Built for trust
Get it for macOSGet it

Privacy Policy

This is an English translation of the German privacy policy (Datenschutzerklärung). It is governed by German and EU law (GDPR); the German version is authoritative.

Data controller

Adnan Dikmen, sole proprietor (Tegmaguard)
Reuterstraße 46
12047 Berlin
Germany
Telephone: +49 176 70150706
Email: info@tegmaguard.com

This website

This website consists of static pages. It does not load any content from third-party servers (no external fonts, no analytics, no third-party embeds) and does not set any cookies. Apart from the technical access data processed by the host (next section), it only processes personal data when you request a trial, buy a license or cancel a contract through the website. These cases are described below.

Hosting and server log files

The website and its server functions are run on Vercel. When you open a page, Vercel automatically processes technical access data (including IP address, date/time of access, page requested, browser used), as is technically necessary to operate any web server. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the site). This data is not merged with other data sources and is not analysed for advertising purposes. Error messages from the server functions are stored in Vercel's log.

Storage in your browser

The website sets no cookies and creates no entries in your browser's local storage.

Requesting a trial

For the 30-day trial you enter your email address in the form on the homepage and, if you wish, the name of your firm, practice or company or your own name. The form also sends the language of the page and the selected operating system (macOS or Windows); both only determine the wording of the email.

A server function on Vercel uses this to create a digitally signed license file. The optional name appears in this file and in the greeting of the email. The file is sent to your address via the email service Resend. No customer account is created. To prevent several trials being issued for the same address, your email address may additionally be stored in a contact list at Resend that later requests are checked against. There is currently no automatic deletion for this contact list. On request to the email address above, I will delete your entry. The trial license file stays with you; it expires after 30 days.

The purpose is to provide the trial. The legal basis is Art. 6(1)(b) GDPR; for checking against earlier requests, Art. 6(1)(f) GDPR (legitimate interest in preventing repeated use of the free trial). Recipients are Vercel (running the server function) and Resend (sending the email). Without an email address no trial can be sent.

Purchase via Stripe

When you buy a license on the homepage, the website sends only the selected number of seats, the billing interval (monthly or annual), the language, your company name and your confirmation that you are ordering as a business and accept the terms to a server function on Vercel. Stripe stores this confirmation, with the time and the version of the text, in the data of the checkout and of the subscription. It serves as proof of the business confirmation: it shows that the order was placed as a business (§ 14 BGB) and that the terms were included. The function uses this to create a checkout with the payment provider Stripe and forwards you to a Stripe payment page.

There you enter your email address, your name, your billing address, your company name, your VAT identification number (VAT ID) and your payment details directly with Stripe. Payment details such as card numbers do not pass through this website. Stripe processes the payment and the subscription and issues the invoices. Processing on the payment page is additionally subject to Stripe's privacy policy.

To calculate value added tax, Stripe uses your billing address and, if given, your VAT ID (Stripe Tax). Stripe checks a VAT ID you give through the EU's VAT Information Exchange System (VIES). The legal basis is Art. 6(1)(c) GDPR in conjunction with the obligations under VAT law.

After every successful payment, including renewals, Stripe transmits the invoice data (including email address, name and billing address) to a server function on Vercel. The function additionally asks Stripe for the number of seats and the term, creates the license file with the name or company name, seats and term, and sends it to your email address via Resend. After the first payment, this email also contains the contract confirmation with the order details, the terms and a note that you ordered as a business.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract), for keeping invoices and accounting records Art. 6(1)(c) GDPR in conjunction with the retention obligations under commercial and tax law, and for the proof of the business confirmation Art. 6(1)(f) GDPR (legitimate interest in being able to prove that only businesses ordered and that the terms were included). Recipients are Stripe (payment processing and invoices), Vercel (server functions) and Resend (sending the license file). A purchase is not possible without these details.

Stripe's privacy notice describes which role Stripe has in each processing step (as a controller in its own right or processing on my behalf). I keep invoices and accounting records for as long as commercial and tax law requires, currently up to ten years (Section 147 AO, Section 257 HGB).

Cancellation via the website

If you cancel through the page “Cancel contracts here”, the website sends the type of cancellation, the reason (if given), your company, the email address of the order, the invoice number, the requested date and the language of the page to a server function on Vercel. The function checks at Stripe (read access) whether company, email address and invoice number belong to exactly one running contract; the only thing written in this step is the time of the link sent, as a subscription metadata entry (cancel_link_sent_at). Only then is a confirmation link sent via Resend to the address of the order stored at Stripe, never to an address typed into the form and without a copy to anyone else. The browser receives the same answer in every case. By clicking the link (valid for seven days) you file the cancellation; I then apply it at Stripe and send the confirmation with the date and time of receipt and of the confirmation to the same stored address. A notice of the cancellation goes to my mailbox at IONOS. Once you confirm, the receipt and the confirmation are stored as timestamps in the metadata of your subscription at Stripe, also when the cancellation is processed manually, as is the time of the last link sent (at most one link per subscription in 15 minutes). The confirmation token is signed and contains subscription and customer identifiers, the type, the date, your reason (if given) and the invoice number; it is not stored in a database. The purpose is to receive, confirm and implement your cancellation and to prevent abuse. The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (protection against abuse). Recipients are Vercel, Stripe, Resend and IONOS. I keep the cancellation records until the regular limitation period has expired (three years from the end of the year of the cancellation), unless a longer statutory retention obligation applies.

Contact by email

If you contact me by email, your information will be stored to process the request and for any follow-up questions. The legal basis is Art. 6(1)(b) or (f) GDPR. The tegmaguard.com mailboxes are hosted by IONOS; incoming emails are received and stored there. Your information is not passed on to any other third parties.

The Tegmaguard application itself

The Tegmaguard application runs locally on your computer (macOS or Windows). It stores your cases, the mapping between real details and replacement values, and your settings on your device. There is no Tegmaguard server that your input passes through or is stored on; I do not receive your input. The app checks the license on your device, with no account and no online activation.

If you use a cloud AI provider (Anthropic, OpenAI, Google or Mistral AI), the app first replaces the personal details it detects with replacement values and then sends the text directly from your device to that provider, using your own API key. This connection does not go through Tegmaguard servers. You conclude the contract with the provider yourself, and its terms apply. Detection can miss details; this is why, by default, the app shows a preview of the outgoing text before sending. With a local model (Ollama) the request stays on your computer. The trust page describes which connections the app makes; the app's privacy report contains the details for a case.

Update check of the app

Every time it starts, the app asks GitHub whether a new version is available, including in local mode. GitHub receives technical connection data such as your IP address; no content from your cases or input is transmitted. By default the app downloads and installs new versions from GitHub automatically; this can be switched off in the app's settings, the check itself cannot. The purpose is to provide bug fixes and security updates. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in up-to-date and secure software). The recipient is GitHub.

Only if you trigger it in the app, Ollama downloads models from the Ollama library on the internet; Ollama receives your IP address in the process. Other connections that only happen at your request are described on the trust page. The key assistant for Mistral and Gemini opens the provider's key page in your browser when you click. Its connection test sends only a fixed test sentence to the provider with your key, no content from your cases.

Recipients and transfers to third countries

The service providers named above may also process data outside the European Union or the European Economic Area, in particular in the USA. How they handle your data and which safeguards they use for such transfers is described in their privacy policies:

Transfers to the USA rely, for service providers certified under the EU-US Data Privacy Framework, on the European Commission's adequacy decision (EU) 2023/1795 (Art. 45 GDPR), and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which the service providers include in their data processing terms. On request to the email address above, I will give you a copy of the standard contractual clauses.

Storage period

Personal data is stored only for as long as is necessary for the respective purpose. I keep invoices and accounting records for the duration of the statutory obligations, currently up to ten years. The proof of the business confirmation stays stored with the subscription at Stripe for as long as the contract data is needed for accounting and as proof, at most until the end of the statutory retention period. For cancellations, see Cancellation via the website. For the contact list for the trial, see Requesting a trial.

Your rights

Under the GDPR, you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21) regarding your personal data. You may object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. Please contact the email address above. Automated decision-making, including profiling (Art. 22 GDPR), does not take place.

Right to complain

You have the right to lodge a complaint with a data protection supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information, which is responsible for Berlin.