Privacy policy
This notice explains how 10XSheets (“we”, “us”) processes personal data when you use www.10xsheets.com and related services. It is designed to meet core transparency expectations under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), together with applicable rules on telemedia and terminal equipment access (in particular the German TTDSG) where storage or access to information on your device occurs.
1. Controller
The controller responsible for processing personal data within the meaning of Art. 4 No. 7 GDPR is:
- 10XSheets — operated as a German sole proprietorship (Einzelunternehmen). The legally responsible proprietor is identified on our Imprint (German transparency rules).
- 10437 Berlin Germany
- Email: hello@10xsheets.com
- Gemäß § 19 UStG wird keine Umsatzsteuer berechnet.
2. Scope and territorial application
We process personal data of visitors and customers in the European Economic Area and elsewhere where our services are accessed. Where the GDPR applies, you benefit from the rights described in Section 9. Where German sector-specific rules apply (for example provisions relevant to electronic commerce and provider identification), our Imprint and purchase-related notices complement this policy.
3. Categories of personal data, purposes, and legal bases (Art. 13 para. 1 lit. c and d GDPR)
We process personal data only where a legal basis applies. Typical processing involved in operating this website and selling digital templates includes:
| Data category (examples) | Purpose | Legal basis |
|---|---|---|
| Technical connection data (e.g., IP address, timestamps, referrer, user agent), security and abuse signals | Delivering the website over HTTPS; protecting infrastructure; diagnosing outages; defending against malicious traffic | Legitimate interests (Art. 6 para. 1 lit. f GDPR)—balanced against your rights—or, where strictly necessary for a requested service, performance steps prior to contract (Art. 6 para. 1 lit. b GDPR) |
| Purchase and billing data processed when you buy templates through our checkout provider (for example name, email, payment-related identifiers as processed by the payment platform) | Performing the purchase contract; issuing access to digital goods; customer support | Performance of a contract (Art. 6 para. 1 lit. b GDPR); compliance with legal obligations such as tax and accounting retention where applicable (Art. 6 para. 1 lit. c GDPR) |
| Communication content you voluntarily send by email (and metadata necessary to reply) | Handling inquiries, support, and contractual correspondence | Contract (Art. 6 para. 1 lit. b GDPR) and/or legitimate interests in responding to business correspondence (Art. 6 para. 1 lit. f GDPR) |
| Locally stored preference for appearance (light/dark theme) | Remembering UI preference without creating an account | Strictly necessary storage/access under applicable ePrivacy rules (TTDSG / EU ePrivacy Directive regime)—where consent is not required because the storage is essential to provide the service you request |
| First-party cookie storing your analytics and marketing (ads) consent choices (via the cookie banner / settings) | Remembering whether you accepted or rejected optional analytics and advertising-related storage for a limited period | Consent (Art. 6 para. 1 lit. a GDPR) where we ask for consent; otherwise documented in our Cookies page |
| Google Tag Manager / Google Analytics 4 measurement on this marketing site (when enabled) | Understanding aggregate traffic and navigation to improve content and product discovery (no behavioral advertising tags in the current configuration) | Consent (Art. 6 para. 1 lit. a GDPR) where required before non-essential analytics storage is used; you can withdraw or change your choice via Cookie settings |
| Newsletter subscription data (only when the signup is activated and connected to a mailing provider) | Sending product updates you opted into | Consent (Art. 6 para. 1 lit. a GDPR)—until withdrawn |
We do not use behavioral advertising trackers on this marketing site in the current GTM configuration. We may use Google Analytics 4 for aggregate measurement when you allow analytics cookies. A first-party banner and (see footer) let you accept, reject, or change that choice where applicable. Details: Cookies. If our use of cookies or similar technologies changes materially, we will update this notice accordingly.
4. Hosting and infrastructure
The site is hosted on Vercel (Vercel Inc.), which provides the application platform, global edge network, TLS termination, and related infrastructure. Depending on configuration, Vercel may process limited technical data (for example request and deployment logs) as described in its privacy documentation: Vercel Privacy Policy.
5. Payments and digital delivery (Lemon Squeezy)
Purchases are completed through checkout operated by Lemon Squeezy, which handles payment processing and fulfillment workflows for digital products. Depending on product configuration, Lemon Squeezy may act as merchant of record for applicable taxes and receipts. Personal data entered at checkout is processed under Lemon Squeezy's agreements and privacy notice in addition to our contractual relationship with you: Lemon Squeezy Privacy Policy. We receive information necessary to validate purchases and provide support.
6. No profiling or automated decision-making
We do not carry out automated decision-making within the meaning of Art. 22 GDPR based on the website today.
7. Recipients and processors
We share personal data only where necessary with infrastructure and payment/service providers acting on documented instructions (Art. 28 GDPR where applicable), including hosting/CDN providers and our payment/checkout partner. We do not sell personal data.
8. International transfers (Art. 13 para. 1 lit. f and Art. 46 GDPR)
Providers may process data in the EU/EEA and/or other countries. Where personal data are transferred to countries without an adequacy decision, transfers rely on appropriate safeguards—typically the EU Standard Contractual Clauses—and supplementary measures where required by case law and regulatory guidance.
9. Storage periods
We retain personal data only as long as necessary for the purposes collected—unless longer retention is required by law (for example commercial or tax retention for invoices). Technical logs may be kept for short rolling periods for security unless incident investigation requires longer retention.
10. Your rights (Arts. 15–21 GDPR)
Subject to legal conditions, you may have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21). Where processing is based on consent (Art. 6 para. 1 lit. a), you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Requests may be sent to hello@10xsheets.com. We may need to verify your identity before fulfilling certain requests.
11. Right to lodge a complaint
Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority—particularly in the Member State of your habitual residence, place of work, or an alleged infringement (Art. 77 GDPR).
If your usual place of residence or work is in Germany, you may contact your competent state data protection authority (Landesbehörde). Because our registered office is in Berlin, the authority responsible for us is typically the Berlin Commissioner for Data Protection and Freedom of Information (site largely in German). For other German states, the federal commissioner publishes a directory of state supervisory authorities.
12. Children
Our offers are aimed at adults and businesses. We do not knowingly solicit personal data from children under 16 through this website.
13. Changes
We update this policy when features, providers, or legal requirements change. The latest version is always posted at this URL with the last updated date shown below.
Last updated: 19 April 2026.
Related pages: Imprint, Cancellation & refunds, Payment methods.