Imprint and privacy.
Legal information for the awedit platform, operated under the sumthink brand by Die Quadratur UG (haftungsbeschränkt).
Last updated: 6 July 2026
This English translation is provided for convenience. In case of any discrepancy, the German version on this page prevails.
Imprint
Information pursuant to § 5 DDG (German Digital Services Act)
Die Quadratur UG (haftungsbeschränkt)
Sierichstraße 120
22299 Hamburg
Deutschland
Commercial register
Amtsgericht Hamburg, HRB 169218
Represented by
Managing Director: Christian Durlej
Contact
Responsible for content pursuant to § 18 (2) MStV
Christian Durlej, address as above
Consumer dispute resolution under § 36 VSBG
We are neither obliged nor willing to participate in dispute resolution proceedings before a consumer arbitration board (§ 36 (1) no. 1 VSBG).
Liability for content
The contents of these pages have been prepared with the greatest possible care. However, we assume no liability for the accuracy, completeness or timeliness of the content. As a service provider, we are responsible for our own content on these pages under § 7 (1) DDG in accordance with general laws. Under §§ 8 to 10 DDG, however, we are not obliged to monitor transmitted or stored third-party information or to investigate circumstances indicating unlawful activity. Content will be removed without delay as soon as we become aware of any legal violation.
Liability for links
Our offer contains links to external websites of third parties over whose content we have no influence. The respective provider or operator of the linked pages is always responsible for their content. Permanent monitoring of the content of linked pages is not reasonable without concrete evidence of a legal violation. Such links will be removed without delay if legal violations become known.
Copyright
The content and works on these pages created by the site operators are subject to German copyright law. Duplication, processing, distribution and any form of exploitation beyond the limits of copyright law require the written consent of the respective author or creator.
Privacy notice
Controller in the sense of the GDPR
Die Quadratur UG (haftungsbeschränkt), Sierichstraße 120, 22299 Hamburg, Deutschland. Represented by Christian Durlej. Email: info@die-quadratur.de.
Data protection contact
For data protection questions you can reach Christian Durlej at info@die-quadratur.de. There is currently no legal obligation to appoint a formal Data Protection Officer; as soon as such an obligation applies, we will appoint a qualified person and update this notice without delay.
Scope
This notice explains how, why and to what extent we process personal data on awedit.ai and the related application. External services we link to are governed by their own privacy notices.
Legal bases
We only process personal data on one of the following legal bases under the GDPR:
- Art. 6 (1) (a) GDPR (consent), e.g. voluntary sign-up for the sample report.
- Art. 6 (1) (b) GDPR (contract), e.g. use of the customer workspace and scanner after sign-up.
- Art. 6 (1) (c) GDPR (legal obligation), e.g. retention duties under commercial and tax law.
- Art. 6 (1) (f) GDPR (legitimate interest), e.g. secure operation, abuse prevention and provision of our content.
Processing activities in detail
We only use carefully selected processors. Data processing agreements under Art. 28 GDPR are in place with all of them. Processing takes place primarily within the European Union.
Hosting and delivery (Cloudflare Workers via Lovable)
The website is delivered through the edge infrastructure of Cloudflare, Inc. (provided via Lovable). Each request generates server logs containing your IP address, request time, requested URL, referer and user agent. Legal basis: Art. 6 (1) (f) GDPR (secure operation, abuse prevention). Logs are deleted or anonymised shortly after collection. A data processing agreement is in place; transfers to the United States are based on the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) and on Standard Contractual Clauses issued by the European Commission.
Application backend and storage (Lovable Cloud / Supabase, EU)
For authentication, database, file storage and application logic we use Lovable Cloud, powered by Supabase, hosted in the European Union (Frankfurt). We process your account and profile data, uploaded artifacts, self-check answers and generated findings and reports. Legal basis: Art. 6 (1) (b) GDPR (performance of contract) or Art. 6 (1) (f) GDPR (provision of the application). A data processing agreement is in place.
Fonts (self-hosted, no Google Fonts)
The „Alexandria“ and „JetBrains Mono“ web fonts are served locally from our own server. There is no connection to Google, no IP address is transmitted to fonts.googleapis.com or fonts.gstatic.com, and no cookies are set. Legal basis: Art. 6 (1) (f) GDPR (consistent and accessible presentation of our content).
First-party usage measurement (funnel events)
To improve the product we record anonymous funnel events, meaning interactions with individual pages and steps of our checks, in our own backend (Supabase, table funnel_events). No cookies are set, no cross-device tracking takes place, and no data is shared with third parties. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in developing our offering in line with actual use).
Website Scan
For the website scan we fetch the address you enter once, server side. We only retrieve publicly served pages and the legal pages linked from them. No JavaScript is executed and no protected area is accessed. We store a scan record containing the domain, the timestamp and the findings, not the full path you entered. Your IP address is stored as a hash only, to limit the number of scans per hour. If you request the report or the fix list, we store your email address (table scan_leads) in order to provide the report and, only with your active consent, to follow up on this scan. Legal basis: Art. 6 (1) (f) GDPR (provision of the service and abuse prevention) and Art. 6 (1) (a) GDPR for the email address. Deletion at any time on request to info@die-quadratur.de.
Usage analytics (Lovable Analytics, cookieless)
We use the privacy-friendly analytics feature of our hosting provider. No cookies are set, no IP addresses are stored, and no cross-device tracking takes place. Only aggregated metrics such as page views and referring domain are collected. Legal basis: Art. 6 (1) (f) GDPR (needs-based design of our content).
Contact by email
When you contact us by email at info@die-quadratur.de, your information is stored to handle the request and any follow-up questions. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (answering your enquiry).
Self-check and sample report sign-up
The free self-check only collects the answers you actively enter and, optionally, your email address if you want to receive the result or the sample report by email. Consent is given by actively submitting the form and can be revoked at any time with effect for the future. Legal basis: Art. 6 (1) (a) GDPR. Without an email address, your result never leaves your browser in a form that can be linked back to you.
Retention
We store personal data only as long as necessary for the stated purposes or as required by statutory retention obligations (in particular under the German Commercial Code and Fiscal Code). Account and project data is deleted no later than 90 days after termination of the contract, unless retention obligations require otherwise.
Transfers to third countries
Personal data is transferred to third countries outside the EU/EEA only where necessary to provide the service (in particular Cloudflare). Such transfers are based on an adequacy decision (EU-US Data Privacy Framework) or on Standard Contractual Clauses under Art. 46 (2) (c) GDPR.
Your rights
As a data subject you have the following rights against the controller:
- Access to the data we hold about you (Art. 15 GDPR).
- Rectification of inaccurate data (Art. 16 GDPR).
- Erasure of your data (Art. 17 GDPR).
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR).
- Objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR).
- Withdrawal of consent with effect for the future (Art. 7 (3) GDPR).
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, mailbox@datenschutz.hamburg.de.
Technical and organisational measures
We implement technical and organisational measures under Art. 32 GDPR, in particular transport-layer encryption (TLS), encryption at rest at the backend provider, role-based access control (Row Level Security), two-factor options and regular review of access rights. These measures are continuously aligned with the state of the art.
No automated decision-making
No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place. Findings from the self-check and scanner are orientation values; final review and release is always done by qualified people.
Changes to this notice
We update this privacy notice when our processing activities or the legal framework change. The current version, together with its date, is always available on this page.