Sixtap

This is a translation, provided so you can read it. The binding version is the German one: the provider, the contract and the place of jurisdiction are German, and no translation can replace the legal terms behind words like "Widerruf" or "Verbraucher".

Privacy policy

Version: September 2026

1. Controller

Altovate GmbH, Max-Planck-Str. 6, 54439 Saarburg, Germany, represented by Alexander Buchmann.
Email: info@altovate.de, phone: +49 (0) 6581 987 65 43.

2. Overview

Sixtap (sixtap.net) sells digital content only (personalised STL files) and operates a QR code redirect for the buyers of those files. There is no physical shipment.

3. Hosting and database (Supabase)

We use Supabase for the database, authentication and server-side functions. Operation takes place in the EU region Frankfurt am Main. A data processing agreement under Art. 28 GDPR is in place with the provider. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (f) GDPR (legitimate interest in secure operation).

4. Ordering and payment (Stripe)

We use Stripe Payments Europe, Ltd. (Ireland) to process payments. Order and payment data are processed (email address, amount, payment method, billing address). The legal basis is Art. 6 (1) (b) GDPR. Transfer to Stripe group companies in the USA is possible; it takes place on the basis of the EU standard contractual clauses (Art. 46 (2) (c) GDPR).

5. Customer account and magic link sign-in

Signing in works via a link sent by email, without a password. Your email address is processed for authentication. The legal basis is Art. 6 (1) (b) GDPR. No password is stored.

6. QR code redirect and scan counting

Every purchased plate carries a QR code pointing to a short address on our domain. When it is scanned, we forward the request server-side to the destination stored by the buyer and count it.

In doing so we collect and store only:

  • the slug, that is the identifier of the individual plate,
  • the time of the request.

We expressly do not collect: IP address, user agent, referrer, location or country data, cookies or any other device identifiers. This data is never captured in the first place.

Legal assessment: the slug and timestamp do not allow us to draw any conclusion about the identity of the person scanning. In relation to that person there is therefore no processing of personal data within the meaning of Art. 4 (1) GDPR. In relation to the buyer we process the aggregated scan counts to perform the contract, Art. 6 (1) (b) GDPR.

No cookie banner required: the redirect sets no cookies, reads no information stored on the device and performs no fingerprinting. Section 25 TDDDG does not apply to the scanning and redirect process.

7. Google Tag Manager and Google Analytics 4

We use Google Tag Manager with Google Analytics 4 (Google Ireland Limited) only after your express consent via the consent banner (Consent Mode v2). Without consent these services remain completely disabled; no cookies are set and no requests are sent to Google. The legal basis is Art. 6 (1) (a) GDPR in conjunction with section 25 (1) TDDDG. You may withdraw your consent at any time with effect for the future.

8. Recipients

Our processors are Supabase (database and hosting), Stripe (payment) and — only where consent has been given — Google (analytics). No transfer to other third parties takes place unless we are legally obliged to do so.

9. Storage periods

  • Order and payment data: for the duration of statutory retention periods under the HGB and AO, as a rule ten years.
  • Customer account and redirect data: for the duration of the contractual relationship, see § 7 of the terms and conditions.
  • Consent records for analytics: until withdrawal.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6 (1) (f) GDPR (Art. 21). You may also lodge a complaint with a supervisory authority; the competent authority is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate.

11. Necessity of providing data

Providing your email address is necessary to create an account, sign in and perform the contract. Without it we cannot carry out the contract.

12. No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.