Legal

Imprint

Information according to § 5 DDG (Digitale-Dienste-Gesetz) and § 18 MStV.

Provider
ThemePunch OHG
c/o Startplatz, Im Mediapark 5
50670 Köln, Germany

Represented by: Krisztian Horvath, Moritz Praetorius, Dirk Gavor
Personally liable partners: Krisztian Horvath, Moritz Praetorius, Dirk Gavor

Register entry: Handelsregister (commercial register). Register court: Amtsgericht Köln. Register number: HRA 32058.

VAT identification number according to § 27 a UStG: DE293041719

Contact
Telephone: +49 221 16836020 (no support by phone)
E-mail: info@themepunch.com
Web: https://www.themepunch.com

Support for SR Anywhere: help@anywhere.sliderrevolution.com, or the Help page in the portal.

Responsible for the content according to § 18 (2) MStV: Krisztian Horvath, Moritz Praetorius, Dirk Gavor, at the address above.

Professional indemnity insurance: Allianz Versicherungs-AG, 10900 Berlin, Germany.

Consumer dispute resolution: We are not willing and not obliged to take part in dispute resolution proceedings before a consumer arbitration board (§ 36 VSBG).

Payments for SR Anywhere plans are handled by Paddle.com Market Limited, Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom, as our merchant of record. Paddle appears on your invoice and card statement.

Accountability for content: The contents of our pages have been created with the utmost care; we cannot guarantee their accuracy, completeness or topicality. We are responsible for our own content under the general laws. We are not obliged to monitor transmitted or stored information of third parties (modules and media our customers create, for example) or to investigate circumstances that point to illegal activity; obligations to remove or block information under the general laws stay unaffected (§§ 7 to 10 DDG).

Accountability for links: Responsibility for the content of external links lies with the operators of the linked pages. No violations were evident to us at the time of linking; should an infringement become known to us, we remove the link at once.

Copyright: Our pages and their contents are subject to German copyright law. Unless the law permits it, every use, reproduction or processing of protected works on our pages needs the prior consent of the rights holder. Our customers' modules are their content under the Licence and the Terms.

Trademarks: Slider Revolution is a trademark of ThemePunch OHG. Shopify, Squarespace, HubSpot, Shopware, Wix and WordPress are trademarks of their owners and are named for compatibility only; there is no affiliation.

Privacy policy

Information according to Art. 13 and 14 GDPR. Last updated: 29 October 2026.

Who is responsible

ThemePunch OHG, c/o Startplatz, Im Mediapark 5, 50670 Köln, Germany — info@themepunch.com, for SR Anywhere also help@anywhere.sliderrevolution.com. Data protection contact: Dirk Gavor, partner, info@themepunch.com. We have not appointed a data protection officer, as the law does not require one for us (Art. 37 GDPR, § 38 BDSG).

This policy covers SR Anywhere: the website (sliderrevolution.com pages about Anywhere), the portal (anywhere.sliderrevolution.com/portal/) and the modules our customers embed on their own sites (served from embed.sliderrevolution.com). Where you visit a customer's site that carries one of our modules, that customer is responsible for the site; what our part processes is under "Modules on other sites" below.

What we process, why, and on which legal basis

Your account

The e-mail address you sign in with, the times of sign-ins, the account and any accounts you are a member of with your role, the settings you make. We use no passwords: a sign-in link is mailed to you, valid for 60 minutes and once; we store only a hash of it. An account is created only on the page that link opens, where you accept the terms and can tick product news; we record that click (the time, the wording you saw, a truncated hash of your IP address). When we give an address a plan before its first sign-in (our team's test accounts, for example), we keep that address and the plan with the account until the account is erased; an address that never signs in keeps its entry until we remove it. The list of your sessions in the portal shows for each one the device (browser and system), the place (city and country, as Cloudflare derives it from the network) and the network class (IPv4 or IPv6 and the operator), never the IP address. To notice a sign-in from a new device, we keep a pseudonymised fingerprint of the network and the device of each sign-in, for 90 days after the last sign-in or signed-in use from that network or device, and delete it with the account. For these fingerprints the legal basis is our legitimate interest in the security of your account (Art. 6 (1) f). Legal basis: the contract (Art. 6 (1) b).

Your modules, media and domains

The modules you build (their content and settings), the pictures and videos you upload (with their size and dimensions) and the depth maps made for pictures with a Layer Depth effect (see below), the domains you list, your brand colours and fonts, the templates you use. For each module we make a small preview picture of its first slide, rendered by our own render service on Cloudflare and kept with your media, so your module list and the editor can show it. Legal basis: the contract.

Handing modules over to a client (Agency)

An account on the Agency plan can offer modules to a client. It enters the client's e-mail address, and we mail the client a link that is valid for 14 days. We keep the offer: that address, a hash of the link, the modules offered, who offered them and when, and the outcome. The agency sees whether the client accepted, declined or let the offer expire, and can withdraw it while it is open. Nothing moves without the client's yes. When the client accepts, signed in with that address, the modules move into the client's account with their content, settings, media and embed lines, and the sites they ran on join the client's domain list. The agency keeps no access, only a copy if it chose to keep one. The views counted so far that month stay with the agency. Legal basis: the contract with the agency for the offer, and our legitimate interest in delivering it to the address the agency gave us (Art. 6 (1) f); the contract with the client for the move.

Usage counts

How often each published module was shown, per month and per host it was shown on, so your plan's allowance can be counted and shown to you. Aggregate numbers; no visitor is identified. Legal basis: the contract.

Payments

When you buy a plan, Paddle.com Market Limited (UK) is the seller of record: Paddle collects your billing details and payment data and issues the invoice; we never see card numbers. We receive Paddle's customer id, subscription id, transaction ids, the plan and its state, so your account carries what you paid for. Invoices live in Paddle's customer portal. Legal basis: the contract; tax law for the retention of invoices (Art. 6 (1) c). Paddle's own privacy policy: https://www.paddle.com/legal/privacy.

Your Slider Revolution licence

If you also have a licence for Slider Revolution, our WordPress plugin (account.sliderrevolution.com), SR Anywhere gives you what that licence includes here: Pro with a Scale plan; on a 1- or 3-site licence no watermark on that licence's own sites and one 30-day Pro trial per licence; 30 % off the first payment of a plan the licence does not include. Both services are ours, so the data stays with the same company. To find the licence, after each sign-in (the sign-in link has just confirmed your address) we ask our customer account service whether a Slider Revolution account with that address has a licence that runs. You can also connect a Slider Revolution account with another address on Plan and licence: we mail a confirmation link to that address (valid for 24 hours and once), and only its click connects the account. If a licence runs, we receive the account's customer number, the licence's tier and end date, and for each running licence its internal subscription number, the number of sites it covers, its end date and the live domains its licence keys are activated on, with development hosts marked. We never receive licence keys, payment data or the e-mail address of the Slider Revolution account. While the link exists we ask again once a day by the customer number, so a renewal, an upgrade or an end shows here.

You can end a link yourself on Plan and licence. A sign-in with the address of the Slider Revolution account can also take a link back to that address's own SR Anywhere account; the account that held the link then loses what the licence gave it. When an account changes owner, its links end, because they belong to the person who proved them.

We keep the customer number, the tier and end date, the address that proved the link and how it was made (sign-in or confirmation); per subscription its number, tier, sites and end, the domains of a 1- or 3-site licence while it runs, the dates of its trial, the first view of a module on one of its sites, and whether a Pro or Agency plan was bought after the link; and the confirmation links (the address asked for, a hash of the link). Download my data contains the links and the subscriptions. When the account is erased, the links and confirmation links go with it; the subscription rows stay without your account, the Slider Revolution account and the domains, so each licence gets its one trial even in a new account. For the 30 % discount we also keep, per paid plan, a marker made from a one-way hash of the Slider Revolution customer number and the date of the first discounted payment, also after the account is erased, so the discount applies only once. Legal basis: the contract (Art. 6 (1) b) for giving you what your licence includes; our legitimate interest in recognising our customers without asking for licence keys, in granting each licence's trial and discount only once and in counting whether the offer is used (Art. 6 (1) f).

Mails we send you

Sign-in links, account mails (welcome, plan changes, published modules), team invitations, hand-over offers and help replies are sent through Cloudflare's Email Service (Cloudflare, Inc.), which hosts Anywhere anyway. When Cloudflare cannot take a mail, for example at its daily limit or during an outage, that one mail goes through Brevo (Sendinblue SAS, Paris, France) instead. Two kinds of mail report on your account while you are away, and each comes with a link that switches it off in one click: the monthly report and the warnings before your plan's limit is reached. Both are on until you switch them off, there or in Settings → Emails. Mails about a change that already happened (a module paused, a plan ended) and everything you asked for always come.

We keep a log per mail: the template, your address, the provider's message id, when it was sent and whether it was delivered, bounced, blocked, marked as spam or unsubscribed, so we can tell you why a sign-in link did not arrive. Cloudflare reports these states to us and keeps its own sending log (sender, recipient, subject, delivery state) for up to 31 days. Our account mails carry no tracking of opens or clicks: their links lead straight to our own pages. The exception is a mail that goes through Brevo because Cloudflare could not take it: Brevo adds its open pixel and routes the links through its own redirect, and we cannot switch that off there.

The monthly report and the limit warnings also carry an unsubscribe header, which mail apps show as an unsubscribe button; it switches that mail off on our side, like the link in the mail. If a mail cannot be delivered because the address does not exist, or if you mark one of our mails as spam, Cloudflare stops sending to that address, and after a spam report we switch off the monthly report, the limit warnings and product news. A mail that went through Brevo carries Brevo's own unsubscribe link; if you use it, Brevo tells us and we handle it the same way, so sign-in links, plan changes and invitations still reach you.

Legal basis: the contract; legitimate interest in reliable delivery and in telling you about your account's activity (Art. 6 (1) f), which you can switch off at any time.

Product news

Product news (a digest of what is new) comes only if you ask for it: with the box when you sign up, in Settings → Emails, or with the form on our website. Brevo then sends you a confirmation mail, and only your click there puts your address on the list (double opt-in). We record which wording you agreed to, where (the form and the page), when, and a truncated hash of your IP address. Brevo keeps your confirmation, and for an account we note its time too. When you tick the box at sign-up, the boxes wait with the sign-in link until you use it, and the page that creates your account shows them again, so they are recorded on whichever device you open it. The website's form takes at most ten sign-ups per network an hour; for that count we keep the hash of the IP address with the sign-up. You can unsubscribe at any time: in Settings → Emails, or with the link in every newsletter. We then take your address off the list. Brevo counts how often a newsletter is opened and clicked; our own count of clicks on our links is per newsletter and link, not per person (see analytics below). Legal basis: your consent (Art. 6 (1) a); keeping the proof of it, our legal obligation to show it (Art. 7 (1), Art. 6 (1) c).

Help requests

When you write to us — from the portal's Help page, from an error message's "Get help", or by e-mail to help@anywhere.sliderrevolution.com — we store the request, your messages and ours, attachments you add, and, when it came from the portal, the page, the module, its revisions, your browser type, viewport and the last error messages of that browser tab, so you do not have to describe them. Our supporters read it; if you allow support access (Settings → Support access, or the checkbox in a request), a supporter can also look at your account and modules for a limited time, and every step is listed for you. Legal basis: the contract.

When a request shows a fault in the product, the support lead can report it to our developers' board at monday.com (monday.com Ltd., Tel Aviv, Israel): the request's number and subject, the topic, your plan and account id, the module, the page, your browser and its last error messages, and the supporter's notes. Your address and your messages beyond the subject are not sent. Legal basis: legitimate interest in fixing faults (Art. 6 (1) f).

When a request reports a security problem in one of our products (a vulnerability, an attack, a site hacked through it), we forward it at once to Patchstack OÜ (Pärnu, Estonia), which runs the vulnerability disclosure program that handles security reports about our products and assigns CVE numbers. Patchstack handles the report under its own responsibility, not on our behalf, and decides what is reported to the authorities. The report carries the request's number, the product and version as written, the times it reached us, the kind of any attachments (not the files) and your words with the sign-off removed and e-mail addresses, host names (the account's domains included), the names the account knows, ids and IP addresses replaced by placeholders; other names in your words may remain. The host of your site goes in the clear only when the report is about an attack on it. Your e-mail address and your account id are not sent. Legal basis: our legitimate interest in meeting our duty to report under the EU Cyber Resilience Act (Art. 14) and in having vulnerabilities in our products fixed (Art. 6 (1) f).

AI preparation and translation for the supporter. A language model helps our supporters with your request; it never answers you itself — a person reads, corrects and sends every reply. For accounts on a paid plan it prepares a request when it comes in (and again when the supporter asks for it, at most twice): a summary, the likely cause, the topic and urgency (including whether the request reports a security problem), checks and a draft reply. On every plan it translates the supporter's reply, which is written in English, into your language. What the model sees: the subject and the messages of the request; the facts our system gathers for the supporter: your account's status and when it was created; your plan and, for a billing question, the state of your subscription; the module or group the request is about, with its name and publish state; your modules, domains, views, storage use and team; what you told us about your role and the platforms you use; whether you allowed support access, and the last five entries of your support log; the page and browser details sent with the request; for a request about signing in or your account, what our records show for your address (whether it has an account, when sign-in links were asked for and used, and whether those mails were delivered); the findings of our own checks; the subjects of your earlier requests; entries of our knowledge base; and, so that answers stay consistent, our replies to up to three similar requests that were already solved, from other accounts too, but never about billing, never from an account that switched this off and never from a request that was already anonymised. Before anything reaches the model, we replace with placeholders: e-mail addresses; IP addresses; our internal ids; the hosts of links; the account's domains (its domain list, the site the request came from and the sites its modules were shown on), also when they are written without https://, with a subdomain or as an international domain name in either form; and the names the account knows that have three characters or more (the parts of its people's e-mail addresses, its workspace name and your first name). Other names in a message are not recognised, so please leave out what a model should not read. The placeholders are put back into the answer only on our side. In a reply taken from another account's request, the names that account knows (the parts of its people's e-mail addresses and its workspace name) and the domains on its domain list, also without https://, with a subdomain or as an international domain name, are replaced by placeholders that are never put back. Screenshots are not shown to the model, only a note that there was one; the content of a module is shown only when you allowed support access, and that is written into your support log.

The model is Claude Haiku by Anthropic, run by Amazon Web Services EMEA SARL (Luxembourg) on Amazon Bedrock in AWS's data centres in the EU and reached through our own AI service, the same way as the AI assist in Quick Edit. AWS processes the request on our behalf, keeps neither what is sent nor the answer (we have switched its logging of model calls off), uses neither to train models and does not pass them to Anthropic. Our AI service has a second engine, OpenAI's gpt-4o-mini (OpenAI Ireland Ltd, Dublin, Ireland, under OpenAI's data processing addendum), which answers instead when we switch to it or when Bedrock cannot be reached; OpenAI receives the same pseudonymised request, does not store it (we send it with storage off) and does not use it for training; any transfer outside the EU rests on the Standard Contractual Clauses or an adequacy decision. With the request we keep the facts we gathered for it and the model's answer (the summary, the draft and the rest of the preparation) until the request is anonymised (see "How long we keep data"); the prompt itself is not stored. Each call to the model is counted (the feature, the model, the number of tokens and the account it served) so we can keep the costs in check; our AI service keeps the same per call, with the plan and a keyed hash in place of the account, for 90 days, then only daily totals. No text is kept in either count.

It is on by default; the account's owner can switch it off in Settings → Legal and data. The account's requests are then prepared from our own records only, the supporter writes in your language without the model, and the account's requests are never shown to the model as examples for others. Legal basis: our legitimate interest in answering your request quickly, well and in your language (Art. 6 (1) f), weighed against the pseudonymisation before every call, the processing in the EU and your switch; switching it off is your objection (Art. 21) and takes effect for every later request.

AI assist in Quick Edit

When you use the AI assist in Quick Edit (to change a module from a description, or to write its texts), we send what your request needs to an AI model:

• what you type;
• the texts of the module (or of the modules in the group you chose), with their roles and lengths, and its title;
• its colours and fonts;
• for texts, what you told us about your business (what it does, the tone, the website) and the language.

Files you add go to your media library; the AI does not see them. Please do not enter other people's personal data. The answer comes back to the editor; nothing reaches your live module before you publish it.

The model is Claude Haiku by Anthropic. Amazon Web Services EMEA SARL (Luxembourg) runs it for us on Amazon Bedrock in data centres in the EU, reached through our own AI service. AWS processes your request on our behalf and does not store it or the answer; it does not use them to train models and does not pass them to Anthropic. When we switch our AI service to its second engine, or when Bedrock cannot be reached, OpenAI's model gpt-4o-mini answers instead (OpenAI Ireland Ltd, Dublin, Ireland, under OpenAI's data processing addendum; the request is sent with storage off and is not used for training; any transfer outside the EU rests on the Standard Contractual Clauses or an adequacy decision).

We count your AI requests for your plan's limits: per call the feature, the model, the number of tokens and the account it served, no text. Our AI service keeps the same per call, with the plan and a keyed hash in place of the account, for 90 days; after that only daily totals per feature and model remain, nothing per call. A text the assist wrote is marked as AI-written in your module until you edit it, so the editor can tell you; nothing else is derived from that mark. Legal basis: the contract (Art. 6 (1) b) for the feature you use; our legitimate interest in fair use and the security of the service for the limits (Art. 6 (1) f).

Connecting your own assistant

If you connect your own Claude or ChatGPT to your account (Settings → Connections: a personal token, or the assistant's own connect flow), that assistant reads and changes your modules on your instruction. Its provider (Anthropic or OpenAI) processes what your assistant sends it under your own contract with that provider; we are not a party to it.

Connected sites (the WordPress plugin)

If you connect a WordPress site with our plugin (Settings → SR Anywhere → Connect), your site's server registers with us and you allow the connection on our consent page. We then keep the site's host name and its environment (live, staging, development, local) with the connection, and the plugin's read-only tokens; a site without HTTPS connects with a key you make in Settings → Connections instead. The connection ends when you remove it there or disconnect in the plugin, 180 days after its last use, or with the account. While an administrator or editor of that site works in the plugin, the site's server reads your account's modules, your plan and its limits, and your e-mail address as the account's owner, which the plugin shows to the site's administrators and does not store. Nothing about that site's visitors, editors or content reaches us through the plugin; what a module does on the site is under "Modules on other sites" below. Legal basis: the contract (Art. 6 (1) b).

Depth maps for Layer Depth effects

A Layer Depth effect makes a photo look three-dimensional. For that the editor needs a depth map of the photo: a grey picture in which bright means near and dark means far. Your own browser computes it, in the full editor and in the Studio, with a small model (Depth Anything V2) that runs on your machine. The photo does not leave your browser for this. The finished map is saved as a file in your media, next to the module; a picture with a Layer Depth effect and no map gets one before the module is composed or published.

To run the model, your browser downloads it once from Hugging Face (Hugging Face, Inc., USA) and its library and runtime once from jsDelivr (a free public content delivery network for open-source files) — about 50 MB the first time; the browser keeps them for the next time. The two providers receive what every download carries — your IP address, the time, your browser's name and the file asked for — not the photo. They act as independent controllers under their own privacy policies (https://huggingface.co/privacy and https://www.jsdelivr.com/terms/privacy-policy). Visitors of your site never load the model; they see the finished map, delivered with the module like any picture. Legal basis: the contract (Art. 6 (1) b), for the effect you chose; keeping the model in your browser is strictly necessary for that effect (§ 25 (2) no. 2 TDDDG).

Security and abuse prevention

Sign-in links are limited per address and per network; for the network limit we keep a hash of the IP address for one day. Notices about content are limited too: for that we keep hashes of the sender's network, of the address a confirmation goes to, and of a sender's e-mail address and its domain, for seven days, never the addresses themselves. Requests are limited per account. The Worker logs carry technical data (time, route, errors) for a short period. Legal basis: legitimate interest in a secure service (Art. 6 (1) f).

Notices about content

Anyone can report content on SR Anywhere they believe is illegal or against our terms, on the page Report content or by e-mail to notice@anywhere.sliderrevolution.com. We process the sender's name and e-mail address, the notice itself (what was reported, where, and why), our correspondence with the sender, and our decision with its reasons. If we remove or restrict content, the account that published it receives our reasons; the sender's name is passed on only where the law requires it, for example for a right of their own. A notice is handled like a help request, by a person; no automated decision removes content. Legal basis: a legal obligation (Art. 6 (1) c GDPR with Art. 16 and 17 of the Digital Services Act) for the notice and the decision; legitimate interest (Art. 6 (1) f) in keeping the record of a decision, so that we can show how we acted. Recipients: none beyond our processors (section "Who receives data"), unless an authority asks or the law requires a report (Art. 18 DSA).

Website visits

The website and the portal are served by Cloudflare, Inc.; Cloudflare sees your IP address and browser data to deliver the pages and to fend off attacks, on our behalf. Legal basis: legitimate interest in running and protecting the service (Art. 6 (1) f).

How the website is used (website analytics)

We measure how our website is used with our own analytics: no cookies, nothing stored in or read from your browser, no third-party tools (no Google Analytics). We record page views (with the name of the site you came from and campaign parameters in the link), which links and buttons are clicked, how far a page is read and for how long, and which version of a page you saw when we test two versions. With each event we keep the time, the page, the device class (desktop, tablet, phone) and the country — never your IP address, never what you type, no mouse movements, no session recordings. To tell visits apart, a code is formed from your IP address and browser with a key that changes every day; the key is deleted when the day is over, so the code cannot be connected across days. The same code chooses which version of a tested page you see that day. Our server also counts, without naming anyone, the steps of signing in (a link asked for and used) and which link in a newsletter was clicked, per newsletter and link and not per person. If your browser sends Global Privacy Control or Do Not Track, nothing your browser does is recorded. Legal basis: our legitimate interest in understanding how our website is used, so we can fix what gets in people's way and improve it (Art. 6 (1) f). It outweighs your interest because no visitor is followed across days, nothing goes to third parties for their own purposes and nothing you type is recorded; you can object at any time with Global Privacy Control or Do Not Track in your browser, or by writing to us (Art. 21).

How the portal and the editor are used (product analytics, only with your consent)

Only if you, as the owner of an account, say yes — when the portal asks you, or with the switch in Settings → Legal and data → Product analytics — do we count how you use the portal and the editor: the pages and buttons you use, which features, and where people get stuck, with the time, the device class and the country. Never what you make or type, no mouse movements, no session recordings. Without your yes, the portal sends nothing and reads nothing in your browser for this. With it, your browser sends these events together with the session you are signed in with (which the portal keeps in your browser's local storage to sign you in), so they belong to your account; no further cookie or identifier is stored. With your yes our server also records, for your account: a consent given or withdrawn, a module opened in the editor (and how long it was actively edited, how often saved), saved in Quick Edit or published, a domain added, a module your assistant built, a limit reached, a plan bought, renewed or cancelled (with the plan, the billing period, the net amount and a discount or offer used), and which of our mails was sent to the account. The use of team members who are not the owner is never counted, and nothing is counted while our support looks into your account.

You can withdraw your consent at any time, with effect for the future, with the same switch in Settings; from then on nothing about how you use Anywhere is recorded. Saying no or withdrawing changes nothing else in the service. **Legal basis:** your consent (Art. 6 (1) a GDPR); for reading the session in your browser for this purpose, § 25 (1) TDDDG. Your answer is kept with the account (yes or no, and when), as the proof of it.

Both kinds of events are kept in Cloudflare's analytics store for about three months and in our own analytics database (hosted for us by Railway Corporation, USA) for 13 months, then only as totals. They are not shared and not used for advertising; how you use the product shapes our mails to you only if you agreed to marketing mail.

Reactions on the website

When you react to a post or a template (an emoji under it), we count the reaction. To count each person only once a day, the server forms a code from your IP address, your browser's type and version (the user agent) and a key that changes every day. Neither the IP address nor the key is stored, and the codes are deleted after one day; what remains is a number per page and emoji, not a record of a person. Your browser keeps your own reaction in its local storage, set only when you click, so you can see and change it; it is sent to us only with your next change. Legal basis: legitimate interest in counting each person once and in preventing abuse (Art. 6 (1) f); the storage in your browser is strictly necessary for the function you asked for (§ 25 (2) no. 2 TDDDG).

Modules on other sites (for visitors of our customers' sites)

A module a customer embeds loads its script, its content and its media from embed.sliderrevolution.com, served by Cloudflare. To deliver it, Cloudflare's edge processes the visitor's IP address and browser request for the moment of delivery. A site that places modules with our WordPress plugin also asks our edge for a module's start (its height and background) from its own server — when a page is saved and about once a day, with the module's public key and the site's host name; no visitor is involved and that request counts no view. We count one view per module shown, together with the host name of the page it was shown on — a number per month, not a record of a person; no cookie, no fingerprint, no identifier is set in the visitor's browser. Fonts a module uses are served through our edge, so the visitor's browser does not contact Google. The site operator (our customer) is responsible for their site and informs their visitors; the paragraph they can use is in the embed notice. For business customers, we process their visitors' requests as their processor under the data processing agreement.

Where your data is stored

Your modules and media are stored in the European Union. Our database (your account and what this policy lists with it: modules, settings, help requests) and our file storage (media, published modules, attachments, preview pictures) are kept at Cloudflare with its EU jurisdiction set, so Cloudflare stores them, and runs the database, only in its data centres in the EU. Not bound to the EU are: the short records our edge reads to deliver a published module (its key, the domains it may run on, what the plan allows) and the access grants of assistants you connect, which Cloudflare replicates across its network so they are near every visitor; Cloudflare's analytics store (Workers Analytics Engine), which keeps the view counts of published modules and the usage events described above under analytics; and Cloudflare's queue that carries the delivery reports of our mails (the recipient's address and the delivery state) to our database, where each report waits only until it is recorded. Cloudflare's edge network delivers modules and media from the data centre nearest each visitor, wherever that is, and keeps copies in its cache for a while. Where other services keep data (our analytics database at Railway, the AI models, our mail providers), the sections above and the list of processors say so.

Backups. The database can be restored to any minute of the last 30 days, and each night our modules and media are copied into a separate backup storage, also in the EU. Data you delete, the files of an erased account included, can therefore remain in these backups for about 30 days before it is gone for good. The backup keeps only the newest copy of each file, no older versions. We use the backups only to restore the service after a fault or a mistake.

Who receives data (processors)

Cloudflare, Inc. (USA; the database, the file storage and its backup in the EU, delivery at its edge; hosting, storage, delivery, our mails, e-mail routing, our AI service, our render service for the modules' preview pictures) · Paddle.com Market Limited (UK; payments, merchant of record — an independent controller for the purchase) · Brevo / Sendinblue SAS (France; the product news list, and our mails when Cloudflare cannot take one) · Amazon Web Services EMEA SARL (Luxembourg; the language model on Amazon Bedrock in the EU, for the AI preparation and translation of help requests and the editor's AI assist) · monday.com Ltd. (Israel, stored in the United States; fault reports from help requests) · OpenAI Ireland Ltd (Ireland; the second engine of our AI service for help requests and the editor's AI assist) · Railway Corporation (USA; hosting of our analytics database). All under data processing agreements; transfers outside the EU rest on adequacy decisions (UK, Israel), the EU-US Data Privacy Framework (Cloudflare, Amazon) or the Standard Contractual Clauses (in the DPAs of AWS, monday, OpenAI and Railway). The full list with locations: processors and sub-processors.

Not our processor, but a recipient that handles the data under its own responsibility: Patchstack OÜ (Pärnu, Estonia), which runs the vulnerability disclosure program for our products and receives the security reports from help requests (see Help requests).

We do not sell data and do not use it for advertising.

For some features your browser also downloads files from providers we do not control: the depth model from Hugging Face and its library from jsDelivr (see Depth maps for Layer Depth effects). They receive the download request — your IP address, your browser's name — never your content, and they act under their own privacy policies.

How long we keep data

Your rights

Access and portability (Settings → Download my data gives you one file with your account, consents, modules, media list, help requests and Slider Revolution licence links), rectification, erasure (Settings → Delete account, or a mail to us), restriction, objection (Art. 21), withdrawal of a consent at any time with effect for the future, and the right to complain to a supervisory authority — for us the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

Changes

We update this policy when the service changes; the date at the top says when. Material changes are announced in the portal.

Terms of service

ThemePunch OHG, c/o Startplatz, Im Mediapark 5, 50670 Köln, Germany ("we") provides SR Anywhere ("the service"). These terms apply to every account. Last updated: 28 October 2026.

1. The service

SR Anywhere lets you build animated modules from templates in your browser, host them with us and embed them on your own websites with one line of code. The portal, the editor, the delivery of your modules and the help desk are part of the service. Some features are limited by plan (section 4).

2. Your account

You need an account with a verified e-mail address. You are responsible for what happens under your account and for the people you invite into it (Team). You must be at least 18 years old and have full legal capacity; if you open an account for a company, you confirm that you may act for it.

3. Your content

Modules, texts, pictures, videos and domains you add are yours. You grant us the right to store, process and deliver them as far as the service needs it — and no further. You warrant that you hold the rights to what you upload and that it breaks no law.

Modules stay inside SR Anywhere: there is no file export, and modules move only between accounts through the service (a hand-over, or support with your permission). Your data is exportable at any time (Settings → Download my data).

Data processing for business customers: where you use the service as a business and your modules run on your sites, we process your visitors' requests on your behalf. The data processing agreement (Art. 28 GDPR) forms part of these terms and applies from the moment you accept them; no signature is needed.

Notices about content, removal and your right to object

We do not check content before it goes live and we do not search for unlawful content. We act on notices and on what we notice ourselves, as a hosting service under the EU Digital Services Act. A person decides; no machine removes content on its own.

• Reporting content. Anyone can tell us about content on SR Anywhere they believe is illegal or breaks these terms, with the form at https://anywhere.sliderrevolution.com/notice or by e-mail to notice@anywhere.sliderrevolution.com, in English or German. The page says what a notice needs. The same address is our point of contact for authorities; as a customer you reach us through the Help page and help@anywhere.sliderrevolution.com. We may refuse notices that are manifestly unfounded, and stop handling notices from someone who keeps sending them after we warned them.
• When we act. We confirm a notice within two working days and decide without undue delay, normally within seven days. Content that is manifestly illegal, or harms people right now (phishing, malware), we take down at once.
• What happens to your module. We stop delivering it: wherever its line is embedded, nothing shows in its place; its pictures and videos follow. The module stays in your account as a draft, unless the law requires otherwise, and cannot be published again while the decision stands.
• Our reasons. At the latest when we act, we tell you by e-mail and in Help: what we did and for how long, the facts we relied on, whether a notice led to it, the law or the clause of these terms it rests on and why, and how you can object. We name the person who sent the notice only where that is needed, for example for a right of their own.
• Your right to object. Reply to our reasons within 14 days, in Help or to the e-mail, and say why the decision is wrong. A person looks at it again within seven days; we publish the module again or tell you why it stays off. You can also go to court at any time.
• Suspending an account. We may suspend an account that abuses the service (malware, phishing, illegal content, spam, attacks on our infrastructure), and an account that keeps providing manifestly illegal content after we warned it. You get our reasons and can object in the same way.
• Authorities. Where the law requires it, we report content to the authorities, in particular when it suggests a crime that threatens someone's life or safety, and we follow orders of courts and authorities.

4. Plans and limits

Free (no charge): 3 live modules, 1 domain, 10,000 views a month, 250 MB of media, files up to 10 MB, our watermark on every module. Pro: 25 live modules, 5 domains, 500,000 views a month, 10 GB of media, files up to 100 MB, no watermark. Agency: 1,000 live modules, 250 domains, 1,000,000 views a month, 100 GB of media, files up to 250 MB, no watermark, a team of three seats (more can be added), hand-over of modules to clients and review links. The current numbers are on the Plan and licence page; they may change for new subscription periods with notice. When a limit other than views is reached, nothing that runs breaks: the affected action (a further publish, a further domain) waits, and we tell you.

Views beyond the plan: we tell you in the portal and by mail when a month's views reach the plan's limit. On Pro and Agency your modules keep showing; beyond 100 % of the views (Pro) or 150 % (Agency) they carry the watermark until the next calendar month or an upgrade. On the Free plan, beyond 120 % of the views your modules are paused until the 1st of the next month or an upgrade: they show their preview picture, where there is one, or nothing in their place.

What counts: a live module is what you publish: a module, or a page from the Studio. A page counts once when you embed it as a page. A section of it that you also embed on its own counts on its own as well. Scroll sections are free. A view is one visitor loading a module or a page.

Domains are the licence: a module runs on the domains listed in your account (and their subdomains); hosts register themselves on the first view up to the plan's limit. You may list only domains you control or are authorised to work on.

5. Payment

Paid plans are sold by Paddle.com Market Limited as our merchant of record: the purchase contract for the plan is with Paddle, Paddle's Buyer Terms (https://www.paddle.com/legal/checkout-buyer-terms) apply to the purchase, Paddle charges you and issues the invoice. Prices shown to consumers include VAT; businesses see the net price, and the VAT or sales tax of their country is added at checkout. Subscriptions renew for the same period (monthly or yearly) until cancelled; you cancel, change the payment method and find invoices in Paddle's customer portal (Plan and licence → Invoices and billing). You can also cancel with the button "Verträge hier kündigen" (Cancel contract) at the foot of every page, without signing in; we confirm receipt by e-mail at once. A cancelled renewal keeps Pro to the end of the paid period. Refunds: on request within 14 days of the first purchase of a plan, in full; beyond that, Paddle's policy and section 9 (right of withdrawal).

6. When a paid plan ends

Nothing breaks. Your modules keep running on your sites. For 14 days after the paid period (the grace period) the Pro limits stay; then the Free plan's limits apply and the watermark returns. Modules beyond the Free limit stay published but you cannot publish more until you are within the limit or on Pro again. A failed payment is treated the same way after Paddle's retries.

7. Availability

We run the service on Cloudflare's network and aim at continuous availability. What we aim at depends on the plan:

• Free: no uptime target.
• Pro: a best-effort target.
• Agency: a target of 99.9 % availability per calendar month for published modules, that is the embed line on your pages and the files it loads from us. We measure it once a minute from outside Cloudflare's network.

These are targets, not guarantees; there are no service credits. We may interrupt the service for maintenance and we announce planned interruptions; announced maintenance does not count against the target. Published modules are designed to keep rendering even when the portal is unavailable.

8. Support and support access

Help is part of the service (the Help page, help@anywhere.sliderrevolution.com). On Agency we answer a request for the first time within one working day (Monday to Friday, except public holidays in North Rhine-Westphalia); on Pro we usually do. A supporter looks into your account and modules only with your permission, which you give for a limited time, read only or with changes, and end at any time; every step is logged for you. A fix from support is a proposal you apply or discard. On a paid plan, requests are prepared by a language model for the supporter as the privacy policy describes; you can switch that off.

9. Right of withdrawal

Consumers have the statutory right of withdrawal on the purchase of a plan — see the withdrawal notice. A paid plan starts at once, at your request. If you withdraw from the first purchase of a plan, you get the full amount back (section 5); we do not charge for the days you used.

10. Termination

You can delete your account at any time (Settings → Delete account, or by mail). Your modules go offline, embeds on your pages stop, and your data is erased after 14 days; invoices stay with Paddle as tax law requires. When you delete your account, we stop the renewal of a running subscription; it ends with its current period and at the latest when the account is erased. There is no refund for the remaining period when you delete the account. You get the remaining period back when we end the contract ourselves, or when you end it because of a breach on our side. Within the 14 days you can undo the deletion in Settings; the renewal resumes if the period has not ended. We may terminate an account with four weeks' notice, and without notice on serious breach (section 3).

11. Templates, effects and third-party services

Templates and effects are licensed to you as the Licence says. Platforms we name (Shopify, Squarespace, HubSpot, Shopware, Wix, WordPress) are named for compatibility; we are not affiliated with them and do not control their behaviour towards embedded scripts. An assistant you connect to your account (your own Claude or ChatGPT) acts on your instruction; you are responsible for what it builds.

12. Liability

We are liable without limit for intent, gross negligence, injury to life, body or health, and under the Product Liability Act. For slight negligence we are liable only for the breach of essential contractual duties (those the contract depends on and you may rely on), limited to the damage typical for this kind of contract and foreseeable at the time of the contract. On the Free plan, which we provide free of charge, we are liable only for intent and gross negligence; our liability for injury to life, body or health and under the Product Liability Act stays unlimited. We are not liable for content you or your visitors add, or for the sites you embed modules on.

13. Changes to these terms

We may change these terms for good reason (a change in the law, a new feature, a security need). We announce changes in the portal and by mail at least four weeks before they apply; if you do not object by then, they apply; if you object, you may end the contract at that date. Changes to the core of the service or to prices of a running period need your agreement.

14. Governing law, venue

German law applies, excluding the UN Sales Convention; for consumers, the mandatory consumer protection of their country of residence stays. For merchants, legal entities under public law and special funds under public law, the venue is Köln. We are not willing and not obliged to take part in dispute resolution proceedings before a consumer arbitration board (§ 36 VSBG).

Licence

In short: while your account exists you may use every template and effect in any number of your own or your clients' projects, as modules published through SR Anywhere. You may not resell templates as templates or redistribute the bundled media. Fonts and media carry the licences of their makers.

What you get

For every template in the catalogue and every effect in the library, a non-exclusive, worldwide licence to copy it into your account, change it, and publish the result as a module on any website you or your clients control, for as long as your account exists — on the Free plan with the watermark, on Pro without.

What is not allowed

• Reselling, sharing or publishing a template, an effect or their media as a template, a theme, a kit or a file; extracting media or the engine for use outside SR Anywhere.
• Using a template's demo media (photos, videos, logos, product images, faces, brand names) in a live module: they are placeholders to show the design; replace them before you go live.
• Removing or hiding the watermark on the Free plan, or circumventing the plan limits.
• Using the service to build content that breaks the law or the terms.

Your own content

What you add stays yours (Terms, section 3). Media you upload must be yours to use; SR Anywhere checks file types, not rights.

Fonts

Google Fonts a module uses are served through our edge under their open licences (SIL Open Font License or Apache 2.0 as published by Google Fonts). Fonts you upload carry your own licence.

The engine

The Slider Revolution engine that renders your modules is our copyright and is licensed to you only as part of the service, for modules published through SR Anywhere. Slider Revolution for WordPress is a separate product with its own licence (https://www.sliderrevolution.com/terms/license/); Anywhere accounts and Slider Revolution licences may be linked in the future — that is announced when it exists.

When the account ends

The licence ends with the account. Published modules go offline when the account is deleted; a plan that ends does not end the licence — the modules keep running with the Free plan's rules.

Last updated: 13 October 2026.

Right of withdrawal

Paid plans are sold by Paddle.com Market Limited, our merchant of record. If you buy a plan as a consumer (§ 13 BGB), you have the following right of withdrawal; you can declare it to Paddle or to us — we pass it on. Last updated: 27 October 2026.

Withdrawal notice

Right of withdrawal

You have the right to withdraw from this contract within fourteen days without giving any reason. The withdrawal period expires after fourteen days from the day of the conclusion of the contract.

To exercise the right of withdrawal, you must inform Paddle.com Market Limited (Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom, help@paddle.com) or us (ThemePunch OHG, c/o Startplatz, Im Mediapark 5, 50670 Köln, Germany, telephone +49 221 16836020, help@anywhere.sliderrevolution.com) of your decision to withdraw from this contract by an unequivocal statement (e.g. a letter sent by post or an e-mail). You may use the model withdrawal form below, but it is not obligatory. To meet the withdrawal deadline, it is sufficient for you to send your communication concerning your exercise of the right of withdrawal before the withdrawal period has expired.

Effects of withdrawal

If you withdraw from this contract, we shall reimburse to you all payments received from you without undue delay and in any event not later than fourteen days from the day on which we are informed about your decision to withdraw from this contract. We will carry out such reimbursement using the same means of payment as you used for the initial transaction, unless you have expressly agreed otherwise; in any event, you will not incur any fees as a result of such reimbursement.

If you requested to begin the performance of services during the withdrawal period, you shall pay us an amount which is in proportion to what has been provided until you have communicated to us your withdrawal from this contract, in comparison with the full coverage of the contract.

Our addition: for the first purchase of a plan we do not charge that amount: if you withdraw, you get everything back (Terms, section 5).

Model withdrawal form

(Complete and return this form only if you wish to withdraw from the contract.)

To Paddle.com Market Limited, Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom, help@paddle.com, or to ThemePunch OHG, c/o Startplatz, Im Mediapark 5, 50670 Köln, Germany, help@anywhere.sliderrevolution.com:

• I/We (*) hereby give notice that I/We (*) withdraw from my/our (*) contract for the provision of the following service: SR Anywhere, plan ______________
• Ordered on (*) ______________ / received on (*) ______________
• Name of consumer(s) ______________
• Address of consumer(s) ______________
• E-mail address of the SR Anywhere account ______________
• Signature of consumer(s) (only if this form is notified on paper) ______________
• Date ______________

(*) Delete as appropriate.

Invoices, cancellation, refunds

Invoices, cancellation of a renewal and the payment method are in Paddle's customer portal (Plan and licence → Invoices and billing). You can also cancel with the button "Verträge hier kündigen" (Cancel contract) at the foot of every page, without signing in; we confirm receipt by e-mail at once. A cancelled renewal keeps the plan to the end of the paid period. Beyond the right of withdrawal we refund the first purchase of a plan on request within 14 days, in full (Terms, section 5).

Cookies and tracking

Last updated: 27 October 2026.

The portal sets strictly necessary cookies only: your session (sra_session, HttpOnly), so you stay signed in, and beside it a marker (sra_in, not HttpOnly, as long as the session), which holds no token and no identifier and only tells our website's pages that you may be signed in, so they show your account instead of "Sign in"; and the editor pass (sra_engine, HttpOnly, 7 days), which lets your signed-in browser load the editor's code. It keeps a few settings that never leave your browser (the account and address you last used, the theme, the last embed tab, your unsent draft of a request, the messages behind the bell, the sign-up boxes waiting for your sign-in link). No consent banner is needed for strictly necessary storage (§ 25 (2) no. 2 TDDDG). Product analytics in the portal and the editor run only with the account owner's consent (§ 25 (1) TDDDG, Art. 6 (1) a GDPR): the portal asks once, and the switch in Settings → Legal and data gives or withdraws it at any time. Without that yes, the portal sends no analytics and reads nothing in your browser for them; with it, the events go with your session and nothing further is stored (privacy policy, product analytics). When you connect an app (Claude, ChatGPT, a WordPress site's plugin) and are not signed in, the consent page sets a further strictly necessary cookie, sra_pending (HttpOnly, 60 minutes): it ties the sign-in code we mail you to that tab, and goes when you are signed in.

The website measures visits with our own analytics, which set no cookie and store nothing in your browser (a daily code formed on our side tells visits apart; details in the privacy policy). It keeps a few display choices in your browser's local storage (the theme, an offer you closed), which never leave your browser. Global Privacy Control and Do Not Track are respected: nothing is recorded. Paddle's checkout, when you open it, sets Paddle's own cookies for the purchase; Paddle's cookie policy applies there. When you react to a post or a template, your browser keeps your own reaction in its local storage, set only by your click, so you can change it; strictly necessary for the function you asked for (§ 25 (2) TDDDG).

Modules on customers' sites set no cookie and no identifier in the visitor's browser. We count views per module and host as numbers. Fonts are served from our edge, not from Google.

Mails: product news sent through Brevo carries Brevo's open pixel and tracked links, as does an account mail in the rare case it goes through Brevo because Cloudflare could not take it; our other mails carry no tracking and their links are direct addresses.

Should a marketing pixel or a third-party analytics tool ever be added, a consent banner comes with it and this page says so first.

What an embedded module does on your site (for your own privacy policy)

For our customers, who are responsible for their own sites and tell their visitors what runs there.

The line you paste loads the module's script, content and media from embed.sliderrevolution.com, a domain of ThemePunch OHG served by Cloudflare. When a visitor opens your page:

• The visitor's browser requests the module from our edge. Cloudflare processes the visitor's IP address and browser request for the moment of delivery, as any web server does; nothing is stored about the person.
• We count one view per module shown, together with the host name of your page — a monthly number per module and host that shows your plan's usage. No cookie, no local storage entry, no fingerprint and no identifier are set in the visitor's browser.
• Fonts the module uses are served from our edge; the visitor's browser does not contact Google.
• If you place modules with our WordPress plugin, the same applies; in addition your site's server asks our edge for a module's start (its height and background) when you save a page and about once a day — with the module's key and your site's host name, no visitor involved, no view counted.
• Videos or pictures you added come from our edge too. Media you linked from elsewhere (a YouTube video, for example) come from that provider under its rules; the module's settings let you use YouTube's no-cookie mode and defer such media until your consent tool allows it.

In the language of the GDPR, you are the controller for your site and we process the visitor's request on your behalf as a processor; the data processing agreement forms part of our Terms of service and applies without a signature.

A paragraph you can use

Animated content on this site is delivered by SR Anywhere, a service of ThemePunch OHG, c/o Startplatz, Im Mediapark 5, 50670 Köln, Germany, from servers of Cloudflare, Inc. To display it, your browser's request including your IP address is processed for the moment of delivery; SR Anywhere counts how often the content was shown, without identifying you, and sets no cookies. Details: https://anywhere.sliderrevolution.com/portal/legal#embed

Last updated: 13 October 2026.

Processors and sub-processors

ThemePunch OHG uses the following processors for SR Anywhere. The list is Annex 3 of the data processing agreement for business customers. We announce an added or replaced sub-processor on this page at least 30 days before it is engaged; to be told by e-mail as well, write to info@themepunch.com with the subject "Sub-processor updates".

Not processors: Patchstack OÜ (Pärnu, Estonia), which runs the vulnerability disclosure program for our products, receives the security reports from help requests and handles them under its own responsibility. The provider of an assistant you connect yourself (Anthropic or OpenAI through Settings → Connections) acts under your own contract; YouTube or other media providers you link inside a module act under their own rules towards your visitors. Hugging Face, Inc. (USA) and jsDelivr (a public content delivery network for open-source files), from which your browser downloads the depth model, its library and its runtime once (Depth maps for Layer Depth effects), see only that download — your IP address, your browser — and never the photo; they act under their own policies.

Not used any more: Anthropic PBC as a direct provider (the account is parked since 2026-09-29; Anthropic's model runs on Amazon Bedrock in the EU instead).

Last updated: 29 October 2026.

Data processing agreement (Art. 28 GDPR)

Version of 29 October 2026. For business customers whose SR Anywhere modules run on their websites: in delivering the modules we process the visitors' requests on the customer's behalf. This agreement forms part of the Terms of service and is concluded in electronic form (Art. 28 (9) GDPR) when the customer accepts them; no signature is needed. Annex 1 describes the processing, Annex 2 the technical and organisational measures, Annex 3 is the sub-processor list.

between the customer named in the SR Anywhere account ("Controller") and ThemePunch OHG, c/o Startplatz, Im Mediapark 5, 50670 Köln, Germany, info@themepunch.com ("Processor"); the Processor's data protection contact is Dirk Gavor, partner, info@themepunch.com.

1. Subject matter and duration

1.1 The Processor provides SR Anywhere: a service to build animated modules and to deliver them to the Controller's websites (the "Service", governed by the Terms of service). In delivering modules to the visitors of the Controller's websites and in counting their views, the Processor processes personal data on behalf of the Controller. 1.2 This agreement applies for as long as the Controller holds an account with published modules, and until the data under 9 is deleted.

2. Nature, purpose, data, data subjects

As described in Annex 1. The Processor processes the data only for the delivery and the operation of the Service.

3. Instructions

3.1 The Processor processes personal data only on the Controller's documented instructions. The instructions are: the Terms of service, this agreement, and the settings the Controller makes in the account (the domains, the modules, the media, the consent tool and YouTube no-cookie settings, the fonts setting). Further instructions in text form. 3.2 The Processor informs the Controller without delay if an instruction in its view infringes the GDPR.

4. Confidentiality

Persons authorised to process the data are bound to confidentiality. Access to customer accounts by the Processor's staff happens only with the Controller's permission given in the account (support access), for a limited time, and is logged in the account.

5. Security (Art. 32)

The Processor implements the measures in Annex 2 and keeps them current with the state of the art; it may change them as long as the level of protection does not fall.

6. Sub-processors

6.1 The Controller authorises the sub-processors in Annex 3 (a general authorisation). The Processor informs the Controller of an intended new sub-processor or a replacement at least 30 days before it takes up work, on the processor page and by mail to every Controller who asked to be told (a mail to info@themepunch.com with the subject "Sub-processor updates" is enough); the Controller may object on reasonable grounds within that period, in which case the parties seek a solution and, failing that, the Controller may terminate the affected part of the Service. 6.2 The Processor imposes the obligations of this agreement on every sub-processor by contract and remains liable for its performance.

7. Data subjects' rights

The Processor supports the Controller with appropriate measures in answering data subjects' requests (Art. 12–22). As the Processor holds no data that identifies a visitor beyond the moment of delivery (Annex 1), such requests will in most cases be answered by the Controller alone; the Processor forwards requests it receives.

8. Personal data breaches, assistance

8.1 The Processor notifies the Controller without undue delay after becoming aware of a personal data breach concerning the Controller's data, with the information Art. 33 (3) requires as far as it is available. 8.2 The Processor assists the Controller with Art. 32–36 (security, breach notifications, data protection impact assessments, prior consultation), taking into account the nature of the processing and the information available.

9. Deletion and return

At the end of the Service (the account deleted, or a module unpublished) the Processor deletes the personal data processed on behalf of the Controller as set out in the privacy policy's retention table — view counts remain as aggregate numbers without personal reference — unless Union or Member State law requires storage. Copies in the backups (Annex 2) are gone about 30 days after the deletion. The Controller exports its own data at any time (Settings → Download my data).

10. Audits

10.1 The Processor makes available the information necessary to demonstrate compliance with Art. 28 and this agreement: this document, Annex 2, the sub-processors' certifications and audit reports (Cloudflare's, Brevo's and the AI provider's SOC 2 / ISO 27001 reports as they are published). 10.2 Where that is not sufficient, the Controller may audit once a year, or on the occasion of a breach, with 30 days' notice, during business hours, at its own cost, by itself or an independent auditor bound to confidentiality; audits of sub-processors are done through the sub-processors' own reports.

11. International transfers

The modules and media are stored in the European Union: the Service's database and file storage, and the backup of the files, are kept at Cloudflare with its EU jurisdiction set. Processing takes place in the EU and the UK, and at Cloudflare's edge worldwide where a visitor is (delivery, its cache, the short key records the edge reads to deliver a module, which Cloudflare replicates worldwide, and the view counts in Cloudflare's analytics store); the language model on Amazon Bedrock in AWS's EU Regions, or at OpenAI Ireland Ltd when the AI service uses its second engine. Transfers outside the EEA rest on adequacy decisions (UK, Israel), the EU-US Data Privacy Framework for certified providers (Cloudflare), or the Standard Contractual Clauses (Commission Decision 2021/914) in the sub-processors' agreements, as listed in Annex 3.

12. Liability, precedence

The Parties' liability under this agreement follows the liability provisions of the Terms of service; nothing in this agreement limits either Party's liability towards data subjects under Art. 82 GDPR. This agreement prevails over the Terms in matters of data protection. German law applies; where the Controller is a merchant, a legal entity under public law or a special fund under public law, the venue is Köln. The rights of data subjects under Art. 79 GDPR stay unaffected.

---

Annex 1 — The processing

Subject: delivery of the Controller's modules (scripts, content, media, fonts) to visitors of the Controller's websites; counting of views. Nature: transmission at request; counting; storage of the modules and media the Controller created (the Controller's own data, not visitors'). Purpose: performance of the Service as agreed in the Terms. Data subjects: visitors of the Controller's websites; the Controller's users of the Service (the account's members). Categories of data: for visitors — the IP address and the browser request (user agent, page referrer) at the moment of delivery, processed at Cloudflare's edge and not stored by the Processor; the host name of the page a module was shown on and the count of views per module and month (no personal reference). For members — the e-mail address, sign-in times, the modules and media they create, help requests. Special categories: none intended; the Controller ensures its modules carry no special categories of data. Duration: the life of the account; visitors' request data only for the moment of delivery.

Annex 2 — Technical and organisational measures

• Hosting and delivery on Cloudflare (ISO 27001, SOC 2 Type II): DDoS protection, WAF, TLS 1.2+ in transit on every route; storage encrypted at rest (D1, R2, KV); the database (D1) and the file storage (R2) with Cloudflare's EU jurisdiction, stored only in the EU; the delivery's key records (KV) and the edge network worldwide.
• Access to systems: personal staff logins only (no shared password since 2026-09-24); the Cloudflare account is held by the partners; secrets are set outside the code and never in the repository; deployments only on the responsible partner's go.
• Access to customer data: staff sees an account's master data only; module content only with the customer's permission (support access: time-limited, read only unless "may change", revocable, every step logged for the customer); AI preparation of help requests reads module content only under that permission and logs it.
• Authentication: sign-in by single-use mailed links (60 minutes), only hashes stored; sessions as HttpOnly cookies; rate limits per address and per network (hashed IPs, one day).
• Data minimisation: view counts are aggregates per module, host and month; no cookies or identifiers in visitors' browsers; fonts served from the edge so visitors' browsers do not contact Google; help requests are pseudonymised before any AI provider sees them.
• Separation: every database query is scoped to the account; tenant isolation is part of the automated test suites run before every deployment.
• Retention: the schedule of the privacy policy, enforced by daily jobs (help requests anonymised after 24 months, attachments deleted after 90 days, mail logs after 180 days, rate-limit hashes after a day).
• Backups and recovery: the database (Cloudflare D1) can be restored to any minute of the last 30 days (D1 Time Travel); modules and media in Cloudflare R2 are stored redundantly by Cloudflare and copied every night into a separate backup bucket, also in the EU. Deleted data stays in the backups for about 30 days, the files of an erased account included; the backup keeps only the newest copy of each object, no older versions. The services are deployed from a version-controlled repository and can be redeployed at any time. Published modules keep rendering when the portal is unavailable.
• Logging: Worker logs with technical data for a short period; support actions logged in the account.
• Sub-processor management: the list in Annex 3, contracts under Art. 28, notice before changes.
• Confidentiality: everyone we authorise to process personal data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.
• Review: the measures are reviewed at least once a year and on every change of the architecture.

Annex 3 — Sub-processors

The processors and sub-processors list, as current on the date of acceptance and as updated under section 6.

Accessibility statement

Statement according to the Barrierefreiheitsstärkungsgesetz (BFSG), in force since 28 June 2025 for consumer-facing digital services. ThemePunch OHG aims to make the SR Anywhere website and portal accessible in line with WCAG 2.1 at level AA (EN 301 549).

Status: partially conformant. The portal is built with keyboard-reachable controls, focus states, dark and light themes, and text alternatives for icons; the website's animated sections respect the reduced-motion setting of your system. The editor inherits the Slider Revolution engine's interface, which is not yet fully conformant.

Known gaps:

• the editor's canvas and some of its panels are not fully operable by keyboard;
• not every animated preview on the website has a reduced-motion variant yet;
• colour contrast has not yet been checked on every page in both the dark and the light theme.

Modules our customers publish are the customer's content; the engine offers reduced-motion behaviour and keyboard navigation where the module's settings allow it, and the customer is responsible for alternative texts (the media library asks for them).

Feedback and contact: if something is not accessible to you, write to help@anywhere.sliderrevolution.com or open a request from the portal; we answer within five working days.

Enforcement: if our answer does not satisfy you, you can turn to the market surveillance authority of the German federal states for the BFSG: Marktüberwachungsstelle der Länder für die Barrierefreiheit von Produkten und Dienstleistungen (MLBF), Carl-Miller-Straße 6, 39112 Magdeburg, Germany, kontakt@mlbf-barrierefrei.de.

This statement was created and last reviewed on 13 October 2026.