Last updated: October 2026. This is a translation for your convenience. In case of doubt the German version applies.
Here you can read which data we process on drillup.io, why we do so and which rights you have.
1. Controller
DrillUp, Luca Buchmann
Wolfsgraben 6
74223 Flein
Germany
Email: support@drillup.io
2. Visiting the website and server logs
The website runs on our own server in a data centre in Frankfurt am Main, Germany. We rent the server from Oracle (Oracle Deutschland B.V. & Co. KG, Riesstraße 25, 80992 Munich, Germany). A data processing agreement is in place with Oracle.
With every request the server processes technically necessary data: IP address, date and time, page requested, amount of data transferred, referring page, browser and operating system. We need this data to deliver the page, find errors and fend off attacks. Logs are deleted after 30 days at the latest.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.
3. Language and currency by location
So that you see the site in the right language and currency, we derive the country from your IP address. This happens on our own server. We store neither the IP address nor the country. We remember your selection in two cookies (see section 9). The legal basis is Art. 6(1)(f) GDPR.
4. Account
When you create an account we process your first and last name, your email address, your password (only as a non-reversible hash), your language, your plan and its term, and the prompts and projects you opened or downloaded. We need the latter for the daily limit and so that anything opened once stays open for you.
The legal basis is Art. 6(1)(b) GDPR (contract). We store this data for as long as your account exists. You can have your account deleted at any time, an email to support@drillup.io is enough. Data we must retain for tax reasons is deleted once the statutory periods have expired.
5. Orders and payment
Payment is processed by the payment service Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). You enter your payment details directly with Stripe. We ourselves neither see nor store complete card or account details. From Stripe we receive a customer number, the subscription number, amount, currency and the status of the payment.
If you choose a payment method of another provider at checkout, for example PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg) or Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden), that provider also receives the data needed for the payment.
Stripe may also process data in the USA. This is based on the EU Commission's adequacy decision for the EU-US Data Privacy Framework and on standard contractual clauses. More: stripe.com/privacy.
The legal basis is Art. 6(1)(b) GDPR. We keep invoice and accounting data for as long as tax and commercial law require (six to ten years depending on the document, Art. 6(1)(c) GDPR).
When you order we also store the time of your consent to the immediate start of the service so that we can prove it.
6. Videos and downloads
Preview videos and downloads are delivered via a content delivery network so that they load quickly everywhere. The provider is BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia. Your IP address is transmitted to the nearest server of this provider. A data processing agreement is in place. The legal basis is Art. 6(1)(b) and (f) GDPR.
7. Emails
Emails about the contract: We send you emails that are necessary for your account and your contract, for example the order confirmation, the code to reset your password, notices about a failed payment and the confirmation of a cancellation or withdrawal. The legal basis is Art. 6(1)(b) GDPR.
Tips for customers: If you bought a plan, we occasionally send tips on how to use DrillUp and notes on new content to the email address you gave. We base this on section 7(3) of the German Act Against Unfair Competition and Art. 6(1)(f) GDPR. You can object at any time without incurring any costs other than the transmission costs according to the basic rates: via the unsubscribe link in each of these emails or by email to support@drillup.io.
Tips without a purchase: If you only have an account without a plan, you receive such tips only if you consented when registering (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the unsubscribe link.
We send the emails via our mailbox at our provider for domain and email (ALL-INKL.COM, Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany). A data processing agreement is in place.
8. Forms and contact
If you write to us via a form (contact, project request, review, withdrawal, cancellation) or by email, we process your details in order to handle your request. The legal basis is Art. 6(1)(b) GDPR where a contract or its initiation is concerned, otherwise Art. 6(1)(f) GDPR. For withdrawals and cancellations we are legally obliged to confirm and document receipt (Art. 6(1)(c) GDPR). We delete requests once they are dealt with and no retention obligation applies.
9. Cookies
We set necessary cookies without consent because the site does not work without them (section 25(2) no. 2 of the German TDDDG):
- du_s: keeps you logged in. Lifetime 60 days.
- du_l: remembers your language. Lifetime 1 year.
- du_w: remembers your currency. Lifetime 30 days.
- du_c: remembers your choice in the cookie notice. Lifetime 180 days.
During payment Stripe sets its own cookies which are necessary for the payment and for fraud prevention.
We set cookies and similar technologies for analytics and marketing only if you agreed in the cookie notice (section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via "Cookie settings" at the bottom of every page. The withdrawal applies for the future.
10. Google Analytics (only with consent)
With your consent we use Google Analytics 4 to understand how the website is used. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data processed includes pages viewed, clicks, time on site, approximate location, device and browser details and an identifier in a cookie. Google Analytics 4 does not store IP addresses permanently.
Data may be transferred to Google LLC in the USA. This is based on the adequacy decision for the EU-US Data Privacy Framework and on standard contractual clauses. A data processing agreement is in place with Google. The data is deleted after 14 months. More: policies.google.com/privacy.
11. Meta Pixel (only with consent)
With your consent we use the Meta Pixel to measure the success of our ads on Facebook and Instagram and to show ads to suitable audiences. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Data processed includes IP address, device and browser details, pages viewed, events such as a purchase and identifiers in cookies.
We are jointly responsible with Meta for collecting and transmitting this data (Art. 26 GDPR). The agreement is available at facebook.com/legal/controller_addendum. Meta alone is responsible for further processing. Data may be transferred to the USA based on the EU-US Data Privacy Framework and standard contractual clauses. More: facebook.com/privacy/policy.
12. TikTok Pixel (only with consent)
With your consent we use the TikTok Pixel to measure the success of our ads on TikTok. The providers are TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited. Data processed includes IP address, device and browser details, pages viewed, events such as a purchase and identifiers in cookies.
We are jointly responsible with TikTok for collecting and transmitting the data. Data may be transferred to countries outside the EU, including the USA, Singapore and Malaysia, based on standard contractual clauses. More: tiktok.com/legal/page/eea/privacy-policy/en.
13. Links to social networks
The references to Instagram, TikTok and YouTube are simple links. Data is transferred to the respective network only when you click a link.
14. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. You can object to the processing of your data for direct marketing at any time without giving reasons.
Simply write to support@drillup.io.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, baden-wuerttemberg.datenschutz.de.
15. Obligation to provide data and automated decisions
We need the stated details for an account and an order. Without them we cannot conclude the contract. There is no automated decision-making including profiling within the meaning of Art. 22 GDPR.
16. Changes
We adapt this privacy policy when our website or the legal situation changes. The version shown here applies.