Privacy Policy

ONFYRE

Last updated: February 2026

1. Data Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection legislation is:

appnormal GmbH

Silberbachstraße 9L

65232 Taunusstein, Germany

Represented by: Jan Kuntscher, Philip Feldmann

Email: support@onfyre.atlassian.net

The appointment of a Data Protection Officer is not legally required, as fewer than 20 persons are regularly engaged in the automated processing of personal data (§ 38 BDSG).

2. Overview of Data Processing

ONFYRE is a web-based link-in-bio platform that enables users to create personalised landing pages with links, images and videos. This Privacy Policy informs you about which personal data we collect, for what purposes, on what legal basis and what rights you have.

We process personal data on the basis of the following legal grounds:

a) Art. 6(1)(a) GDPR (Consent): Where you have given us consent to process personal data.

b) Art. 6(1)(b) GDPR (Performance of a contract): Where the processing is necessary for the performance of a contract with you or for the implementation of pre-contractual measures.

c) Art. 6(1)(c) GDPR (Legal obligation): Where the processing is necessary for compliance with a legal obligation.

d) Art. 6(1)(f) GDPR (Legitimate interests): Where the processing is necessary for the purposes of our legitimate interests or those of a third party, provided that your interests or fundamental rights and freedoms do not override.

4. Registration and User Account

4.1 Registration via Email

For registration and login on our Platform, we collect your email address. Login is passwordless: for authentication, you receive a one-time password (OTP) sent to your email address. No permanent password is collected or stored.

Purpose: Creation and management of your user account, authentication via one-time password, communication with you.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Retention period: Until deletion of your user account. After account deletion, your data will be completely deleted within 90 days, unless statutory retention obligations require otherwise.

4.2 Social Login (Google, Apple)

You have the option to sign in to ONFYRE using your Google or Apple account. In doing so, the following data is transmitted to us by the respective provider:

  • Name

  • Email address

  • Profile picture (if available and shared)

  • Unique user ID of the respective provider

Purpose: Simplified registration and login.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) in conjunction with your consent to the social login provider.

We do not receive access to your Google or Apple password. For further information on data processing by these providers, please refer to their privacy policies:

5. User-Generated Content

When you create an ONFYRE page, you may upload and publish links, images and videos. This content is publicly accessible via the internet.

Purpose: Provision of Platform features in accordance with the Terms and Conditions.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Note: Please be aware that the content you post is publicly accessible. Do not post personal data of third parties without their consent. You are solely responsible for the lawfulness of the content you publish.

6. AI-Assisted Page Import

Our Platform offers an import feature that lets you automatically convert an existing publicly accessible page (e.g. a Linktree page) into an ONFYRE page. When you use this feature, we retrieve the public page you specify and process its contents using an AI service in order to create an ONFYRE page from it.

The processing by the AI model is carried out via Anthropic, PBC (San Francisco, CA, USA), integrated through the Vercel AI Gateway. The imported page contents may contain personal data (e.g. names, profile pictures, social media links).

Purpose: Automated creation of your ONFYRE page from a source you specify.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Where data is transferred to the USA, this is done on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The AI processing serves solely to create your page; the contents are not used to train AI models.

7. Visitor Statistics (Unique Visitors)

To provide visitor statistics to our users, we collect the following data from visitors to ONFYRE pages:

We compute a short-lived hash value from technical data (e.g. IP address and user agent) in order to count the number of unique visitors per day. This hash value is discarded daily and cannot be traced back to individuals. No IP addresses or other personally identifiable data are stored permanently.

Purpose: Provision of anonymised visitor statistics for Platform users.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest lies in providing a functional service to our users.

Retention period: The hash value is discarded at the end of each day and is not stored permanently.

8. Cookies and Tracking

The public ONFYRE pages do not use analytics cookies or third-party tracking technologies. No advertising cookies are set.

Where technically necessary cookies are used to maintain user sessions (session cookies) or for authentication in the logged-in area, this is done on the basis of Art. 6(1)(f) GDPR (legitimate interest) and § 25(2) No. 2 TDDDG (technical necessity). These cookies are automatically deleted at the end of the session or upon expiry.

9. Product Analytics in the Logged-In Area (PostHog)

In the logged-in area of our Platform (user dashboard), we use PostHog for product analytics in order to understand how our features are used and to improve the Platform. PostHog is used exclusively in the logged-in area and not on the public ONFYRE pages.

The provider is PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. Data processing takes place on servers within the EU (region EU – Frankfurt).

The data collected includes in particular: interactions with the dashboard (e.g. pages viewed, features used, clicks), device and browser information, and a pseudonymous user identifier.

Purpose: Analysis and improvement of Platform features and error detection.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving our Platform) or, where consent is required for this, Art. 6(1)(a) GDPR.

PostHog Privacy Policy: https://posthog.com/privacy

Where data is transferred to the USA, this is done on the basis of the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

10. Payment Processing via Stripe

For the processing of payments under the Pro Plan and for shop features, we use the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.

When processing payments, your payment data (e.g. credit card number, bank details) is collected and processed directly by Stripe. We do not have access to complete payment data. We only receive confirmation of the payment transaction from Stripe and, where applicable, the last four digits of your credit card and the expiry date for display in your user account.

Stripe may collect technical data for fraud detection and prevention (Stripe Radar), including IP address, browser information and device data.

Purpose: Secure processing of payments and fraud detection.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) for payment processing; Art. 6(1)(f) GDPR (legitimate interest) for fraud detection.

Stripe Privacy Policy: https://stripe.com/privacy

Stripe is certified under the EU-U.S. Data Privacy Framework. Where data is transferred to the USA, this is done on the basis of an adequacy decision by the European Commission pursuant to Art. 45 GDPR and/or Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

11. Hosting

Our Platform is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA (hereinafter “Vercel”).

Each time our Platform is accessed, technical access data is automatically collected by Vercel (so-called server log files). This may include: the page accessed, date and time of access, volume of data transferred, notification of successful retrieval, browser type and version, operating system, referrer URL and the requesting IP address.

Purpose: Provision and technical operation of the Platform.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of the Platform).

We have entered into a Data Processing Agreement (DPA) with Vercel. Data processing takes place on servers within the European Union (region EU – Frankfurt). Where data is transferred to the USA, this is done on the basis of the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

Vercel Privacy Policy: https://vercel.com/legal/privacy-policy

12. Email Communications

For the delivery of transactional emails (e.g. one-time password for login, registration confirmation, account notifications) we use Amazon Simple Email Service (Amazon SES), a service provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg.

Your email address and the content of the respective email are transmitted to Amazon SES for this purpose.

Purpose: Reliable delivery of transactional emails for the performance of the contract.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

AWS Privacy Policy: https://aws.amazon.com/privacy/

Processing takes place on servers within the EU (region EU – Frankfurt). AWS is certified under the EU-U.S. Data Privacy Framework. Where data is transferred to the USA, this is done on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

Should we in the future use an additional email service for marketing emails, we will update this Privacy Policy accordingly. You will only receive marketing emails with your express consent (Art. 6(1)(a) GDPR).

13. Third-Party Integrations

The Platform may offer integrations with third-party services (e.g. social media platforms, analytics tools, shop systems) now or in the future. If such integrations are activated, we will inform you in this Privacy Policy or through separate notices on the Platform about the associated data processing.

When you as a user activate third-party integrations, data may be transmitted to the respective third-party provider. Responsibility for data processing by the third-party provider lies with that provider. We recommend that you read the privacy policy of the respective third-party provider before activating an integration.

14. Data Transfers to Third Countries

Your data is generally processed on servers within the European Union. To provide our service, we engage various categories of processors, in particular hosting providers, video and media processing providers, email delivery providers and payment service providers. An up-to-date list of the processors engaged is available at onfy.re/subprocessors. Where we use service providers based outside the EU/EEA (e.g. Stripe, Vercel, Google, Apple), we ensure that an adequate level of data protection is maintained. This is achieved in particular through:

a) Adequacy decisions by the European Commission pursuant to Art. 45 GDPR (e.g. EU-U.S. Data Privacy Framework),

b) Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR,

c) or other appropriate safeguards pursuant to Art. 46 GDPR.

15. Your Rights as a Data Subject

You have the following rights under the GDPR:

a) Right of access (Art. 15 GDPR): You have the right to obtain information free of charge as to whether and which personal data we process about you.

b) Right to rectification (Art. 16 GDPR): You have the right to request the rectification of inaccurate personal data or the completion of incomplete personal data.

c) Right to erasure (Art. 17 GDPR): You have the right to request the erasure of your personal data, provided the legal requirements are met.

d) Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your personal data.

e) Right to data portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit such data to another controller.

f) Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on Art. 6(1)(f) GDPR. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms.

g) Right to withdraw consent (Art. 7(3) GDPR): Where you have given consent to data processing, you may withdraw such consent at any time with effect for the future. The lawfulness of the processing carried out on the basis of the consent until withdrawal remains unaffected.

h) Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

The supervisory authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit

(Hessian Commissioner for Data Protection and Freedom of Information)

Gustav-Stresemann-Ring 1

65189 Wiesbaden, Germany

Phone: +49 611 1408-0

Email: poststelle@datenschutz.hessen.de

To exercise your rights, you may contact us at any time at: support@onfyre.atlassian.net

16. Retention Periods

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention obligations.

User account data: Until deletion of the user account. After account deletion, data will be completely deleted within 90 days.

Payment data: In accordance with statutory commercial and tax law retention periods (generally 6 or 10 years pursuant to § 257 HGB, § 147 AO).

Server logs (Vercel): In accordance with Vercel’s retention policies; typically short-term.

Unique visitor hash: Discarded daily.

17. Data Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. These include, among others:

  • Encryption of data in transit using TLS/SSL

  • Passwordless authentication using time-limited one-time passwords (OTP)

  • Regular security updates and reviews

  • Access control and the principle of least privilege

Despite these measures, we cannot guarantee absolute security, as no method of transmission over the internet or method of electronic storage is 100% secure.

18. Minors

Use of the Platform is permitted for persons aged 16 and over. Persons between 16 and 18 years of age require the consent of a legal guardian. We do not knowingly collect personal data from children under 16. If we become aware that a child under 16 has submitted personal data to us, we will delete such data without undue delay.

19. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy as necessary to reflect changes in legal requirements or changes to our services or data processing practices. The current version is always available on the Platform. Material changes will be communicated to you in an appropriate manner (e.g. by email or through a notice on the Platform).