1. Controller and EU representative
Controller within the meaning of the General Data Protection Regulation (GDPR): Sentra Terminal Email: info@sentra-terminal.de Our EU representative pursuant to Art. 27 GDPR: [EU representative — to be named] You may direct all data protection matters to us or to our EU representative.
2. General
We process personal data only within the framework of statutory provisions (in particular GDPR and, where applicable, the German BDSG). Personal data means any information relating to an identified or identifiable natural person.
3. Your rights
You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), as well as the right to withdraw a granted consent with effect for the future (Art. 7(3) GDPR). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Please send requests to info@sentra-terminal.de or to our EU representative.
4. Legal bases
Depending on purpose, processing is based on Art. 6(1)(a) (consent), (b) (performance of a contract), (c) (legal obligation) or (f) (legitimate interest) GDPR.
5. Hosting and provision of the app
Our application is provided via Lovable (Lovable Labs Incorporated); database, authentication and backend run on Supabase (Supabase, Inc.). When the app is accessed, technically necessary data (e.g. IP address, date/time, requested resource, browser type) are processed in server log files. The legal basis is our legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR) and contract performance (lit. b). Data processing agreements (Art. 28 GDPR) are in place with the providers.
6. User account / registration
To use SENTRA you create an account. In doing so we process the data you provide (e.g. email address, name, access credentials). Legal basis is Art. 6(1)(b) GDPR. The data are deleted as soon as the account is closed and no statutory retention obligations apply.
7. Payment processing via Whop (Merchant of Record)
Payments are processed by Whop Inc., 175 Varick Street, Floor 09, New York, NY 10014, USA ("Whop") as the merchant of record. Whop is the controller for the payment transaction itself. Data required for the payment (e.g. name, email, billing address, payment method) are entered directly into Whop's checkout; from Whop we only receive the information necessary to fulfil the contract (in particular the Whop membership ID, status, trial end and plan). We do not store full payment method data. Legal basis for our processing is Art. 6(1)(b) GDPR. Whop's privacy notice applies additionally: https://whop.com/privacy
8. Processing by AI services
SENTRA processes your inputs as well as account/usage data required for analysis using AI services provided via Lovable (Lovable Labs Incorporated) and the Claude AI model from Anthropic PBC (USA). Where personal data are transmitted to these providers for this purpose, the legal basis is Art. 6(1)(b) GDPR (contract performance). Please do not enter sensitive personal data of third parties into the input fields. The respective provider's privacy terms apply additionally.
9. Email delivery
For service and transactional emails (e.g. registration, payment and withdrawal confirmations) we use Resend (Resend, Inc., USA). Your email address and the respective message content are processed. Legal basis is Art. 6(1)(b) and (f) GDPR. You will only receive marketing emails after explicit consent (double opt-in); unsubscribing is possible at any time.
10. Cookies and consent banner
We use technically necessary cookies as well as — only after your consent — optional cookies (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You manage your consent via our cookie banner and may withdraw it at any time with effect for the future.
11. Transfer to third countries (USA)
Since the controller and several service providers (Whop, Anthropic, Resend, possibly Lovable/Supabase) are located in the USA, personal data are transferred to the USA. This is done on the basis of appropriate safeguards under Art. 44 et seq. GDPR, in particular the EU standard contractual clauses and — where the provider is certified — the EU-US Data Privacy Framework. The level of data protection in the USA does not fully correspond to that under EU law.
12. Retention period
We store personal data only for as long as is necessary for the stated purposes or as required by statutory retention periods (e.g. under commercial and tax law).
13. Data security
We take appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access (e.g. TLS encryption).
14. Changes to this privacy policy
We adapt this privacy policy as soon as changes in processing or in the legal framework require it. The version currently published on the website applies.
© 2026 Sentra Terminal