SoonUp
Back to home

Privacy Policy

This English text is a courtesy translation. Only the German version is legally binding.

1. Who we are and what this policy covers

The controller for the processing described in this policy, within the meaning of Art. 4(7) GDPR, is Soon Up GmbH ("we"). This policy covers:

  • our websites www.soon-up.com and www.philippbaldauf.com,
  • the web app NameSTL at www.namestl.com, including the NameSTL app in ChatGPT, and
  • all apps we publish on the Apple App Store.

Soon Up GmbH, Industriezeile 35, 4020 Linz, Austria. Company register number FN 655382y, Regional Court of Linz. VAT ID ATU82237713. Email: support@soon-up.com.

We have not appointed a data protection officer, as we are not legally required to. For any data protection question, contact us at the email address above.

2. Principles

Personal data is any information relating to an identified or identifiable person, such as a name, email address, IP address or device identifier. We process such data only where there is a legal basis under Art. 6 GDPR (for health data, also Art. 9 GDPR). For each processing activity below we state the purpose and the legal basis. Where we rely on legitimate interests, we also state those interests.

Many of our apps work without sending any data to us: the data stays on your device or in your private iCloud space, which we cannot access. We do not sell personal data. We currently show ads only in the app Lettino. Google receives data there as an independent controller, and for personalised ads only with your consent (section 6.3). We do not make automated decisions within the meaning of Art. 22 GDPR, including profiling.

3. Visiting our websites

3.1 Server log files

When you visit soon-up.com, philippbaldauf.com or namestl.com, our hosting provider processes the access data needed to run the site: IP address, date and time, page requested, amount of data transferred, status code, referring page, browser and operating system. We need this data to deliver the site and fend off attacks. The legal basis is our legitimate interest in stable and secure operation (Art. 6(1)(f) GDPR). We do not combine log files with other data.

3.2 Cookieless visitor statistics

On all our websites we count page views with a cookieless statistics feature of our hosting provider. It stores nothing on your device and does not recognise you on later visits. We only see aggregated numbers such as page views and countries of origin. The legal basis is our legitimate interest in understanding how our websites are used (Art. 6(1)(f) GDPR).

3.3 Country lookup for prices (namestl.com)

On namestl.com our hosting provider derives your approximate country from your IP address. We use it only to show prices in your currency and do not store it (Art. 6(1)(f) GDPR).

3.4 Fonts and external content

We host fonts locally. Loading a page does not connect to Google Fonts. We do not use social media plugins. If we link to other websites, the privacy policy of their operator applies there.

4. Cookies and similar technologies

soon-up.com and philippbaldauf.com set no cookies. namestl.com stores information on your device (cookies, local storage, session storage) or reads it. Under § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), this is allowed without consent only where it is strictly necessary for the service you asked for. Everything else happens only with your consent.

  • Necessary: your login session, your cookie choice and the temporary storage of your current design. Without these, login and the generator do not work. They cannot be switched off.
  • Analytics (only with consent): product analytics with PostHog (PostHog Inc., data stored in the EU). We see which features are used and where errors happen. This includes error reports and session replays under a pseudonymous identifier. Password fields are not recorded.
  • Marketing (only with consent): Google Tag Manager and Google Ads (Google Ireland Limited). These tags measure which ad clicks lead to a purchase and let us show our ads to past visitors on other websites. Google processes some of this data as an independent controller.

The legal basis for analytics and marketing is your consent (§ 165(3) TKG 2021, Art. 6(1)(a) GDPR). Before you decide, the Google Tag Manager script loads with consent signals set to denied (Google Consent Mode). Analytics and advertising cookies are only set after you consent. You can change or withdraw your choice at any time under "Cookie settings" in the footer. Withdrawal applies to the future. The embeddable generator (namestl.com/embed) loads no analytics or marketing services.

5. Contact and support

When you write to us, we process your email address, your name and the content of your message to answer your request. The legal basis is taking steps before or under a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering other requests (Art. 6(1)(f) GDPR). Please do not send us passwords or payment details.

6. Our apps

6.1 Purchases and subscriptions

You buy paid features through the Apple App Store. Apple handles payment as an independent controller. We receive no payment details, only a confirmation of the purchase. To manage subscriptions and show purchase offers, we use service providers that process a pseudonymous purchase and app identifier, the product, price, country and time of purchase. The legal basis is performance of a contract (Art. 6(1)(b) GDPR).

6.2 Analytics, crash reports and campaign measurement

Some apps analyse usage pseudonymously, send crash reports or measure which ad campaign led to an install. This involves device type, operating system, app version, usage events, an app-specific device identifier (IDFV) and, for campaign measurement, purchase amounts. We use Apple's advertising identifier (IDFA) only in Lettino and only if you agree in the iOS prompt (section 6.3). The legal basis is our legitimate interest in improving our apps, fixing errors and measuring the effect of our advertising (Art. 6(1)(f) GDPR). You can object at any time (section 11). If you have agreed in the iOS settings to share analytics with developers, we also receive aggregated statistics from Apple.

6.3 Ads in Lettino

Lettino is free and funded by ads. We show video ads you can choose to watch for a reward, and ads between rounds. They are served by Google AdMob (Google Ireland Limited, Ireland).

Before any ad loads, users in the EEA see Google's consent form (a Google-certified consent management platform under the IAB TCF standard). It asks whether Google may store and read information on your device and personalise ads. Before the first ad, iOS also asks whether Lettino may use your advertising identifier (IDFA) (App Tracking Transparency).

This involves in particular your IP address, device and app information, advertising identifiers (the IDFA only if you agree in the iOS prompt) and your interactions with ads. Google uses this data as an independent controller to serve and measure ads, prevent fraud and, if you agree, personalise ads. If you decline or refuse tracking, you see non-personalised ads. The legal basis is your consent (§ 165(3) TKG 2021, Art. 6(1)(a) GDPR). Google also processes data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework. Google explains how it uses data from apps at policies.google.com/technologies/partner-sites.

You can change or withdraw your consent at any time under "Privacy settings" in the app's shop (Offers tab). You control access to your advertising identifier in the iOS settings under Privacy & Security > Tracking. The app reports ad views and ad revenue pseudonymously to our purchase management provider so we can evaluate revenue (Art. 6(1)(f) GDPR).

6.4 Permissions and storage

If an app asks for access to the camera, microphone, location, calendar, Bluetooth or Health, it uses that data only for the feature in question and, as a rule, only on your device. You can revoke any access in the iOS settings. If an app syncs via iCloud, the data sits in your private iCloud space at Apple. We cannot access it. The privacy details on each app's App Store page also show what data the app uses.

6.5 Notes on individual apps

  • Pawcer: reads your step count from Apple Health with your explicit consent. We process health data only on that basis (Art. 9(2)(a) GDPR). AR photos stay on your device.
  • Binge Control: what you log about drinking is health data. We process it only with your explicit consent (Art. 9(2)(a) GDPR), on your devices and in your private iCloud space.
  • Doculla: the text recognised from a scan (not the image of the document) is sent to an AI provider in the USA to create a title and summary. The legal basis is our legitimate interest in offering this convenience feature (Art. 6(1)(f) GDPR).
  • Oldtimer Co-Pilot: tours you publish are visible to other users with route, elevation profile and location. Private drives stay in your iCloud space. We use a database provider for accounts and published tours.
  • Rally Co-Pilot: connects to an external GPS sensor via Bluetooth and scans road books with the camera, both on the device. For the optional mailing list we store your email address on our own server and confirm sign-up by double opt-in. You can unsubscribe via the link in every message.
  • Firnexa: shows public data from the Austrian company register, provided through the JustizOnline portal of the Federal Ministry of Justice as a high-value dataset under Implementing Regulation (EU) 2023/138. We process this register data on the basis of Art. 6(1)(f) GDPR. Source: Federal Ministry of Justice, company register. The display is not an official register extract.
  • Myohren: amplifies sound in real time. The audio is neither recorded nor stored. Live transcription runs on the device.
  • Lettino, Snowball Mania and The Steam Punk Labyrinth Game: if you use Game Center, Apple processes your player ID, achievements and scores as an independent controller. In Lettino's online duels, Apple exchanges your game inputs with the other players, and they see your Game Center name.
  • Affiliate links: Myohren and Rally Co-Pilot contain affiliate links, for example to Amazon. If you buy through such a link, the retailer may pay us a commission. We receive no data that identifies you.
  • Apps that send no data: Priobs, CalAlarms, Greencard, ABCDEF Keyboard, The Anchors, Fall Asleep Baby, Hold Breath Longer and RMMBA process your input only on the device and send nothing to us or third parties apart from purchase confirmations.

7. NameSTL (namestl.com)

NameSTL lets you design names as 3D models and export them as STL or 3MF files for 3D printing.

7.1 Designing in the browser

Name text, font, colours, size and base are processed in your browser. The print files are created there too. Our servers only receive these settings when you save a project to your account.

7.2 Account

You need an account to save projects and export. You sign up with an email address and password, or sign in with Google or Apple. In the latter case we receive your email address and an identifier from that provider. We store your email address, account ID, your projects, a customer reference from our payment provider and, where applicable, free export access we have granted. Passwords are stored only as hashes. We send account emails, such as the link to set your password, through an email provider with a data centre in Frankfurt. The legal basis is performance of a contract (Art. 6(1)(b) GDPR). Without this data we cannot run an account.

7.3 Payments

One-time purchases and subscriptions are handled by Stripe (Stripe Payments Europe, Ltd., Ireland). Stripe processes your name, email address, payment details and, where applicable, your billing address, and is itself responsible for payment processing, fraud prevention and its own legal obligations. We receive no card details, only the result of the payment and a customer reference. The legal basis is performance of a contract (Art. 6(1)(b) GDPR) and, for receipts, our legal retention obligation (Art. 6(1)(c) GDPR).

7.4 NameSTL in ChatGPT

If you use NameSTL in ChatGPT, OpenAI processes the conversation as an independent controller. We receive the design settings you ask for. If you connect your account, we also get access to your saved projects and your export access. Access tokens expire after one hour and refresh tokens after 30 days, and we store them only as hashes. To prevent abuse, we keep salted hashes of network identifiers for at most one day, and no plain IP addresses. More at www.namestl.com/chatgpt/privacy.

7.5 Affiliate link to Treatstock

NameSTL links to the print service Treatstock. If you order there, Treatstock may pay us a commission. We receive no data that identifies you. Treatstock is itself responsible for your order.

7.6 Purchase and sign-up events

When you buy or create an account, our servers send this event with your account ID or email address to our product analytics tool. This lets us match payments to the right account and find errors in checkout. It happens regardless of your cookie choice, because nothing is stored on your device. The legal basis is our legitimate interest in a working checkout (Art. 6(1)(f) GDPR). You can object (section 11).

8. Recipients

8.1 Processors

We use carefully selected service providers that process data only on our instructions and with whom we have contracts under Art. 28 GDPR. They may not use the data for their own purposes. They fall into these categories:

  • Hosting, content delivery and domain management (EU and USA)
  • Database, sign-in and account storage (EU or USA)
  • Email delivery (EU)
  • Managing purchases and subscriptions, showing purchase offers and evaluating ad revenue in apps (USA)
  • Product analytics, crash reporting and performance monitoring (EU and USA)
  • Ad campaign measurement for apps (EU)
  • AI-assisted text generation for individual app features (USA)

On request we will tell you every individual provider that processes your data.

8.2 Independent controllers

The following recipients process data as independent controllers under their own privacy policies:

  • Apple Distribution International Ltd., Ireland: App Store, in-app purchases, Sign in with Apple, iCloud and Game Center.
  • Google Ireland Limited, Ireland: Sign in with Google on namestl.com and, where you have consented, Google Ads on namestl.com and personalised ads via Google AdMob in Lettino. Google also serves non-personalised ads in Lettino as an independent controller.
  • Stripe Payments Europe, Ltd., Ireland: payments on namestl.com.
  • OpenAI: the conversation, if you use NameSTL in ChatGPT.
  • Treatstock: print orders you place there.

Beyond this, we only pass on data where the law requires it, for example to authorities or courts, or where it is needed to enforce our rights.

9. Transfers outside the EEA

Some providers are based in the USA or access data from there. We transfer data to countries outside the EEA only where an adequate level of protection is ensured:

  • Adequacy decision: the recipient is certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023, Art. 45 GDPR). You can check certification at www.dataprivacyframework.gov.
  • Standard contractual clauses: with recipients that are not certified, we have agreed the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

You can request a copy of the relevant safeguards at support@soon-up.com.

10. Retention

We keep data only as long as we need it for the purpose in question:

  • Account and saved content: until you delete it. In NameSTL and in apps with accounts you can delete your account yourself. This also deletes your projects or content and cancels any active NameSTL subscription.
  • Payment records and invoices: seven years from the end of the financial year (§ 132 BAO, § 212 UGB).
  • Support requests: until your request is resolved, then within legal retention obligations or as long as possible claims have not expired.
  • NameSTL in ChatGPT: connection requests ten minutes, authorisation codes one minute, access tokens one hour, refresh tokens 30 days, download links ten minutes, abuse protection at most one day.
  • Analytics and marketing cookies: until you withdraw your consent. The cookies themselves expire after at most one year (PostHog) or 90 days (Google Ads).
  • Server log files: only as long as our hosting provider keeps them for operation and security, after which they are deleted automatically.

11. Your rights

Under the GDPR you have the following rights:

  • Access: which data we process about you, for what purpose and to whom we pass it, including the specific recipients (Art. 15 GDPR).
  • Rectification of inaccurate or incomplete data (Art. 16 GDPR).
  • Erasure of your data where the conditions of Art. 17 GDPR are met.
  • Restriction of processing under the conditions of Art. 18 GDPR.
  • Portability of the data you gave us, in a common machine-readable format (Art. 20 GDPR).
  • Objection: you can object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 21 GDPR).
  • Withdrawal: you can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR).

Write to support@soon-up.com. We reply within one month and may verify your identity before giving access.

You can also complain to the supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria, dsb@dsb.gv.at, www.dsb.gv.at.

12. Security

We protect your data with technical and organisational measures, including encrypted transmission (TLS), access restrictions, hashed passwords and tokens, and access rules at database level. We keep these measures up to date with the state of the art.

13. Changes

We update this policy when our services or the law change. The version published at soon-up.com/privacy applies. We will inform you in advance in the app or on the website about material changes that require your consent.

Last updated: October 2026