agreement.
  • Cloud infrastructure providers for hosting and storage, with GDPR-compliant data processing agreements.
  • Email service providers, exclusively for transactional and, where consented, marketing emails.
  • Authorities, when required by law, by court order or to protect our rights.

7. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA). In these cases, we ensure appropriate safeguards under Chapter V GDPR, e.g. through Standard Contractual Clauses (SCC) of the European Commission or adequacy decisions.

Stripe, Inc. is certified under the EU–US Data Privacy Framework. Details are available at https://stripe.com/privacy.

8. Your Rights as a Data Subject

As a data subject, you have the following rights under the GDPR:

  • Right of access (Art. 15 GDPR): You may request a copy of the data stored about you.
  • Right to rectification (Art. 16 GDPR): You may request correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17 GDPR): You may request deletion of your data where the legal basis for processing no longer applies.
  • Right to restriction of processing (Art. 18 GDPR): You may request that we restrict the processing of your data in certain circumstances.
  • Right to data portability (Art. 20 GDPR): You may request your data in a structured, machine-readable format.
  • Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests, including profiling and direct marketing.
  • Right of withdrawal (Art. 7(3) GDPR): Consent given may be withdrawn at any time with effect for the future.
  • Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority.

9. Supervisory Authority

You have the right to lodge a complaint with the competent data protection supervisory authority. The competent supervisory authority for Berlin is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit Mahlsdorfer Str. 126 12555 Berlin Germany Website: https://www.datenschutz-berlin.de Email: mailbox@datenschutz-berlin.de

10. Cookies

Our website uses cookies. Detailed information on the cookies we use, their purposes and how to manage your preferences can be found in our Cookie Policy.

11. Data Security

We protect access through email confirmation, short-lived single-use codes and links, TLS and access controls. New customers do not need a password. Do not forward sign-in links or codes. Codes and links are stored on the server only as cryptographic verification values.

12. Privacy of Minors

The service is aimed at adult purchasers. For personalized books, photos and information about children may also be processed. Purchasers must be authorized to use them. Requirements for photo consents, service providers and deletion are explained separately and reviewed before public launch.

13. Changes to This Policy

Material changes to this policy will be communicated transparently. Continued use does not constitute blanket consent to new processing purposes.

14. Contact

Verified contact details for exercising your rights will be provided here before public launch.