Privacy Policy

Who is responsible

Nubri GmbH, Liebenowzeile 22, 12167 Berlin, Germany, runs StyleGrab and is the controller of the personal data described here. Contact: info@nubri.co.

What we process

• Your account: email address and an Argon2 hash of your password. API keys are stored as SHA-256 hashes.
• Extractions: the URLs you submit, and the design tokens, snapshots and diffs we produce from them. Our server opens each URL in a headless browser to read its styles; the site you point it at sees our server, not you.
• AI analyses (Pro and Team): the extracted tokens and CSS are sent to Anthropic's Claude on Amazon Bedrock when you ask for an analysis, an accessibility check or a diff explanation. We keep a count of your requests, not their content.
• Webhooks you configure: we send change notifications to the URL you give us.
• Payments: handled by Stripe; we receive a customer reference and your subscription status, not your card details.
• Site analytics: our pages keep a random visitor id and the link that brought you in your browser's local storage and send page events to our own server. No third-party analytics or advertising tools.
• Technical data: IP addresses and request details in server logs, also used to limit abuse.
• Messages you send us through the contact form or by email.

Why, and on what legal basis

To provide the service you signed up for (Art. 6(1)(b) GDPR) and to keep it secure and free of abuse and improve it, which is our legitimate interest (Art. 6(1)(f) GDPR).

Processors

• Amazon Web Services (hosting, email delivery, and Claude on Amazon Bedrock), United States.
• Stripe (payments), United States.

Transfers to the United States rely on the EU Standard Contractual Clauses.

How long we keep it

Your account, extractions and history are kept while your account exists. You can delete your account and all its data at any time in Settings; payment records are kept as long as the law requires.

Cookies and local storage

StyleGrab sets no cookies. Your sign-in is kept in your browser's local storage, together with the visitor id and first-visit source described above.

Server logs

When you open any page, our web server records your IP address, the time, the address requested, the response and your browser's user agent. We use these logs only to keep the service secure and to find faults (Art. 6(1)(f) GDPR). They are deleted automatically after at most 8 days.

Your rights

You can ask for access to your data, its correction or deletion, restriction of processing, a copy in a portable format, and you can object to processing based on legitimate interests. Email info@nubri.co. You may also complain to a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.