Privacy Policy

Last updated: 17 October 2026

1. Controller

The controller for the processing of personal data in connection with the website, communications, contract management, billing and own business processes is:

Yevgen Yeshchenko
Im Egerten 7/1
74391 Erligheim
Germany
Phone: +49 1575 765 86 22
Email: info@phasi.app

2. Scope

This Privacy Policy applies to the website and SaaS service phasi.app as well as communications, inquiries, pilot access, orders, invoices, support and other business contacts with the Provider.

3. Data Protection Roles

3.1 Where the Provider processes personal data for its own purposes, in particular for website operation, communications, contracting, invoices, payment administration, support, security and legal obligations, the Provider acts as controller.

3.2 Where the Customer enters personal data into the Service and the Provider processes such data on behalf of the Customer to provide the Service, the Customer acts as controller and the Provider acts as processor. In this case, the Data Processing Agreement also applies.

4. Categories of personal data and storage locations

For customer administration, the Provider stores the administrator's name and email address and necessary contract, invoice and payment data on the Provider's local computer. This also includes information voluntarily supplied in inquiries, such as company, employee count, contact name and message.

The website processes forms for forwarding by email and does not maintain its own inquiry database. Messages are delivered through Cloudflare to the Provider's mailbox hosted by STRATO. Emails remain in the mailbox and, where applicable, local copies until deleted for the relevant purpose or upon expiry of retention periods.

Each customer company has a separate VPS at STRATO in Europe. The SaaS may also process user accounts, roles, project assignments, comments and other personal data entered by the Customer. Technical connection, access and security data may arise from website operation, hosting, email delivery and spam prevention. Limiting local customer administration to administrator contact and billing data does not mean that the SaaS processes only those data.

5. Purposes and legal bases

Inquiries, setup and operation of the free three-month pilot project and paid contracts are processed for pre-contractual steps and contract performance (Article 6(1)(b) GDPR where the data subject is a contracting party). Communication with company employees and contacts, and website operation and security, are based on legitimate interests in business communication and a secure service (Article 6(1)(f) GDPR). Statutory documentation and retention duties rely on Article 6(1)(c) GDPR. Optional YouTube embeds rely on your consent (Article 6(1)(a) GDPR).

Required contact and company details are needed to answer inquiries and arrange pilot access or an offer. Optional fields are marked. There is no automated decision on entering into a contract.

6. Customer Content and Special Data

The Service is intended for business data. The Customer should not enter special categories of personal data, health data, criminal conviction data, children's data or other highly sensitive personal data into the Service unless expressly agreed in advance.

7. Recipients and service providers

STRATO: hosting of SaaS customer environments on separate VPS instances in Europe and hosting of the email mailbox.
Cloudflare: delivery and protection of the public website, processing and delivery of form inquiries, and email forwarding. Cloudflare Turnstile processes technical information to detect automated or abusive access. Daily SaaS backups are additionally stored in Cloudflare R2 with European Union (EU) jurisdiction selected for one month. Age encryption before upload is implemented and tested according to the Provider.
Google / YouTube: playback of embedded videos only after consent and selection of a video. Preview images are hosted locally on the website.
Banks and, where applicable, legally authorized recipients receive data necessary for payment or statutory obligations.

Customer administration takes place locally at the Provider. Service providers receive data for their respective tasks. The privacy roles for website visits and customer communications are distinct from processing productive SaaS Customer Data on behalf of customers.

8. International processing

SaaS VPS instances operate in Europe. This does not mean that all website and communications processing takes place exclusively there. Cloudflare and Google in particular operate international infrastructures; processing outside the EEA may occur. Where required, the conditions of Articles 44 et seq. GDPR must be met. Information about specific recipients and transfer grounds, and copies of safeguards where applicable, may be requested at info@phasi.app.

9. Retention and end of the pilot project

Inquiry and communication data are retained for handling and necessary follow-up. Contract and billing records are retained for the applicable statutory periods and then deleted unless another lawful purpose remains.

The free pilot project ends after three months at the latest or earlier upon notice by either party. It does not renew automatically. Return or deletion of personal SaaS Customer Data follows the DPA and the Customer's documented instructions. Handover, retrieval and deletion are handled separately under the DPA and Section 26 of the Terms; automatic deletion 30 days after termination is not intended. Backup download and import into PHASI are available according to the Provider. Format, scope and retrieval after access ends are recorded for the order; the file is not readable without PHASI. Local billing records and business correspondence are treated separately.

According to the Provider, STRATO VPS data is backed up daily to Cloudflare R2, European Union (EU) jurisdiction, and retained for one month. Archives including the database and configuration are encrypted before upload using age and a separate PHASI key. The Provider successfully tested encryption and recovery from an encrypted R2 archive. No local SaaS backup copies exist; the private key is kept locally with a backup on USB. According to the Provider, deletion after one month and targeted earlier deletion of individual customer backups are configured. Earlier deletion duties remain controlling.

10. Cookies, browser storage and videos

The public website uses local browser storage for language, appearance and privacy choices. Analytics and advertising scripts are not enabled. YouTube players load only after consent and video selection, transmitting connection data to Google. Consent may be withdrawn at any time through “Privacy settings” in the footer with effect for the future. Cloudflare Turnstile protects forms against spam and is separate from the optional YouTube choice. Further details are provided in the Cookie Policy.

11. Security

According to the Provider, HTTPS, a firewall and operating system updates are configured for the SaaS environments. Customer companies receive separate VPS instances. STRATO reports ISO/IEC 27001 certification of its information security management system; this is not a PHASI certification or a guarantee against data loss.

Backups are encrypted before upload; recovery from an encrypted R2 archive is tested according to the Provider. Administrative access on the PHASI side is restricted to the Provider. Its own technical logs are retained for one month. Statutory protection duties also apply during the free pilot.

12. Rights of Data Subjects

Data subjects have, subject to statutory requirements, rights of access, rectification, erasure, restriction of processing, data portability, objection to certain processing and withdrawal of consent with future effect.

Requests can be sent to info@phasi.app.

13. Right to Lodge a Complaint

Data subjects have the right to lodge a complaint with a competent data protection supervisory authority if they believe that the processing of their personal data violates data protection law.

14. Changes

The Provider may update this Privacy Policy if the Service, data processing, service providers or legal requirements change.