Privacy Policy

Effective Date: July 2026

1. Controller

The controller responsible for the processing of personal data in connection with the KunstTapete app and the associated services is:
Stephan Scipal Unternehmensberatung e.U.
KunstTapete
Strudlhofgasse 14/15, 1090 Vienna, Austria
Email: KunstTapete@gmx.net

2. Overview and General Information

The protection of your personal data is important to us. This privacy policy informs you, in accordance with Art. 13 GDPR, which data the KunstTapete app and the associated server services process, for which purposes, on which legal basis, and for how long.

KunstTapete is a desktop application that displays daily changing artworks as your wallpaper. Some features – in particular the cross-device sign-in (single sign-on) as well as favorites and ratings – require a sign-in and server-side processing. Without signing in, no personal account data is processed on our servers.

3. Use under a corporate agreement (processing on behalf)

If KunstTapete is provided to you by your employer or organization, that organization is the controller under data protection law for the personal data processed within the service. In that case, we process this data as a processor in accordance with Art. 28 GDPR, on the basis of a data processing agreement with your organization.

For information about the data processing and to exercise your data subject rights in this case, please contact your organization first. Requests from data subjects that reach us directly are forwarded to the responsible organization. The following sections therefore apply only supplementarily, in particular to the use of KunstTapete with a private account.

4. Data Processed and Purposes

4.1 Data stored locally on your device

• Cache data: Downloaded artworks and metadata are stored locally to optimize performance and enable offline access.
• Log files (local): Technical log files for error diagnostics are stored locally.
• Settings: Your app settings are stored locally.

This data remains on your device and can be removed at any time by uninstalling the app.

4.2 Sign-in / Single Sign-On (Microsoft and Apple)

For signing in, we use external identity providers. You can sign in with a Microsoft account (Microsoft Entra ID or Microsoft account) or via "Sign in with Apple" (Apple ID). In doing so, we process the identity data provided by the respective provider:

• email address (with "Sign in with Apple", at your choice also as an anonymized relay address)
• display name/name, as far as transmitted by the provider
• unique user or account identifier of the provider (e.g. object ID/subject)
• for business or school accounts: tenant/organization identifier ("tid")

Purpose: authentication, cross-device association of your account, and enabling the respective feature set (e.g. Free/Premium).

4.3 Server-side user account

Upon your first sign-in, a user account is created on our servers. The following are stored:

• internal identifier, email address, and display name
• subscription tier (e.g. Free/Premium) and activation status
• time of account creation and of the last sign-in
• where applicable, the assigned organization

4.4 Server-side event log (logging)

To secure operations and for error diagnostics, and – with your consent – to improve the service, server-side log entries are created. An entry may contain:

• user identifier (account reference)
• IP address
• operating system information
• time of the event
• type of event – e.g. sign-in/sign-out; as well as, only where consent has been given, interactions such as "add/remove favorite", "rating", or "magnify"
• reference to the displayed artwork

4.5 Network access / downloading artworks

• Downloading artworks: The app regularly downloads new artworks and metadata (title, artist, museum) from our server.
• In doing so, technical connection data (including IP address, timestamp, requested resource) is processed, which is necessary for operation and security.

5. Legal Bases

• Sign-in and account management (email, name, account): Art. 6(1)(b) GDPR – provision of the services you requested.
• Operational, security, and error logs (incl. IP address): Art. 6(1)(f) GDPR – legitimate interest in security, stability, and abuse prevention.
• Usage and interaction analytics (favorites, ratings, "magnify"): Art. 6(1)(a) GDPR – consent.

6. Consent during sign-in

During the sign-in process, you can grant or refuse consent to the optional usage and interaction analytics. Sign-in and the core features of the app are available to you without restriction even without this consent. If you refuse consent, the corresponding optional interaction events are not logged for analytics purposes. Consent that has been granted can be withdrawn at any time with effect for the future (see the section "Withdrawal of Consent and Objection").

7. Recipients and Processors

To provide the services, we use carefully selected service providers that act on our behalf and under our instructions (processors, Art. 28 GDPR):

• Hosting/infrastructure: Microsoft Azure (Microsoft Ireland Operations Ltd.) for operating the servers, the database, and storage in data centers in the European Union (see the section "Storage Location / Hosting").

In addition, for signing in we use external identity providers: Microsoft (Microsoft Entra ID / Microsoft account) and Apple ("Sign in with Apple"). These process your sign-in data for authentication under their own terms as independent controllers; the privacy notices of Microsoft and Apple apply in this respect. When signing in with an account managed by your organization (e.g. Microsoft Entra ID), the processing by the identity provider is additionally carried out on behalf of your organization.

No further disclosure of your data to third parties for their own purposes takes place. There is no sale of data and no advertising profiling.

8. Transfers to Third Countries

Our servers and databases are operated exclusively in the European Union.

In connection with signing in via Microsoft or Apple, processing in third countries (e.g. the USA) may occur. In such cases, the transfer is based on appropriate safeguards, in particular the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses (Art. 44 et seq. GDPR).

9. Storage Location / Hosting

The data processed on the server side (user account and logs) is stored in data centers in the European Union. Data stored locally on your device (cache, settings, and local log files) remains under your control on your device and can be removed at any time by uninstalling the app.

10. Retention Period

• User account: 12 months from the last sign-in; thereafter deletion or anonymization, unless statutory retention obligations apply.
• Event logs: 12 months from the respective event; thereafter deletion.
• Local data: until deleted by you or until the app is uninstalled.
• Use under a corporate agreement: After termination of the agreement with your organization, the data processed on their behalf is deleted or returned in accordance with the data processing agreement.

11. Your Rights

Subject to the statutory requirements, you have the following rights:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on legitimate interests (Art. 21 GDPR)
• withdrawal of consent granted, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to KunstTapete@gmx.net is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

12. Withdrawal of Consent and Objection

Consent granted during sign-in to the usage and interaction analytics can be withdrawn at any time with effect for the future – at your next sign-in, in the app settings, or by email to KunstTapete@gmx.net. The lawfulness of the processing carried out until withdrawal remains unaffected.

13. Data Security

We use technical and organizational measures (including transport encryption and access control) to protect your data against loss, manipulation, and unauthorized access.

14. Changes to This Privacy Policy

We update this privacy policy when the legal situation or our processing activities change. The current version is always available on this page. The German version of this privacy policy is authoritative.

15. Contact

If you have any questions about data protection, you can contact us at any time:
Email: KunstTapete@gmx.net

16. Disclaimer

Despite careful review of content, the operator of this website and app assumes no liability for the content of external links. The operators of the linked pages are solely responsible for their content. Should you nevertheless become aware of outgoing links pointing to a website with unlawful activity/information, we ask for a corresponding notice so that we can remove them promptly pursuant to Section 17(2) of the Austrian E-Commerce Act (ECG).

17. Copyright

The copyrights of third parties are observed, researched, and cited by the operator of this website with the utmost care. Should you nevertheless become aware of a copyright infringement, we ask for a corresponding notice. Upon becoming aware of such infringements, we will remove the affected content promptly. The contents of this website and app are subject, as far as legally possible, to various protective rights (e.g. copyright). Any reproduction, distribution, editing, or any other type of use of the provided material beyond the limits permitted by law is not permitted without the prior written consent of the rights holders.

← Back to Home