Privacy Policy

1. Controller and scope

This notice describes the processing of personal data when you visit the Coop Blanc website or use the instance operated by Frank Dase.

Please include “Coop Blanc — Privacy” when contacting us about data protection. If another organization runs its own self-hosted instance, that operator is responsible for its deployment and its own privacy information.

2. Purposes and legal bases

We process information to provide the requested workspace, authenticate users, store and display board content, enable collaboration and guest access, respond to inquiries, and maintain service availability and security.

• Article 6(1)(b) GDPR: providing the service you request and handling contractual or pre-contractual inquiries.
• Article 6(1)(f) GDPR: our legitimate interests in reliable and secure operation, detecting misuse, investigating faults and responding to general inquiries.
• Article 6(1)(c) GDPR: complying with applicable legal obligations, where relevant.
• Article 6(1)(a) GDPR: where a separate processing activity requires your consent. No analytics or advertising tracking is currently used.

Information needed to sign in or deliver a requested feature is necessary for that feature. You can browse the public website without a workspace account. Providing optional profile information or board content is your choice; without the necessary account data we cannot provide an authenticated workspace.

3. Website access and technical operation

When you access the website, application interfaces or a shared board, the server processes technical connection information such as your IP address, access time, requested resource, browser or device information transmitted with the request, and error or security information. Referrer information may also be transmitted by your browser.

These data are used to deliver the service, diagnose problems and protect against abuse, on the basis of Article 6(1)(f) GDPR. Technical logs and incident records are retained according to the operational or security purpose for which they are needed, rather than for advertising profiles.

4. Accounts and sign-in

Account information can include your name, email address, account identifier, organization or team membership and access permissions. With email-and-password authentication, password hashes are stored; passwords are not stored as readable account passwords. Authentication sessions contain the information required to identify your account and permissions.

The legal basis is Article 6(1)(b) GDPR for account and workspace functionality, and Article 6(1)(f) GDPR for access protection and abuse prevention.

Optional Google sign-in

Where the Google sign-in button is available and you select it, your browser connects to Google for authentication. We receive the account information made available for sign-in, such as your Google identifier, name, email address and profile image. Your Google password is not provided to Coop Blanc.

We use the returned information to authenticate you and operate your account under Article 6(1)(b) GDPR. Google processes information under its own terms and privacy policy. Its services may involve processing outside the European Economic Area, including in the United States. A German hosting location for Coop Blanc does not limit all Google processing to Germany.

Further information: Google Privacy Policy and Google’s information about international transfers.

5. Whiteboards and collaboration

We store the content you add to boards, including text, sticky notes, drawings, images, tables, checklists and emojis, together with board identifiers, ownership, arrangement, appearance and collaboration settings. Uploaded images can contain personal information if you choose to include it.

During a collaborative session, connected users can see the information made available within that board, including participant display names, cursor positions and changes. Shared timers and related session settings are also processed to provide the requested workshop functionality.

The legal basis is Article 6(1)(b) GDPR. You are responsible for ensuring that you may upload and share the content you provide. Where an organization uses the service to process personal data on its behalf, the relevant controller and processor roles and any required data-processing agreement must be established for that use.

6. Guest links and passwords

A board owner can create a view-only link with an optional password. Anyone who obtains a valid unprotected link can view its board without signing in. Protected links additionally require the password. Links and passwords should therefore only be shared with intended recipients.

We store technical link identifiers and, where applicable, password hashes. For a protected link, successful verification stores an access cookie on your device for up to 24 hours. Technical access information and temporary failed-password attempt counts may be processed to protect links against abuse. The board owner can disable guest links.

The legal bases are Article 6(1)(b) GDPR for the requested sharing functionality and Article 6(1)(f) GDPR for access protection. Guest access does not permit editing the board.

7. Cookies and browser storage

Coop Blanc uses authentication and security cookies, including session, anti-forgery and sign-in flow cookies where required. The authenticated session is configured for a 20-minute lifetime, which may be renewed during use. Protected guest-access cookies last up to 24 hours.

Necessary access and security storage is used to provide the service you explicitly request under Section 25(2)(2) TDDDG. Associated processing of personal data is based on Article 6(1)(b) or Article 6(1)(f) GDPR as described above.

The application also uses local browser storage to remember the last board identifier, your selected canvas position and zoom, and whether you dismissed an expired timer. These preferences are specific to the browser and origin and remain until replaced or cleared. They are not used for analytics or advertising. You can remove them through your browser’s site-data settings; doing so can reset preferences or require you to sign in again.

The undo/redo history and temporary rendering or connection state are held in the active browser session. No advertising cookies or analytics technologies are currently integrated. If such features are added, this notice and any required consent controls must be updated before they are activated.

8. Hosting, storage and service providers

The service and its MongoDB storage are currently operated on infrastructure managed by the operator. Hosting on an IONOS server in Berlin, Germany is planned. This notice will be updated when that migration takes place.

Where hosting, maintenance or communications providers are engaged, they may process the information necessary for their services. Processor relationships must be covered by the required agreements. Board data are stored in the configured database; locally served fonts and the emoji catalog do not require a request to an external font or emoji service.

Self-hosted installations may use different hosting locations, providers and configurations. Their operators must provide information appropriate to that installation.

9. Invitations and email contact

For organization invitations, the application can process the recipient’s email address, organization information, the inviting user’s name and a technical invitation identifier. If email delivery is enabled, these details and the invitation message are processed through the configured email service. Organization invitations are sent through IONOS email using noreply@coopblank.com.

If you contact us by email, we process your address, message and any information you provide to respond to your inquiry. Recipients can include the email service providers involved in sending and receiving the message. The legal basis is Article 6(1)(b) GDPR for contractual inquiries and Article 6(1)(f) GDPR for other inquiries.

10. Retention and deletion

Account and workspace data are retained for the operation of the account and the requested workspace. Board content, uploads, invitations and guest-access records are retained for the corresponding service purpose until deleted or no longer needed, subject to applicable retention duties and legitimate requirements to resolve disputes or investigate security incidents.

Removing an element from the visible canvas does not necessarily erase every technical copy immediately. Media retained for restoration and any backup copies require separate handling. You may contact us to request account closure or erasure; requests are assessed under the GDPR, including any applicable exceptions and legal retention duties.

Technical logs are retained according to the need to operate the service, investigate faults and defend against misuse. Browser preferences remain on your device until overwritten or cleared by you. The rights below apply regardless of the absence of an automatic account-deletion interface.

11. Your rights

Subject to the relevant conditions, you have the rights to access, rectification, erasure, restriction of processing and data portability under Articles 15–20 GDPR.

Right to object: where processing is based on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of earlier processing.

To exercise your rights, contact contact@thelabelmanager.com. We may request information reasonably necessary to verify your identity.

You can lodge a complaint with a supervisory authority, in particular in your place of residence, work or the alleged infringement. For the operator in North Rhine-Westphalia, you can contact the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).

12. Automated decisions and changes

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, or for advertising profiling.

This notice may be updated when the service, hosting, providers or legal requirements change. The version published here applies to the processing it describes.