Privacy policy
In short: without an account, your value stream maps stay in your browser. Detailed analytics (Google Analytics, Microsoft Clarity) run only with your consent; without consent we only count page views anonymously and without cookies. The site is hosted on Cloudflare; the database is located in the EU. The operator is a German company, so the EU General Data Protection Regulation (GDPR) applies to all visitors, including visitors from the United States.
1. Controller
C-led Solutions GmbH, Feringastraße 9a, 85774 Unterföhring, Germany. Managing directors: Thomas Rosenstiel, Erik Reisig. Email: [email protected], phone: +49 89 809 1314 60. More details in the legal notice.
2. Hosting, delivery, server logs and audience measurement
The application runs on Cloudflare (Pages, Workers, D1 database, R2 object storage, Durable Objects). When you open the site, Cloudflare processes technically necessary data such as IP address, time, requested URL, browser identifier and referrer to deliver the site and fend off attacks. The legal basis is Art. 6 (1) (f) GDPR (secure and stable operation).
Cloudflare, Inc. (101 Townsend St, San Francisco, USA) processes this data as our processor under Art. 28 GDPR on the basis of the Cloudflare Data Processing Addendum including the EU Standard Contractual Clauses. Cloudflare is certified under the EU-U.S. Data Privacy Framework. The database is set up in the EU region.
For simple audience measurement we use Cloudflare Web Analytics. A small script from static.cloudflareinsights.com sends the page visited, referrer, browser type, country and load times to Cloudflare. It sets no cookies, stores nothing on your device, does no fingerprinting and builds no profiles across visits; we only see aggregated numbers such as page views per day. The legal basis is our legitimate interest in privacy-friendly audience measurement (Art. 6 (1) (f) GDPR). You can object, for example by blocking static.cloudflareinsights.com with a content blocker; the site keeps working unchanged.
3. Use without an account
Without an account, the editor stores your value stream maps only in your browser's local storage (localStorage). Content is not sent to us unless you deliberately create a share or live link. Your language setting, view options and your analytics choice are also stored locally. This storage is strictly necessary for the function you request (Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).
4. Account and cloud storage
When you sign in, we store your email address and, optionally, a display name and branding (company name, logo). Sign-in uses a one-time 6-digit code sent by email; there are no passwords. The session is kept as a hashed token in an HttpOnly cookie for 30 days.
Saved value streams, versions, tags, folders, comments, action items and uploaded background photos are stored in the database or object storage and are visible only to your account. The legal basis is Art. 6 (1) (b) GDPR (provision of the service).
5. Share and live links, mobile data collection
Share links show a value stream read-only, without an account. Guests can optionally leave comments with a name; to prevent abuse we store the IP address only as a hash. Live links allow joint editing; guests enter a display name that other participants see. With mobile data collection, measurements and notes are transferred to the value stream of the account. All links are random 144-bit tokens and the owner can end them at any time.
6. Emails and feedback
We send system emails (sign-in codes, comment notifications, action item reminders) via Cloudflare Email Sending from [email protected]. Feedback from the editor is stored with category, text, an optional email address and technical figures (without the content of your value stream) and forwarded to our team by email. The legal basis is Art. 6 (1) (b) or (f) GDPR.
7. Analytics with Google Analytics and Microsoft Clarity (only with consent)
Only if you choose "Allow analytics" in the notice do we load Google Analytics 4 from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It records pseudonymous usage events such as pages visited, features used (for example export format, analysis opened, type of symbol added, video started), device type and the shortened IP address, and it sets cookies. Only fixed categories and counts are sent; the content of your value streams (titles, names, numbers, comments) and email addresses are never sent.
With the same consent we load Microsoft Clarity from Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Clarity records how the interface is used (mouse movements, clicks, scrolling, page layout) and creates heatmaps and session recordings so we can spot usability problems. In the editor, all content is masked in the browser before it is sent; only controls such as menus and buttons remain readable. Clarity sets cookies (_clck for up to one year, _clsk for one day).
Both services may transfer data to the USA; Google and Microsoft are certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. It covers the editor and the learning center and can be withdrawn at any time via "Cookie settings" in the footer; the services are then switched off and their cookies deleted. Without consent neither service is loaded, and everything works the same.
8. Fonts and external content
We serve fonts ourselves; no connection is made to Google Fonts or other font providers. Links to c-led.net and other sites connect to the respective provider only when you click them. For embedded videos see section 9.
9. Embedded YouTube videos
In the learning center we embed videos from our YouTube channel. When the page loads, only a preview image from our own server is shown; no connection to YouTube is made. Only when you click "Play video" does your browser load the YouTube player in privacy-enhanced mode (youtube-nocookie.com). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
After the click, Google receives, among other things, your IP address, the page visited and browser data, and may store or read information on your device. If you are signed in to Google, playback may be linked to your account. Data may be transferred to the USA; Google is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent by clicking, Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. Without the click no data is sent to YouTube; you can also watch the videos directly on YouTube.
10. Business contact data for outreach
We occasionally contact professionals in lean manufacturing, operations and continuous improvement by email to introduce the free tool and ask for feedback. For this we process name, business email address, job title, company and, where available, the source where we found this information (for example a company website or a public conference program). The legal basis is our legitimate interest in introducing a free tool to a professional audience (Art. 6 (1) (f) GDPR). Every such email names the sender, includes our postal address and offers a one-click way to opt out.
If you opt out or object, we stop contacting you immediately and keep only your email address on a suppression list so that you are not contacted again. Contact data without a reply is deleted no later than six months after the last email. You can object at any time by replying to the email or writing to [email protected].
11. Retention
Value streams remain stored until you delete them; versions, shares, comments and photos are removed with them. Sign-in codes expire after 10 minutes, sessions after 30 days. To delete your whole account, an email to [email protected] is enough. We delete feedback once it has been handled and is no longer needed.
12. Security
Data is transmitted only in encrypted form (TLS, HSTS) and stored encrypted at Cloudflare. Sign-in codes and session tokens are stored only as hashes. Write requests are protected against cross-site request forgery (CSRF). Only the administrators of C-led Solutions GmbH have access to the production environment, with two-factor authentication.
13. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20; in the editor as a JSON export per value stream) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. You can lodge a complaint with a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
14. No automated decision-making
There is no automated decision-making, including profiling, under Art. 22 GDPR.