L·1 — Privacy

Privacy Policy

Last updated: August 10, 2026

This policy explains how Wirepilot processes personal data when you visit wirepilot.io or use the Wirepilot application at app.wirepilot.io ("the Service"). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and German data protection law.

1. Controller

The controller responsible for data processing on this website and in the Service is:

Matthias Wolf
Tölzer Str. 5a
81379 München, Germany
Email: [email protected]

Full provider identification is available in the imprint.

2. What we process, why, and on what legal basis

2.1 Account data

When you create an account, our authentication provider Clerk processes your email address, name (if provided), sign-in credentials or third-party sign-in identifiers, and session data on our behalf. We use this data to create and secure your account and to provide the Service. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.2 Billing data

Paid subscriptions are sold through Polar, our merchant of record. Polar processes your name, email address, billing address, and payment details, and issues the invoice (including VAT handling). Wirepilot never receives or stores your full card number — payment details are entered directly on Polar's hosted checkout and customer portal pages. We receive subscription status and truncated payment metadata. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations such as tax law (Art. 6(1)(c) GDPR).

2.3 Project and schematic content

The schematics, projects, and related content you create in the Service are stored on servers operated by Hetzner Online GmbH in Germany. We access this content only to operate the Service (storage, sync, export) — see also the ownership terms in our Terms of Service. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.4 AI features

Wirepilot includes AI-assisted drawing and review features. These run only when you invoke them — for example by sending a prompt to the assistant. When you do, the relevant schematic content and your prompt are transmitted to the configured AI provider (Anthropic, OpenAI, or Google Gemini, depending on configuration) to generate the response. We do not send your project content to any AI provider in the background or without an action on your part. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for providing the feature you invoked.

2.5 Error and diagnostic data

To detect and fix defects, the Service reports errors and performance telemetry to Sentry. We use Sentry's EU data region, so this data is ingested and stored in the European Union. Reports can include technical context such as browser type, URL, and the state of the application at the time of the error. Legal basis: our legitimate interest in providing a stable and secure service (Art. 6(1)(f) GDPR).

2.6 Server logs

Our servers automatically log technical access data (IP address, timestamp, requested URL, user agent) as necessary to deliver the Service and defend against abuse. Legal basis: our legitimate interest in the secure operation of our infrastructure (Art. 6(1)(f) GDPR).

2.7 Client share links and comments

A customer of ours can publish a read-only view of a project as ashare link — a secret URL that opens the drawing without an account. If the link's owner enables comments, anyone holding that link can post a comment and, optionally, type a display name. We store the comment text, the display name if one is given, the position of the pin on the drawing, and the time of posting, and we show all of it to the owner of the project and to everyone else holding the same link. A display name is voluntary — leave it blank and the comment is stored without one. Do not enter personal data you do not want the project's owner and other link holders to see.

For visitors who use a share link we are the controller of the comment data; legal basis: our legitimate interest in enabling review and feedback on a shared drawing (Art. 6(1)(f) GDPR). For the project content shown behind the link, our customer decides what to publish and we act as their processor. Comments are deleted when the project owner deletes them or the project, and a share link can be revoked by its owner at any time, which immediately makes the drawing and its comments unreachable through that URL.

3. Processors

We use the following processors under data processing agreements pursuant to Art. 28 GDPR:

  • Clerk, Inc. (USA) — authentication and account management
  • Polar Software Inc. (USA) — payment processing and subscription billing as merchant of record (for the payment transaction itself Polar acts as an independent controller, not our processor)
  • Functional Software, Inc. (Sentry) (USA, EU data region ingest) — error monitoring and performance telemetry
  • Hetzner Online GmbH (Germany) — application hosting and database (project content)
  • Cloudflare, Inc. (USA) — hosting of this marketing website (Pages)
  • AI providers, only when you invoke AI features: Anthropic PBC (USA), OpenAI, L.L.C. (USA), or Google (Gemini), depending on configuration

4. International transfers

Your project content is stored in Germany. Some of the processors above (Anthropic, OpenAI, Google, Clerk, Polar, Cloudflare, Sentry) are US companies, so processing personal data can involve transfers to the United States. Such transfers rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and/or an adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified.

5. Retention

High-level retention periods:

  • Account data — for the life of your account; deleted after account termination, subject to statutory retention duties.
  • Billing records — retained as required by German commercial and tax law (up to 10 years).
  • Project content — until you delete it or your account is deleted.
  • Error and diagnostic data — automatically expires per Sentry's retention window (typically 90 days).
  • Server logs — short-lived, rotated automatically.

6. Cookies and local storage

This website (wirepilot.io) sets no cookies. It stores your theme and language preference in your browser's local storage — purely functional, readable only by this site, and sent to no one.

The application (app.wirepilot.io) uses only strictly necessary cookies — the authentication session cookies set by Clerk that keep you signed in. We use no advertising, analytics, or other tracking cookies on either site. Because strictly necessary cookies do not require consent (§ 25(2) TDDDG), we do not show a cookie consent banner.

7. Your rights

Under the GDPR you have the right to:

  • access to your personal data (Art. 15),
  • rectification of inaccurate data (Art. 16),
  • erasure ("right to be forgotten", Art. 17),
  • restriction of processing (Art. 18),
  • data portability (Art. 20),
  • object to processing based on legitimate interests (Art. 21), and to withdraw any consent at any time with effect for the future (Art. 7(3)).

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence or place of the alleged infringement (Art. 77 GDPR).

8. Contact for privacy requests

To exercise any of these rights or ask questions about this policy, contact us at [email protected].

9. Changes to this policy

We will update this policy when our data processing changes — for example when a processor is added or replaced. The date at the top reflects the latest revision; material changes to how we process account data will be announced in the Service.