RepDB
Privacy Policy
Last updated: 2026-07-17
1. Controller
Sergei Argutin, Regener Str. 51, 10318 Berlin, Germany. Contact: support@repdb.co (see Impressum).
2. What we process
When you buy a RepDB bundle we process your email address, name, and billing country (for VAT), together with order and license details (public order number, tier, license version, amount, currency, timestamps). We keep a record of your order (including your email address, your name, and the public order number, as the licensee record for license administration) to validate downloads, resend links, and administer your license. If you use the resend form, we process the email address you enter to look up your order and trigger a new download email (sent by Lemon Squeezy); to prevent abuse, resend requests are rate-limited for a short period. Browsing the site requires no account and no login. If you opt in on the blog page, we additionally process your email address together with a record of your consent, in order to send you occasional product-update emails; you can unsubscribe at any time (email support@repdb.co).
3. Legal basis
We process this data to deliver your purchase and license under Art. 6(1)(b) GDPR (performance of a contract), and we retain invoices/records under Art. 6(1)(c) GDPR (legal obligation under German tax law). Server and access logs (incl. IP addresses) that our hosting provider processes to operate and secure the site rely on Art. 6(1)(f) GDPR (legitimate interest). Sending product-update emails to subscribers relies on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future.
4. Recipients & processors
- Lemon Squeezy (Lemon Squeezy LLC) — our Merchant of Record. As seller of record it is an independent controller for the purchase (not our processor): it runs the checkout, takes payment, handles VAT and invoicing, and sends the purchase confirmation / download email. It receives your name, email address, and billing country. See its privacy policy.
- Cloudflare (Cloudflare, Inc.) — hosts this website, the image CDN (cdn.repdb.co), the download delivery, and our order records (incl. your email address, name, and public order number), and processes server/access logs (including IP addresses) to deliver and secure the site. Cloudflare acts as our processor under a data processing agreement (Art. 28 GDPR). See its privacy policy.
- Buttondown (Buttondown, LLC) — our email newsletter provider. If you opt in for product-update emails, your email address is processed by Buttondown to send the confirmation email and subsequent updates, as our processor. See its privacy policy.
- Google (Google Ireland Ltd.) — our advertising platform. It receives the conversion measurement data described in section 5 (ad click identifier, purchase value, and — only with your consent — a hashed email address). Google acts as an independent controller for this data. See its privacy policy.
We do not sell your data. We use it for advertising only in the narrow sense described in section 5: measuring whether our own ads led to a purchase. We do not build advertising profiles and do not use your data to target ads at you.
5. Cookies & analytics
Cloudflare Web Analytics. For aggregated, privacy-first usage statistics we use Cloudflare Web Analytics, which is cookieless: it sets no cookies, stores or reads nothing on your device, does not fingerprint you, and does not track you across other sites. It collects only aggregated metrics (such as page URL, referrer, country, browser and device type, and page-load performance) and no information that identifies you personally. Because it stores nothing on your device, it needs no consent; this processing relies on our legitimate interest in understanding and improving how the site is used (Art. 6(1)(f) GDPR). Cloudflare acts as our processor (see section 4).
Google Ads conversion measurement. We advertise on Google Ads and need to know which ads lead to purchases. We use no advertising profiles, no remarketing, no ad personalisation and no cross-site tracking, and we do not sell your data. Three separate things are involved, with different legal bases:
- Server-side reporting — no cookies, always active. If you arrive from a Google ad, the ad click identifier (
gclid,gbraidorwbraid) is carried in the page URL only; it is never stored on your device. If you buy, we store it with your order record and report the purchase to Google Ads from our server. Legal basis: legitimate interest in measuring our advertising (Art. 6(1)(f) GDPR). - The Google tag — loads for every visitor, no cookies by default. Google's tag (
gtag.js, provided by Google Ireland Ltd.) loads on every page regardless of your choice below. Unless you consent it sets and reads no cookies. On most pages it sends only limited, non-identifying signals to Google (timestamp, browser/user-agent, referrer, your consent state, and the page address; query parameters are removed from the page address before it is sent, except a Google Ads click identifier if one is present). On the order confirmation page it additionally sends a cookieless conversion signal telling Google that a purchase occurred, together with the purchase value and currency and a SHA-256 hash derived from your order reference (so Google can recognise repeat reports of the same purchase). This purchase signal is sent with or without your consent; even so, no cookies are set and your email address and the download link for your order are never transmitted. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). - Only with your consent — cookies and enhanced conversions. If you accept in the cookie banner, two additional things happen. First, the tag sets the first-party cookies below on our domain to link a later purchase back to your ad click. Second, on the order confirmation page it transmits a SHA-256 hash of your (normalised) email address to improve conversion matching. Your email address is never transmitted in readable form — only as that hash — and it is sent only if you consent. Legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future via “Cookie settings” in the footer.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
_gcl_au | Stores the ad click identifier so a later purchase can be attributed to the ad you clicked. | 90 days | |
_gcl_aw | Stores the ad click identifier for conversion measurement after an ad click. | 90 days |
These cookies are set only after you accept, and only on our own domain (first-party). Your choice is stored locally in your browser so we do not ask again; it is not sent to or stored on our servers.
6. Retention
Invoice and order records are kept for the statutory retention period under German tax law (8 years for invoices/accounting records since 2025, up to 10 years for other records; § 147 AO). Personal data not subject to a retention obligation is deleted once it is no longer needed. Newsletter opt-in data is kept until you unsubscribe.
7. Your rights (GDPR)
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). To exercise them, email support@repdb.co. You may also lodge a complaint with a supervisory authority — for Berlin, the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
8. International transfers
Some recipients (e.g. Lemon Squeezy, a US company) may process data outside the EU/EEA; such transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
9. Contact
Data-protection questions: support@repdb.co.