Privacy Policy

Stipme is built so that clients don't need to sign up. We store only what's genuinely necessary for the project, the payment and the payout. Less data means less risk – for both sides.

When you create a Stip link as a service provider, or open one as a client, we store the data you enter: project and milestone titles, amounts, deadlines, acceptance criteria and your email address for status updates. Matching without a login happens via a random key stored in your browser (local storage). Links contain a random, unguessable identifier and are not publicly indexed.

You can optionally create an account. We then process sign-in data (email address, password as a hashed value, and, where applicable, your Google profile name and email for Google sign-in), your display name, and any voluntary profile data (company, logo). When you log in we create a session, which is deleted once the session ends.

Payments and payouts are processed entirely through Stripe Payments Europe and Stripe Technology Europe ("Stripe"). Stripe moves the money: you enter your payment details directly with Stripe, and card data never touches our servers. Stripe processes this data as an independent controller – the Stripe privacy notice applies.

For payouts as a service provider, the payment partner handles onboarding (identity, bank account details, and KYC data where applicable). We only store the payout status of your account from it.

Only if you use the "Review project" feature do we send your project description, milestones, acceptance criteria and deadlines server-side to an AI model. The aim is to spot ambiguities and potential sources of dispute. The request is routed through the AI gateway of our hosting provider, Lovable, to the model provider OpenAI in the USA. This relies on EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. Please don't enter sensitive personal data into these fields. The legal basis is contract performance (Art. 6(1)(b) GDPR), because you actively trigger the feature.

Files you upload as a deliverable, and your logo for the client-facing link, are stored in non-public storage. Access is only possible via time-limited links. Every project step and every approval (e.g. accepting the rules before payment, a revision request, a settlement) is recorded in an immutable log, with a timestamp, the text version, and a hash of the IP address. This serves both parties as evidence (Art. 6(1)(b) and (f) GDPR).

To protect against spam and automated abuse, we store hashes of your IP address and the number of your requests. We do not store the plaintext IP address. We log payment flows so we can trace payment confirmations and detect errors. New projects are automatically checked for typical fraud patterns (e.g. phishing). If suspicious, we hold them back until reviewed. The legal basis is our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

Reporting misuse: If you report a link, we store the reason, your description, your voluntary email address (only if you'd like a reply), and a hash of the IP address. The hash is used to detect repeated reports.

Feedback: We store your message, the type of feedback, the page you submitted it from, and, if you're signed in, your account identifier. The email address is voluntary. Only Stipme administrators read the feedback.

Referrals: For the referral program we store your referral code, who came in through which code, a hash of the IP address to prevent abuse, and the free months credited. The code is kept for up to 60 days in your browser's local storage so the referral can be matched (Art. 6(1)(b) GDPR).

When you contact us about a possible investment, we store your name, business email, fund or company, role, investment focus, typical ticket range, language, and the context you provide with your request (at least 30 characters). We use this information internally only to assess and respond to the request. The legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

To improve Stipme, we count page views and the use of individual features (e.g. "Stip created", "FAQ searched") using our own, self-hosted analytics. We do not set cookies for this, we do not use local storage for the analytics, and we do not share any data with third parties. Which browser storage Stipme uses for other features is listed in the cookie and storage policy.

We store: the page visited (without project identifiers), the referring domain, campaign parameters, device type, language and country. To count visitors per day, we form a checksum from the IP address and browser identifier together with a random value that is regenerated daily and then deleted. We do not store the IP address itself; recognition across multiple days is excluded. Technical errors are logged without personal details.

The legal basis is our legitimate interest in a functioning, improved service (Art. 6(1)(f) GDPR). We delete raw data after 90 days; only anonymous daily figures remain. If your browser sends "Do Not Track" or "Global Privacy Control", we record nothing.

Only if you click "Accept" in the notice do we use Google Analytics 4 by Google Ireland Ltd. to measure which pages are visited. Cookies (_ga, _ga_<ID>, 13 months) are set and usage data (page, device, approximate location, shortened IP address) is sent to Google, possibly also to the USA (EU-US Data Privacy Framework). Google signals and advertising features are disabled; project links are sent without identifiers. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time on the cookie page; we then delete the cookies. Google deletes the data after 14 months.

The website, server functions, database and file storage are operated by providers acting on our behalf. The website is delivered via a global server network. As a result, requests may also be processed outside the EU, for example in the USA. For sign-in with Google and for payments, Google and the payment partner respectively act as independent controllers. Where data goes to third countries, we rely on EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. All providers, with purpose and location, are listed under Subprocessors.

The cookie and storage policy lists the technically necessary storage and consent-based analytics cookies we use, including purpose and duration.

• Project data, deliverables and logos: for as long as you use them; you can delete projects in the dashboard.
• Project log and approvals: for as long as claims arising from the project can be asserted (typically up to 10 years); they cannot be altered.
• Raw analytics data and error logs: 90 days.
• Hashes used to rate-limit requests: 2 days.
• Abuse reports and feedback: until the matter is resolved, a maximum of 2 years.
• Investor enquiries: until the exchange is complete, for no longer than 2 years.
• Account: until deleted via settings or by email to info@hantha.com.
• Statutory retention obligations (e.g. for invoicing data) remain unaffected.

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Please contact info@hantha.com. You also have the right to lodge a complaint with a data protection supervisory authority (in Italy: Garante per la protezione dei dati personali).

We update this policy whenever features or legal requirements change. The current version always applies on this page.

Before launch you can join our waitlist. We store your email address, the role you select (freelancer, agency, client), optionally your monthly invoicing volume, your language, a personal invite code, the code you were invited with (if any), a hashed network fingerprint against abuse (no IP address), and the time of your consent.

Early-bird bonus and invites: we store your sign-up number and count how many people joined through your invite code, to calculate your free Pro months. Invites from your own network don't count. At launch, the bonus is credited once to the account registered with the same confirmed email address. People who join through your link don't see your email address, and you don't see theirs.

Purpose: to inform you about the launch and give you early access. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by email to us; we then delete your entry. Entries are deleted at the latest 12 months after launch if you do not create an account.