Privacy Policy

The Black Line · Last updated: November 1, 2026

This policy explains how we handle personal data when you visit our website, write to us, request early access, or use The Black Line as a studio. We wrote it to be read, not skimmed past.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Roberto Panciatici, trading as The Black Line
Missing: business address for service of documents (c/o, never a home address)
Germany
Email: info@robertopanciatici.com

Full provider details are in our Imprint.

We are not required to appoint a data protection officer (§ 38 German Federal Data Protection Act, BDSG). Write to the address above for anything about your data.

2. Two roles, kept apart

• Visitors, early-access applicants and studios. For your data we decide why and how it is processed: we are the controller, and this policy applies.
• The clients of a studio (couples, families, companies a studio works for). Their data is entered and used by the studio. The studio is the controller; we only process that data on the studio's instructions, as a processor under our Data Processing Agreement. If you are a client of a studio, please contact the studio first: it decides about your data. See section 10.

3. Visiting the website

What. When you open a page, our server receives the technical data every browser sends: IP address, date and time, page requested, referrer, browser and operating system.

Why and on what basis. To deliver the page and keep the site secure (Art. 6 (1) (f) GDPR: our legitimate interest in a working, secure website).

How long. Only as long as needed for these purposes; server logs are deleted regularly, unless a specific entry is needed to investigate an attack.

No tracking. The website sets no cookies, uses no analytics, no advertising pixels and no third-party fonts or scripts; fonts are served from our own server. Our contact and early-access forms work the same way: no cookies, no CAPTCHA, no third-party scripts. Because nothing is stored on or read from your device beyond what is strictly necessary to show the page, no consent banner is needed (§ 25 (2) German TDDDG). If this ever changes, we will ask for your consent first and update this policy.

Hosting. The website and the Service run on servers of Hetzner Online GmbH in Falkenstein, Germany, under a data processing agreement.

4. Contacting us

What. When you write to us through the contact form at /contact/ we receive your name, your email address, your studio or brand if you give it, the topic you choose, your message, and the fact that you agreed to this section, with the date and time. To keep the form free of spam without tracking you, our server briefly uses your IP address: it keeps only a scrambled fingerprint of it (a keyed hash that cannot be turned back into the address) for at most 24 hours, and never stores the address itself.

Why and on what basis. To read and answer your message, and to follow up on what you asked for (Art. 6 (1) (b) GDPR where your message concerns using The Black Line; otherwise Art. 6 (1) (f): our legitimate interest in answering the people who write to us). The spam protection relies on our legitimate interest in keeping the form usable and our inbox safe (Art. 6 (1) (f)). If you write to us by email instead, the same applies.

What the form does not do. It sets no cookies, uses no CAPTCHA or other third-party script, and does not add you to any newsletter or mailing list. The confirmation email you receive is sent once, because you asked to be contacted; we send nothing else from the form.

How long. The form itself stores nothing: your message is delivered by email to our inbox and is not kept on the form's server. In our inbox we keep it as long as we need it to answer you and follow up, and delete it at the latest 12 months after our last exchange. If your message leads to a contract, it becomes business correspondence and is kept for the legal period (6 years from the end of the calendar year, § 257 German Commercial Code).

Who helps. The form runs on our own servers at Hetzner Online GmbH in Germany; the emails are delivered through the email provider listed in section 7.

5. Requesting early access

What. When you request early access at /early-access/ we receive your name, your studio's name, your email address, your country, the software you use today if you tell us, and your consent, with the date and time. For spam protection the form uses the same short-lived IP fingerprint as the contact form (section 4).

Why and on what basis. To check that the email address is yours (double opt-in: we send one email with a confirmation link), and to invite you when we open your studio (Art. 6 (1) (a) GDPR: your consent; Art. 6 (1) (b): steps you asked for before a contract). We send you nothing else: no newsletter, no marketing.

How long. If you don't confirm within 7 days, your request is deleted automatically. Once confirmed, we keep it until we open your studio or you tell us you're no longer interested, and delete it automatically 12 months after you confirmed at the latest. You can withdraw your consent at any time by replying to any of our emails or writing to info@robertopanciatici.com; we then delete your request.

Who helps. The requests are stored on our own servers at Hetzner Online GmbH in Germany; the emails are delivered through the email provider listed in section 7.

6. Using The Black Line as a studio

What.

• Account data: name, email, password (stored only as a hash), role, language; if you sign in with Google, your Google account ID, name and email.
• Studio data: studio name, address, VAT and tax details, logo and brand settings, bank or payment details you choose to show your clients.
• Subscription and billing data: plan, invoices, payment status; payment card data is handled by Stripe and never reaches us.
• Usage and security data: sign-ins, actions in the studio (an event log), IP address and device, API keys and connected AI assistants.
• Support: what you write to us.

Why and on what basis.

• To provide the Service you signed up for, run your account and bill your subscription (Art. 6 (1) (b) GDPR).
• To keep the Service secure, detect misuse and prove who did what in a studio (Art. 6 (1) (f) GDPR: legitimate interest in security and accountability).
• To keep invoices and accounting records (Art. 6 (1) (c) GDPR with § 147 German Fiscal Code and § 257 German Commercial Code).
• To send you service emails (account, security, billing, changes to these terms) (Art. 6 (1) (b)). Product news only if you opt in (Art. 6 (1) (a)).

How long.

• Account and studio data: for the duration of the subscription, then 90 days read-only for your export, then deletion (see our Terms, section 7).
• Event log entries (including IP address and device): kept as long as the studio's records they relate to.
• Invoices and accounting records: 8 years; business correspondence: 6 years, from the end of the calendar year (§ 147 AO, § 257 HGB).
• Backups: deleted when they are overwritten in their regular cycle.

7. Recipients and sub-processors

We share personal data only with service providers that help us run the Service and are bound by contract, or where the law requires it. The current list, with purpose and location, is on our Subprocessors page. In short:

Independent controllers. Some services you choose to connect act on their own responsibility, not on our behalf: Google LLC for "Sign in with Google" and Google Calendar (under Google's API terms), Stripe for its own fraud-prevention and legal obligations, PayPal (Europe) S.à r.l. et Cie, S.C.A. when your clients pay you through a PayPal link. Their own privacy policies apply.

Not personal data. To show Bitcoin amounts we request public exchange rates from CoinGecko and Kraken; no personal data is sent.

8. Transfers outside the EU

Some providers, or their parent companies, are in the United States. Where data reaches the US, we rely on the EU-US Data Privacy Framework (Commission Decision (EU) 2023/1795) for certified companies (Google, Stripe) and on the Standard Contractual Clauses (Commission Decision (EU) 2021/914) for the others (Anthropic). You can ask us for a copy of the safeguards.

9. Your rights

You have the right to:

• access your data and get a copy (Art. 15 GDPR);
• rectification (Art. 16);
• erasure (Art. 17) and restriction (Art. 18), within the limits of the legal retention periods;
• data portability (Art. 20): on request we provide your data in a machine-readable format;
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time, without affecting what happened before (Art. 7 (3)).

Write to info@robertopanciatici.com. We answer within one month.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), for example ours: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, https://www.datenschutz-berlin.de.

We do not use your data for automated decisions that have legal or similarly significant effects on you (Art. 22).

10. If you are a client of a studio

The studio you work with uses The Black Line to manage your booking: contract, signature, questionnaire, payments, Client Lounge. The studio is responsible for your data and its own privacy notice applies; you find it in the pages and emails the studio sends you. We process your data only on the studio's instructions, on servers in Germany, and we do not use it for our own purposes, for advertising or to train AI models.

If you write to us, we forward your request to the studio without delay and help the studio answer it.

11. Security

We protect data with encryption in transit (HTTPS/TLS), servers in Germany, separation of each studio's data, role-based access inside each studio, encryption of stored access credentials, an append-only event log, regular backups, and a procedure for data breaches. Details are in Annex 2 of our DPA.

12. Changes

We update this policy when our processing changes. The date at the top shows the current version; studios are told by email about material changes.