As of: June 2026 — in accordance with the GDPR
This English text is a convenience translation to aid understanding. Only the German version of this document is legally binding; in the event of any discrepancy, the German version prevails.
Contents
Mandria Labs GbR
represented by the partners Martin Dietrich and Daniel Seitz
Lachenmeyrstr. 16
81827 Munich
E-mail: info@flowpresent.org
flow present is a tool for civic education, non-profit work, and civil society. We process only as much personal data as is necessary to operate the service. Specifically:
During registration, only your e-mail address is stored. Access takes place via magic link (password-free) — no passwords are stored. Optionally, you can add a display name and a profile picture.
Art. 6(1)(b) GDPR (performance of a contract) for the provision of the service.
Account data is stored for as long as the account is active. You can delete your account yourself at any time in the settings under "Profile"; deletion takes place immediately. In doing so, your personal organizations (organizations of which you are the sole member), including the associated content and uploaded files, as well as your login account, are removed. From shared organizations with other members you are merely removed as a member. Alternatively, you can request deletion by e-mail to datenschutz@flowpresent.org. Statutory retention obligations (in particular for invoicing/billing data) remain unaffected; such data is merely blocked for the duration of the statutory periods and subsequently deleted.
Organizations and their members can create and edit extensive workshop content. Specifically, the following data is stored:
This data is accessible exclusively to the respective team and is not transmitted to third parties.
Participants in workshops can access the public live view without logging in. Survey responses (polls, scale questions, free texts, word clouds) are linked to a randomly generated key (localStorage UUID) stored on your device. As a result, the responses are pseudonymous (not anonymous), since the key can connect several responses from the same device. Free-text fields may contain personal information if you enter such information. Participants can optionally upload files via the live view; these are stored in Supabase Storage. Responsibility for processing the participant data collected in a workshop generally lies with the organization running it (the Customer); flow present processes this data on their behalf (Art. 28 GDPR).
During live operation, team members and (if enabled) participants can upload files. These files are stored in Supabase Storage in a publicly accessible bucket and can be accessed by anyone with the corresponding link.
flow present uses Supabase (Supabase Inc., San Francisco, USA) for its PostgreSQL database, authentication (magic link), file storage (Storage), and real-time functions (Realtime). Supabase is ISO 27001 certified. The data is stored on EU servers (Frankfurt, AWS eu-central-1). Supabase acts as a processor pursuant to Art. 28 GDPR; a Data Processing Agreement (DPA) is in place.
For collaborative real-time editing of the briefing, Hocuspocus (a self-hosted WebSocket server) is used in conjunction with Yjs. The server processes document changes transiently; persistence takes place exclusively in Supabase.
The application is hosted on Vercel (Vercel Inc., San Francisco, USA), likewise with EU-region routing. Vercel processes access logs (IP address, user agent, timestamp) for a maximum of 30 days.
Authentication emails (magic link, registration and password emails) are delivered via an email service provider; see Section 7 (“Email delivery”) for details.
Self-hosting option: flow present will be released as open-source software (AGPL-3.0, planned) and can then be fully self-hosted. In this case, the data protection practices of the operating organization apply.
flow present does not use any third-party cookies or tracking cookies. The following are used:
Since only technically necessary cookies are used, no cookie banner is required (Art. 5(3) ePrivacy Directive in conjunction with § 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act, formerly TTDSG)).
For paid plans, we use the payment service provider Stripe (Stripe Payments Europe, Ltd., Ireland; possibly Stripe Inc., USA). When you make a purchase, the data required for payment (e.g., name, e-mail address, payment method information) is transmitted to Stripe and processed there. Complete payment data is not stored by us. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). For transfers to the USA, Stripe relies on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. Privacy notice: stripe.com/de/privacy.
To send transactional emails — in particular the passwordless sign-in/login link (“magic link”), confirmation and notification emails, as well as team and project invitations — we use Resend (Resend, Inc., USA). In doing so, your email address and the respective email content (including any links/tokens) are transmitted to Resend and processed solely for the purpose of delivery. Emails are sent from the sender domain mail.flowpresent.org (with SPF, DKIM and DMARC). Legal basis: Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in reliable delivery). Processing takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR; for transfers to the USA, Resend relies on EU Standard Contractual Clauses. Privacy policy: resend.com/legal/privacy-policy.
When you use the optional image search, your query is transmitted to Unsplash (Unsplash Inc., USA); in doing so, your IP address may be sent to Unsplash servers. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in image selection).
To detect and fix technical errors and to ensure the stability and security of the service, we use Sentry (Functional Software, Inc., USA). If an error occurs, technical diagnostic data (e.g., error message, stack trace, affected page/URL, browser and device type, timestamp) is transmitted to Sentry. Processing takes place in Sentry's EU region (data centers in Germany/Frankfurt). The transmission of personal data such as the IP address is disabled by default; nevertheless, diagnostic data may in individual cases contain personal information. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stability and security). For any access from the USA, Sentry relies on the EU-US Data Privacy Framework or EU Standard Contractual Clauses.
To improve our service, we use PostHog (PostHog Inc., San Francisco, USA) in the EU Cloud variant. In doing so, anonymized usage data (pages visited, session duration, rough device category) is collected. PostHog does not set any cookies on this website, nor is any data stored in localStorage or sessionStorage — the data is kept exclusively in the browser's volatile memory and discarded when the tab is closed. No merging of usage data across devices or sessions takes place. Processing takes place exclusively on EU servers (Frankfurt/Germany); no transfer to the USA takes place. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing and improving the service). PostHog privacy notice: posthog.com/privacy.
All fonts are served from our own infrastructure (self-hosted, including via next/font and Fontsource). No fonts are loaded from external servers such as Google Fonts; your IP address is not transmitted to third parties for the purpose of loading fonts.
The optional live translation function uses the open-source software LibreTranslate, which we operate on our own server in Germany (EU). When used, the slide content to be translated is transmitted exclusively to this server; no transmission to an external translation service (such as Google Translate or DeepL) takes place. When self-hosting flow present, translation runs entirely within the infrastructure you operate.
The optional weather variable in slides uses the free Open-Meteo API (Open-Meteo.com, Switzerland). In doing so, the location name you enter is transmitted to Open-Meteo. No personal data is transmitted.
Under the GDPR, you have the right to:
For inquiries regarding your rights or data protection, please contact: datenschutz@flowpresent.org
We respond to requests pursuant to Art. 12 GDPR within one month.