From Calculator Studio to Airrange → See how easy migration can be
EnglishDeutsch
Book a DemoTry it free
Start

Privacy Policy

Last updated: 19 August 2026

This privacy policy applies to the websites airrange.io and spreadapi.io as well as to the airrange and SpreadAPI services.

1. Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

airrange software GmbH
Sperberweg 7
82152 Krailling, Germany
E-mail: privacy@airrange.io
Commercial register: HRB 271683, local court of Munich

We have not appointed a data protection officer, as the statutory requirements for a mandatory appointment do not apply. For all data protection matters, you can reach us at privacy@airrange.io.

2. Your rights as a data subject

With regard to your personal data, you have the following rights against us:

  • Access to the data we store about you and its processing (Art. 15 GDPR),
  • Rectification of inaccurate personal data (Art. 16 GDPR),
  • Erasure of your data stored by us (Art. 17 GDPR),
  • Restriction of processing where we may not yet delete your data due to legal obligations (Art. 18 GDPR),
  • Data portability (Art. 20 GDPR), and
  • Objection to the processing of your data (Art. 21 GDPR).

You may withdraw any consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach, Germany.

3. Visiting our websites

Our websites are hosted by Vercel Inc., Covina, California, USA. When you access a page, Vercel automatically processes technical access data on our behalf (IP address, date and time of access, page accessed, browser and device type) in server log files. This processing serves the secure and stable operation of the website, error analysis and the prevention of attacks; the legal basis is our legitimate interest (Art. 6 (1) (f) GDPR). Log data is retained only for a short period (a few days) and then deleted automatically. A data processing agreement is in place with Vercel; Vercel is certified under the EU-U.S. Data Privacy Framework (DPF).

Our websites do not use cookies. A cookie banner is therefore not required.

4. Audience measurement (Vercel Analytics)

We use Vercel Analytics to measure the use of our websites. The measurement works without cookies and without cross-device user profiles; page views are evaluated in aggregate and are not shared with advertising networks. The legal basis is our legitimate interest in improving our services (Art. 6 (1) (f) GDPR).

5. Fonts and videos

The fonts used on our websites are self-hosted. No connection to Google or other font providers is established when pages load.

For product videos we use the Wistia service of Wistia Inc., Cambridge, Massachusetts, USA. As soon as an embedded video appears in the visible area of your browser, a connection to Wistia servers is established and your IP address is transmitted. We use Wistia's Do-Not-Track mode: no cookies are set and no viewing behavior is analyzed. The legal basis is our legitimate interest in an appealing presentation of our services (Art. 6 (1) (f) GDPR). Wistia is certified under the EU-U.S. Data Privacy Framework.

6. Registration and login

For signing in to airrange and SpreadAPI we use the authentication service Hanko (FIDO2-certified, hosted in the EU). Sign-in is passwordless via e-mail passcode, via your Google account or — for SpreadAPI — via passkey; passkey credentials remain on your device.

Upon registration we collect and store your e-mail address only. When you sign in via Google, Google transmits additional profile data (in particular your name); we do not store this data. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR). Without an e-mail address we cannot provide you with a user account.

7. Contact and appointment booking

If you use our contact form or contact us by e-mail, we process the data you provide (name, e-mail address, message) to handle your inquiry. The legal basis is the implementation of pre-contractual measures or our legitimate interest in responding to your inquiry (Art. 6 (1) (b) or (f) GDPR). The technical transmission of form data is handled by Pipedream Inc., San Francisco, USA (data processing agreement including EU standard contractual clauses); the data is then stored in our CRM (see section 10). We delete inquiry data once it is no longer required for processing and no statutory retention obligations apply.

For booking demo appointments we use Cal.com Inc., USA. The data entered during booking (name, e-mail address, selected time slot) is transmitted to Cal.com. Cal.com is certified under the EU-U.S. Data Privacy Framework.

8. Onboarding and product-related e-mails

After registration you will receive an onboarding e-mail with guidance on using the service. We send further product-related messages only as part of existing-customer communication; each of these e-mails contains an unsubscribe link that lets you opt out of further messages at any time. The legal basis is the performance of the contract or our legitimate interest (Art. 6 (1) (b) or (f) GDPR, section 7 (3) of the German Act Against Unfair Competition (UWG)). We do not send a newsletter.

9. Processing during product use

airrange: Local Excel files and on-premises workbooks are not uploaded to our servers; we only store metadata of the apps you create. Workbooks in Microsoft 365 remain in your own Microsoft tenant. If you opt for Hosted Files, we store your workbook encrypted on AWS in Frankfurt (EU). When an app is shared, an encrypted Calculation Package is created that contains only the formulas and data the app needs — never the whole workbook.

SpreadAPI: Workbooks you upload are stored encrypted in the EU (Frankfurt) to provide the API. Calculation results are cached for a maximum of 15 minutes for performance reasons and then deleted automatically; the input values of API calls (query inputs) are not stored. API tokens are stored exclusively as SHA-256 hashes. We use Redis Cloud (EU) for metadata and caching. When AI assistants access your services via the MCP server, the transmitted parameters are processed solely to execute the respective calculation.

We do not use your data to train AI models.

The legal basis for this processing is the performance of the contract (Art. 6 (1) (b) GDPR). After the end of the contract you can export your workbooks and configurations; details are set out in section 6.8 of our Terms of Service. All transmissions are encrypted with TLS; stored data is encrypted with AES-256.

10. Payment processing and customer management (CRM)

For direct purchases, payment is processed by Stripe Payments Europe Ltd., Dublin, Ireland. You enter your payment details directly with Stripe; we do not receive complete credit card or account data. For purchases via the Microsoft marketplace, billing is handled by Microsoft in accordance with Microsoft's privacy terms. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR); we retain billing data in accordance with statutory commercial and tax retention periods (6 or 10 years).

To manage prospect and customer data from inquiries and registrations we use the CRM system of Attio Ltd., London, United Kingdom (data held in EU data centers, data processing agreement in place; an EU adequacy decision exists for the United Kingdom). We do not enrich contact data from external sources. The legal basis is the performance of the contract or our legitimate interest in maintaining the customer relationship (Art. 6 (1) (b) or (f) GDPR).

11. Recipients, third-country transfers and retention

We share personal data only with the processors named in this policy: Vercel (USA, DPF), Wistia (USA, DPF), Cal.com (USA, DPF), Pipedream (USA, EU standard contractual clauses), Stripe (Ireland), Attio (United Kingdom, adequacy decision), AWS (Frankfurt, EU), Hanko (EU) and Redis Cloud (EU). Transfers to the USA take place exclusively on the basis of the EU-U.S. Data Privacy Framework or EU standard contractual clauses.

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations. No automated decision-making, including profiling, takes place. Upon request, we provide business customers with a data processing agreement pursuant to Art. 28 GDPR.

12. Changes to this privacy policy

We update this privacy policy when the legal situation or our services change. The current version published on this page applies.

Please direct any questions about data protection to: privacy@airrange.io