Privacy policy

The controller for the processing of personal data in connection with 4you2us is Vailble GmbH, Ludwig-Lassl-Strasse 2, 6112 Wattens, Tyrol, Austria, email: office@vailble.at.

Further company details can be found in the legal notice.

We process personal data within the framework of applicable data protection law, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and – where applicable – the Austrian Telecommunications Act (TKG).

Related:Legal noticeTerms

We use technical hosting, database and infrastructure services to operate 4you2us. The website is delivered via the hosting infrastructure of Lovable (Lovable Labs Incorporated); database, authentication and file storage run on Supabase (Supabase, Inc.).

When our website is accessed, technically necessary information may be processed, in particular:

• IP address
• date and time of access
• pages and resources requested
• browser and browser version
• operating system
• device type
• referrer information, where transmitted
• technical error and security information

This data is processed in order to provide 4you2us technically, to ensure the stability and security of the service and to detect errors and abusive access.

The legal basis is in particular Art. 6(1)(f) GDPR – our legitimate interest in a secure and functioning online service.

Where individual providers process data outside the European Economic Area, this only happens under the conditions of the GDPR (see section 16).

A user account is required in order to create, store and manage experiences. The following may be processed in particular:

• name or user name
• email address
• internal user ID
• login and authentication information
• language settings
• experiences created
• products and plans purchased
• account settings
• registration date

We use this data to set up and manage the user account and to provide the requested features.

The legal basis is in particular Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures.

Account data is generally stored for as long as the user account exists. Statutory retention obligations remain unaffected. Rights and obligations regarding the account are additionally governed by the terms.

Related:Terms

4you2us offers sign-in via Google. Users can use their existing Google account to register or sign in. Depending on the permissions granted, the following information may be transmitted to 4you2us:

• name
• email address
• Google account ID
• profile picture, where applicable

We do not receive the user's Google password. The transmitted data is used solely to register, authenticate and manage the 4you2us account.

Google also processes personal data as part of the sign-in procedure. Further information can be found in Google's privacy policy.

Using the Google login is voluntary; sign-in via email link is available as an alternative.

Related:Google privacy policy

Stripe (Stripe Payments Europe, Ltd.) is intended as the payment provider for paid features, premium experiences and subscriptions. Payment processing is currently in preparation: as long as Stripe is not activated, no payment and no transmission of payment data takes place through 4you2us.

Once payment processing is active, the following may be processed in particular:

• name
• email address
• billing information
• payment method
• amount and currency
• date and time of the transaction
• payment and transaction status
• any further data required for payment processing

The actual payment data, such as credit card details, is processed directly by Stripe. We do not store complete credit card details.

Processing takes place in particular to perform the contract and process payment pursuant to Art. 6(1)(b) GDPR and, where necessary, to comply with legal obligations pursuant to Art. 6(1)(c) GDPR.

Invoice and transaction data may continue to be stored after deletion of a user account due to statutory tax and commercial retention obligations. Prices and contractual conditions follow from the terms.

Related:Stripe privacy informationTermsPrices & plans

Depending on the available features, 4you2us allows the upload of photos, images, videos, audio recordings and other media files. This content is stored and processed in order to display or play it within the experience created by the user.

Uploaded media is not automatically published publicly on 4you2us, not sold to other users and not used for advertising purposes, unless a separate legal basis or consent exists.

Users are responsible for holding the necessary rights to use the uploaded content. This applies in particular to copyright, personality and data protection rights of the people shown or recorded.

Related:Terms

Users can create personal experiences on 4you2us. The following information may be stored in particular:

• names and nicknames
• type of relationship
• occasion
• personal messages
• questions and answers
• quiz content
• memories
• Compare Us answers
• Finish My Sentence content
• personal letters
• images, videos and audio
• individual content entered by the user

This data is stored so that the experience can be created, edited and made available to the intended recipient.

Rights to a user's own content generally remain with the respective user or rights holder. Vailble only uses the content to the extent necessary to provide 4you2us technically and to run the experience requested by the user.

We do not sell personal content and do not make private experiences publicly available to other 4you2us users. Where technically necessary service providers have to process data – for example hosting or storage providers – this takes place within the framework of data protection requirements.

Related:Terms

On 4you2us, users can also enter personal information about the intended recipient or other people, for example a name or nickname, shared memories, photos, personal stories, answers and audio or video recordings.

In this case the information does not come directly from the data subject but from the creator of the experience.

The creator is responsible for only using content that they are lawfully entitled to use and whose use does not infringe the rights of other people.

We expressly recommend not including unnecessary particularly sensitive or confidential information about other people in experiences.

After an experience is published, 4you2us generates an individual link, for example 4you2us.com/anna. This link allows the creator to share the experience with the intended recipient.

Experiences are generally not listed in a public user gallery on 4you2us and are not intended to be found through a public search function.

A share link is not password protection, however. Anyone who receives the link or to whom it is forwarded may be able to access the experience. Users should therefore only share links with the intended people.

For additional access protection, the creator can use the premium PIN protection feature.

Related:TermsPrices & plans

When a personalized recipient page is accessed, technically necessary access data may be processed.

Depending on the experience, recipients can also voluntarily interact with the content provided, for example by selecting answers, answering questions, playing games, making decisions or entering text.

Where these answers are necessary for the functioning of the experience, they are processed and, where applicable, associated with the respective experience.

Recipients do not need their own 4you2us account to view an experience. Information from the use of a private recipient page does not automatically become a public profile of the recipient.

4you2us creates suggestions for questions, answer options, sentence starters, texts, games and other experience content. These suggestions are currently generated exclusively inside 4you2us from prepared content building blocks; no input is transmitted to an external AI service.

Should external AI services be used in future, we will transparently state the respective provider and the associated data processing here before the feature is activated.

Users should not include unnecessary confidential or particularly sensitive personal data in input for such features.

4you2us may use usage statistics to improve the platform and to provide creators with certain information about their experiences. This may include, for example, the number of views of an experience, the start of an experience, the completion of an experience, the time of access and technical usage information.

We take care to process only the data required for the respective feature.

External analytics or tracking services are currently not in use. Should such services be used, they will only be activated after corresponding consent via the cookie banner and will be added here together with provider and retention period.

4you2us uses cookies and comparable technologies (in particular local storage in the browser). Technically necessary technologies may be required in particular for:

• login
• authentication
• session management
• security
• language settings
• cookie settings
• checkout
• technical functionality

These necessary technologies may be used insofar as they are required for the feature requested by the user.

Optional cookies or comparable technologies – in particular for certain analytics or marketing purposes – are only set after prior consent, where this is legally required. The cookie banner offers “Accept all”, “Reject optional” and “Settings”.

Consent given can be changed or withdrawn at any time with effect for the future via the cookie settings.

If users contact us by email, we process the information they submit in order to handle the enquiry. This may include in particular name, email address, message, time of the enquiry and, where applicable, information about the experience, order or user account.

Depending on the content of the enquiry, the legal basis is in particular Art. 6(1)(b) or (f) GDPR.

We do not sell personal data or private 4you2us content to third parties. For technical operation it may however be necessary to have certain data processed by carefully selected service providers. These may include in particular:

• hosting provider (Lovable)
• cloud, storage and database provider (Supabase)
• authentication provider (Supabase, Google Login)
• Stripe for payment processing, once this is active
• email service providers for sign-in and system messages
• IT and security service providers
• AI providers where applicable, after prior information here
• analytics providers where applicable, after corresponding consent

Where these providers process personal data on our behalf, they are engaged in accordance with statutory requirements, in particular via data processing agreements under Art. 28 GDPR.

Disclosure may also take place where we are legally obliged to do so.

Individual service providers we use may process personal data outside Austria or outside the European Economic Area. This concerns in particular providers based in the USA.

A transfer to a third country only takes place in compliance with the statutory requirements of the GDPR. Depending on the recipient, the transfer may in particular be based on an adequacy decision of the European Commission or on appropriate safeguards such as standard contractual clauses.

The providers actually used are named in section 15; changes will be stated accordingly in this privacy policy.

Users can delete their account via the dedicated function in the settings. A corresponding notice is shown before final deletion.

When the user account is deleted, the associated experiences, uploads and personal content are also deleted or made inaccessible.

Personal data is generally stored only for as long as it is needed for the respective purpose. Excluded from this is data we must retain longer due to legal obligations, in particular invoice data, payment data, accounting records and transaction data relevant for tax purposes.

After deletion, data may also remain in technical backups for a limited period until these are overwritten as part of regular backup cycles. The contractual consequences of account deletion are described in the terms.

Related:Terms

We take appropriate technical and organizational measures to protect personal data against loss, manipulation, unauthorized access and unlawful disclosure. These include in particular encrypted data transmission (HTTPS), access restrictions at database level, authentication and permission and access concepts.

Despite such security measures, absolute protection cannot be guaranteed for data transmissions over the internet.

Under the GDPR, data subjects have in particular the right to access, rectification, erasure, restriction of processing, data portability, objection to certain processing, and the right to withdraw consent given.

Withdrawal of consent takes effect for the future and does not affect the lawfulness of processing carried out up to the withdrawal.

Requests can be sent to office@vailble.at.

A recipient who does not have a 4you2us account can also contact us if they believe that personal data about them is being processed within a 4you2us experience. Requests can be sent to office@vailble.at.

To handle the request we may need information that clearly identifies the experience concerned – for example the link received. Only the information necessary to handle the request will be requested.

Data subjects have the right to lodge a complaint with a data protection supervisory authority.

In Austria: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria.

Related:Austrian Data Protection Authority

We may adapt this privacy policy if features of 4you2us, the service providers used or legal requirements change. The current version is always published on 4you2us.

In addition, the terms and the notices in the legal notice apply.

Related:TermsLegal notice