Stephan Lindauer, Kremenholler Str. 91a, 42857 Remscheid, Germany.
Email: hello@mrrcard.io
mrrcard.io turns revenue figures from payment providers you connect into public badges. To do so we process: your email address (account), the API keys you provide (encrypted), the revenue metrics retrieved with them, and — if you subscribe to Pro — subscription details from our payment provider. We do not use analytics, tracking or advertising tools.
The website is hosted by Uberspace (jonaspasche GmbH) in Germany under a data processing agreement. When you visit the site, the server automatically records information your browser transmits (including IP address, date and time, requested resource). This serves security, stability and the prevention of abuse (Art. 6 (1) (f) GDPR). Logs are kept for a short period and then deleted. To limit abuse (e.g. mass sign-in requests), IP addresses are additionally held in memory for a few minutes.
We only use cookies that are strictly necessary to keep you signed in (§ 25 (2) TDDDG):
mc_at — sign-in token, expires after 1 hour;mc_rt — renews your sign-in so you don't have to log in again, expires after 30 days
or when you log out.Both are only set after you sign in. We use no tracking or marketing cookies, so no consent banner is required. The Lemon Squeezy checkout runs on Lemon Squeezy's own domain and is governed by its privacy policy (see section 8).
To create and use an account we process your email address (Art. 6 (1) (b) GDPR). Sign-in works via a one-time link sent by email. Account management and authentication are provided by Supabase (see section 9); the emails are sent through our own mail server at Uberspace (sender no-reply@mrrcard.io).
When you connect a provider (e.g. RevenueCat or Stripe), we store the API key exclusively in encrypted form (AES-256-GCM) and use it server-side only to retrieve your revenue metrics, currently about once per hour. We store the retrieved values (MRR, number of active subscriptions, timestamp) to show the current value and its trend. The key is never passed to third parties or to the browser in plain text. We strongly recommend read-only keys with the smallest possible scope. Legal basis: Art. 6 (1) (b) GDPR.
Publishing figures is the purpose of the service: each badge's name, website, current MRR, trend and — if enabled — subscriber count are publicly accessible at its link (mrrcard.io/c/…). When you share the link, platforms such as X or Mastodon fetch the badge image. If you choose to, the badge is also listed on the public Explore page; you decide this per badge when you create it. You decide what you publish; you can delete a badge at any time.
Pro subscriptions are sold and processed by Lemon Squeezy, LLC (USA), which acts as merchant of record: Lemon Squeezy is the seller, handles payment, invoicing and taxes, and processes your name, email, billing address and payment details under its own responsibility (see Lemon Squeezy's privacy policy). We receive and store only what we need to unlock Pro: customer ID, subscription ID, plan, status and renewal/end dates (Art. 6 (1) (b) GDPR). This involves a transfer to the USA, based on the EU-US Data Privacy Framework or EU standard contractual clauses.
We use Supabase (Supabase, Inc., USA) for the database and authentication under a data processing agreement. Where data is transferred to a third country (USA), this is based on appropriate safeguards (EU standard contractual clauses or the EU-US Data Privacy Framework). Legal basis: Art. 6 (1) (b) and (f) GDPR.
We keep your data for as long as you have an account. You can delete your account at any time in the dashboard ("Delete account"): your account, all badges, their history and your stored subscription details are deleted immediately, and an active subscription is cancelled. Lemon Squeezy retains transaction records according to its statutory obligations. Server logs are deleted after a short period (section 3).
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). You may withdraw any consent at any time (Art. 7 (3) GDPR). To exercise your rights, email hello@mrrcard.io. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany.
Last updated: October 2026