Get notified

Legal

Privacy Policy

1. Overview

This privacy policy explains how we collect, use, and protect your personal data when you visit bambuddy.cool (the "Website"), buy the Bambuddy Appliance or register one. We take the protection of your personal data very seriously and treat it confidentially in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection laws.

Data controller:
Martin Ziegler
Warschauer Str. 12
10243 Berlin, Germany
Email: martin@bambuddy.cool

2. Hosting

This website is hosted by a third-party provider. When you visit this website, the hosting provider automatically collects and stores information in server log files that your browser transmits. This includes:

  • IP address
  • Browser type and version
  • Operating system
  • Referrer URL
  • Date and time of access

This data is processed based on Art. 6(1)(f) GDPR, as it is necessary for the secure and efficient operation of this website. Server log files are deleted automatically after 30 days.

3. Analytics (Matomo)

We use Matomo, a self-hosted, open-source web analytics platform, to understand how visitors use this website. Matomo runs on our own infrastructure; no data is shared with third parties, and no data leaves the European Union.

Our Matomo installation is configured to process data anonymously:

  • No cookies are set in your browser
  • No personal identifiers (user ID, order ID, referrer paths beyond the domain) are stored
  • IP addresses are truncated by 2 bytes (e.g. 144.76.176.12 is stored as 144.76.0.0) before being written to the database, so no individual visitor can be identified
  • The anonymized IP is also used for geolocation (country-level only)
  • Do Not Track (DNT) browser signals are honored — if your browser sends DNT, no data is recorded
  • Raw visit logs are automatically deleted after 180 days

The following anonymous, aggregated data is collected:

  • Pages visited and time spent
  • Referrer domain (how you arrived at the site)
  • Browser and device type
  • Approximate country (from the truncated IP)

Because the data is anonymized at the point of collection and no cookies or personal identifiers are used, this processing does not require consent under the GDPR. Legal basis: Art. 6(1)(f) GDPR (legitimate interest) — our legitimate interest being the operation and improvement of this website.

You have the right to object to this processing at any time under Art. 21 GDPR by enabling Do Not Track in your browser or by contacting us at martin@bambuddy.cool.

4. User Reviews

If you submit a review on our website, the following data is collected:

  • Your review text
  • Your rating (1-5 stars)
  • Your name (optional)

Reviews are stored using Supabase, a cloud database service. Supabase processes data in accordance with GDPR. Reviews are moderated before being displayed publicly. You can request deletion of your review by contacting us at martin@bambuddy.cool.

Legal basis: Art. 6(1)(a) GDPR (consent through voluntary submission).

5. Bug Reports

If you submit a bug report through this website, the following data may be collected:

  • Bug description
  • Your email address (optional)
  • System information and logs (optional)
  • Screenshots (optional)

Bug reports are used to create GitHub issues for tracking and resolution. Personal information (IP addresses, serial numbers, names) is automatically sanitized from logs before submission. Your email address, if provided, is only used to follow up on the reported issue.

Legal basis: Art. 6(1)(a) GDPR (consent through voluntary submission).

6. Contact by Email

If you contact us by email, your data (email address, name, message content) will be stored and processed for the purpose of handling your request. This data will not be shared with third parties without your consent.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

7. Business and Appliance Enquiry Forms

If you send an enquiry through the form on the Business or Appliance page, we receive your email address, your message and the details you select (topic, number of printers, region, timeframe, and whether you use Bambuddy for business). The form forwards them to us by email so we can reply; they are not stored on the website server.

To stop abuse, the form service keeps a short-lived per-IP-address counter in memory and records your IP address, but not your email address or message, in its server log. A successful enquiry is counted as an anonymous goal in our Matomo analytics (see section 3).

Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract at your request) and Art. 6(1)(f) GDPR (protection against abuse).

8. Buying the Bambuddy Appliance (Paddle)

The Bambuddy Appliance subscription is sold through our online reseller Paddle (Paddle.com Market Limited, London, and its affiliates Paddle.com Inc. and Paddle.com (Canada) Ltd.), which is the Merchant of Record for all our orders. Paddle collects and processes your payment details, billing address and tax information as the seller and under its own responsibility; we never see your card or bank details. Paddle's privacy policy applies: paddle.com/legal/privacy.

The checkout opens on get.bambuddy.cool/pay.html, the only page that loads Paddle's checkout script (Paddle.js) from Paddle's servers. When it loads, your IP address and browser details reach Paddle, and Paddle may set cookies it needs for the payment and for fraud prevention. No other page on our sites loads anything from Paddle.

Paddle passes us what we need to deliver the subscription: your name, email address, country, the product bought, the order number and the subscription status; for business purchases also the company name and VAT number you entered. We use these to issue and manage your licence key, to answer support requests and to handle refunds.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (retention duties under tax and commercial law). We keep order data for as long as the subscription runs and afterwards for as long as those retention duties require, up to ten years.

9. Appliance Registration

A Bambuddy Appliance registers with our licence service and then reports roughly once a day. It sends only: a device identifier derived from the board's serial number, the batch identifier of the image, the licence key, the hardware model and the Appliance software version. Once an hour it also checks its subscription status; that request carries only the device identifier and a device token, and we do not log it.

No print data, files, printer data, user data or credentials are ever transmitted. Your IP address is not stored in the clear: we keep only a salted, truncated hash of it, and only to detect one licence key being used on several devices.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (preventing misuse of licence keys). The registration is kept while the subscription and the device registration exist; ask us at support@bambuddy.cool to delete it after the subscription has ended.

10. Third-Party Services

GitHub

Our website links to GitHub (github.com) for source code, issues, and releases. When you follow these links, GitHub's privacy policy applies.

Discord

Our website links to our Discord community server. When you follow these links, Discord's privacy policy applies.

Ko-fi

Our website links to Ko-fi for voluntary donations. When you follow these links, Ko-fi's privacy policy applies.

Visitor Badge

This website uses a visitor badge image from api.visitorbadge.io to display a visitor counter. When this image loads, your IP address is transmitted to this service.

11. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR) - You can request information about whether and which personal data we process about you.
  • Right to rectification (Art. 16 GDPR) - You can request correction of inaccurate data.
  • Right to erasure (Art. 17 GDPR) - You can request deletion of your personal data.
  • Right to restriction (Art. 18 GDPR) - You can request restriction of processing.
  • Right to data portability (Art. 20 GDPR) - You can request your data in a structured, machine-readable format.
  • Right to object (Art. 21 GDPR) - You can object to processing based on legitimate interests.
  • Right to withdraw consent (Art. 7(3) GDPR) - You can withdraw consent at any time.

To exercise any of these rights, please contact us at martin@bambuddy.cool.

You also have the right to lodge a complaint with a supervisory authority. The competent authority is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219
10969 Berlin
www.datenschutz-berlin.de

12. Data Security

This website uses TLS (HTTPS) encryption for secure data transmission. We take appropriate technical and organizational measures to protect your data against unauthorized access, loss, or manipulation.

13. Changes to This Policy

We may update this privacy policy from time to time. The current version is always available on this page.

Last updated: September 29, 2026