Privacy policy

1. Controller

The controller responsible for data processing on this website is:

Patrick Ludewig, Lenneisgasse 5/1, 1140 Vienna, Austria, email: [email]

We are not legally required to appoint a data protection officer. For any privacy question, contact us directly at the email address above.

2. Summary

• We measure how the website is used with Umami, on our own server and without cookies. No IP address is stored and no usage profile is built. There is no advertising tracking.
• We only use strictly necessary cookies and browser storage. The optional support chat only loads after you click, so there is no connection to Crisp before that. That is why there is no cookie banner.
• Fonts and all other files are served from our own server, not from third parties such as Google. The only exception is the optional support chat, which is loaded from Crisp only after you click.
• Our servers are in Germany. We use Cloudflare to deliver and protect the website, Stripe for payments and, if you start it, Crisp (France) for the support chat.
• We do not sell data and only share it as described in this policy.

3. Hosting and server log files

The website, the database and generated exports are stored on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. We have a data processing agreement with Hetzner under Art. 28 GDPR.

Each time the website is accessed, our server automatically processes the following data in server log files:

• IP address of the requesting device
• date and time of access
• requested page or file and HTTP status code
• amount of data transferred
• browser and operating system (user agent) and, where applicable, the previously visited page (referrer)

We need this data to deliver the website, ensure its stability and security, and detect attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and error-free operation of the service. Log files are deleted after 7 days unless they are needed longer to investigate a specific security incident.

4. Cloudflare (content delivery and protection)

We use services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare routes traffic to our website through its global network, provides the encrypted connection (TLS), caches static files and blocks attacks such as DDoS.

In doing so, Cloudflare processes in particular your IP address, the requested URLs, timestamps, technical information about your browser and device, and security-relevant characteristics of the request. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a fast, available and protected website.

Cloudflare processes the data as our processor under its Data Processing Addendum. Data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of protection (Art. 45 GDPR). In addition, the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR). More information: https://www.cloudflare.com/privacypolicy/

5. User account

You need an account to save projects and buy exports. When you sign up and use the service, we process:

• name and email address
• password, stored only as an encrypted hash
• login sessions: session token, expiry time, IP address and user agent
• time of registration and last change, remaining quota for text suggestions
• customer ID at Stripe once you buy an export

The legal basis is Art. 6(1)(b) GDPR (contract for using Mingo). We additionally store the session's IP address and user agent on the basis of Art. 6(1)(f) GDPR to detect misuse and unauthorised access to your account.

An email address and password are required for an account. Without them you can only use the public pages and the demo.

We keep your account data as long as your account exists. You can ask us by email to delete it at any time; we then delete your account, projects and exports unless statutory retention obligations apply (see section 8). Expired sessions are removed regularly.

6. Projects, prompts and exports

When you create a bingo project, we store the content you enter: title, occasion, prompts, texts for the PDF and settings. When you export, we generate PDF and CSV files and store them on our server so you can download them again. For each card we create a random access code (token), which we store only as a hash.

For the QR codes on the cards, each account gets a public short name made from your name or the part of your email address before the @, plus a random string. This short name is part of the links your guests open via the QR codes. Anyone with the link sees the short name and the card, but not your email address.

The legal basis is Art. 6(1)(b) GDPR. Please do not enter sensitive data about other people in prompts. We keep projects and exports until you delete them or your account is deleted.

7. Digital bingo card for players

Guests who scan a card's QR code need no account and enter no data. We do not learn who opens a card. When the card is opened, the server only processes the technical data described in sections 3 and 4 and the access code from the link to show the right card.

Which squares have been ticked is stored only in the browser of the device in question (localStorage, see section 10) and is not sent to us.

8. Payments via Stripe

You pay for exports via Stripe. The provider for customers in the EEA is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. When you buy, we redirect you to a Stripe checkout page and pass on:

• your email address
• the description of the export including the project title and number of cards
• internal identifiers (account ID, export ID) and the selected language

You enter your payment details (e.g. card number or bank details) directly with Stripe; they are not sent to us. We only receive confirmation of the payment and a customer or transaction identifier from Stripe.

The legal basis is Art. 6(1)(b) GDPR (performing the purchase) and Art. 6(1)(c) GDPR (tax and company law retention obligations). Stripe also processes payment data as an independent controller, for example for fraud prevention and to meet its own legal obligations. Data may be transferred to Stripe, Inc. in the USA; Stripe is certified under the EU-US Data Privacy Framework and also uses standard contractual clauses. Stripe's privacy policy: https://stripe.com/privacy

We retain purchase records under Section 132 of the Austrian Federal Fiscal Code (BAO) for seven years from the end of the calendar year, and longer only while they are relevant to pending tax proceedings.

9. Support chat (Crisp)

We only load the support chat when you click “Start chat” in the bubble. Before that there is no connection to Crisp. The provider is Crisp IM SAS, France (https://crisp.chat). Crisp processes the chat data on our behalf; we have a data processing agreement with Crisp.

We process your message, an email address if you give one, your IP address, browser information, the page you write from and the name of the creature you opened the chat through. According to Crisp, messages are stored on servers in the Netherlands. The connection may run through Crisp relay servers in the USA, the United Kingdom and Singapore; according to Crisp these only store connection data (IP address, time, browser, website visited).

If you do not write a message, Crisp deletes the session including the IP address about 30 minutes after your last activity. We automatically delete conversations and the associated contact data (such as an e-mail address you provided) 12 months after the last activity, or earlier on request. Separately, Crisp keeps connection logs (IP address, browser, time) for up to 1 year, according to its own statements, because French law requires it. We have no access to these logs.

The legal basis is Art. 6(1)(f) GDPR (answering your request through the channel you chose), or Art. 6(1)(b) GDPR for questions about your account or a purchase.

10. Cookies and local storage

We only store the following information on your device. All of it is strictly necessary for the features you request. The legal basis is Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021); no consent is required. Where personal data is involved, we rely on Art. 6(1)(b) or (f) GDPR.

You can delete or block cookies and browser storage in your browser at any time. Without the session cookie you cannot sign in.

11. Audience measurement (Umami)

We want to understand which pages are helpful and which buttons lead to sign-ups. For that we use Umami, analytics software that we run ourselves on our own server. No data is passed on to third parties.

We record: the page viewed, referrer, browser, operating system, device type, rough country of origin, clicks on buttons and the counters "sign-up", "project created" and "export paid". The IP address is not stored. No cookies are set and nothing is stored in your browser, so no consent is required. The counters contain neither your e-mail address nor a user ID.

The legal basis is Art. 6(1)(f) GDPR: our legitimate interest is a website that is understandable and works well. We delete the measurement data after 14 months. If you do not want to be measured, turn on "Do Not Track" in your browser. We honour it.

12. Contact by email

If you email us, we process your email address, your name and the content of your message to handle your request. The legal basis is Art. 6(1)(b) GDPR where it concerns your account or a purchase, otherwise Art. 6(1)(f) GDPR (answering enquiries). We delete messages once the matter is closed and no retention obligations apply.

13. Recipients and transfers to third countries

Your data is only received by the service providers named in this policy: Hetzner (hosting, Germany), Cloudflare (delivery and protection, USA), Stripe (payments, Ireland or USA) and, if you start the support chat, Crisp (chat, France; stored in the Netherlands, connection data also via relay servers in the USA, the United Kingdom and Singapore). Beyond that, we only share data where we are legally required to, for example with authorities, or where it is necessary to enforce our rights.

Transfers to Cloudflare and Stripe in the USA are based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46(2)(c) GDPR).

14. Your rights

You have the following rights regarding your personal data:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of any consent given, with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

An informal email to the address in section 1 is enough for any request.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the EU member state where you live. The authority responsible for us is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, email: dsb@dsb.gv.at, web: https://www.dsb.gv.at

15. Further information

• We do not make automated decisions or carry out profiling within the meaning of Art. 22 GDPR.
• The connection to Mingo is encrypted via TLS, shown by “https://” and the lock icon in your browser.
• Mingo is not aimed at children under 14. Younger children may only create an account with parental consent (Section 4(4) DSG).

16. Changes to this policy

We update this privacy policy when Mingo or the legal situation changes, for example when we start using new services. The version published here applies.