1. Controller
Controller under the GDPR:
Kai Uhlig, Herrenhauser Str. 3a, 40822 Mettmann, Germany
Email: info@brickpartmanager.com
Further legal details: https://brickpartmanager.com/en/imprint.html
2. Data we process
Local data: sets, part progress, settings on your device.
Account (optional): email, display name via Supabase.
Cloud sync (optional): list sync for premium users.
Collaborative search sessions: invite codes and session metadata.
Technical data when online: when calling our catalog API (brickpartmanager.com) or loading part images (e.g. cdn.rebrickable.com), IP address, timestamps and request metadata may be processed.
Website: visiting brickpartmanager.com generates server log data (see section 6).
3. Purposes and legal bases
Contract performance (Art. 6(1)(b) GDPR).
Consent for optional processing such as marketing/ads (Art. 6(1)(a) GDPR).
Legitimate interests for security and stability where applicable (Art. 6(1)(f) GDPR).
Legitimate interest in providing set and part data via catalog API and Rebrickable CDN (Art. 6(1)(f) GDPR).
Legitimate interest in operating and securing the website including server log files (Art. 6(1)(f) GDPR).
4. Retention
Local data remains on your device until you delete it, uninstall the app, or choose “Delete account & local data” in your profile.
When you delete your account in the app, your login account, all related cloud data (lists, parts, search groups, memberships) and all local app data on the device are permanently deleted. You will not be able to sign in with the same account again.
We use Supabase (hosting, authentication, database) as a processor. After deletion, personal data may remain in the infrastructure provider’s automatic backups for a limited period until they are overwritten in the normal backup cycle. Such data is not actively used or restored for other purposes.
Statutory retention obligations (e.g. commercial or tax law) remain unaffected.
5. Recipients
Supabase (Supabase Inc., 970 Topper Lane, Lafayette, CA 94549, USA) as processor for hosting, authentication and database. Our Supabase project is hosted in the EU region (Frankfurt, eu-central-1). We have a data processing agreement (DPA) under Art. 28 GDPR with Supabase. Any transfers to the USA rely on EU Standard Contractual Clauses (SCCs) and Supabase’s participation in the EU-US Data Privacy Framework.
Rebrickable BV (Netherlands) as the source of set and part data. Data is mirrored on our catalog server; loading images from the Rebrickable CDN may transmit your IP address to Rebrickable. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Privacy policy: https://rebrickable.com/privacy/
Google AdMob (Google Ireland Limited / Google LLC, USA) for ads if you opt in on the splash screen. Device identifiers, advertising ID and usage data may be processed. Legal basis: consent (Art. 6(1)(a) GDPR), withdrawable at any time. Google privacy policy: https://policies.google.com/privacy — Disable personalized ads: https://adssettings.google.com
Web hosting (All-Inkl) for the website and catalog API at brickpartmanager.com (Germany). DPAs are in place where required.
6. Website and server log files
When you visit brickpartmanager.com or our catalog API receives online requests, technical access data (e.g. IP address, date/time, requested URL, browser/OS, referrer) is processed in server log files.
Purpose: operation, IT security and error analysis. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Log data is deleted or anonymized after a short period unless security-related retention is required.
7. Your rights
See “GDPR – Your rights” in this App for access, rectification, erasure and more.