Privacy policy
per Art. 13, 14 GDPR. The German version of this page is the legally binding one — this is a courtesy translation.
1. Controller
The controller responsible for processing personal data on this website and through our services is:
Florian Heuberger
Am Steinhaus 2
63546 Hammersbach
Deutschland
Represented by: Florian Heuberger
Email:
info@beetlotse.de
2. Data protection officer
We have not appointed a data protection officer. The obligation under Art. 37 GDPR / § 38 BDSG does not currently apply to us: we employ fewer than 20 people regularly processing personal data, and we do not process special categories under Art. 9 GDPR on a large scale. Data-protection requests please go to info@beetlotse.de.
3. Purposes and legal bases
We process personal data for the following purposes on the following legal bases:
| Purpose | Data categories | Legal basis |
|---|---|---|
| Providing the website / app | IP address, device model, app version, language | Art. 6(1)(f) GDPR (legitimate interest: secure operation) |
| Registration and account management | Email, first and last name, username, hashed password | Art. 6(1)(b) GDPR (contract performance) |
| Plant / task management | Tray, cell, plant data; coordinates and uploaded pictures where provided | Art. 6(1)(b) GDPR (contract performance) |
| Transactional email (verification, password reset) | Email, message content | Art. 6(1)(b) GDPR (contract performance) |
| Push notifications | Device push token, reminder content | Art. 6(1)(b) GDPR (contract performance) |
| Marketing email (newsletter) | Email, first name | Art. 6(1)(a) GDPR (consent) — opt-in, withdrawable at any time |
| Crash and error reporting | Stack trace, device model, app version; NEVER your content | Art. 6(1)(f) GDPR (legitimate interest: stability) |
| Sign in with Apple / Google (optional) | OAuth subject ID, email, first and last name | Art. 6(1)(b) GDPR; only when you actively use that button |
4. Retention
We retain personal data only as long as we need it for the purposes listed, or as long as statutory retention rules (e.g. § 257 HGB, § 147 AO) require. Specifically:
- Account + plant content: until you delete your account.
- Email send logs: max 12 months for spam / bounce handling.
- Server access logs: max 14 days.
- Backups: rotating up to 30 days; permanently removed after the next backup cycle following account deletion.
- Invoices and tax records (where applicable): 10 years per § 147(3) AO.
5. Recipients
We work with carefully selected processors (Art. 28 GDPR). We have a data-processing agreement with each.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server- und Datenbank-Hosting (PostgreSQL, Redis, Backups). | Deutschland |
| Hetzner Object Storage | Speicherung der von Nutzer:innen hochgeladenen Pflanzen- bilder (S3-kompatibel). | Deutschland (Falkenstein / Nürnberg) |
| Namecheap, Inc. (PrivateEmail) | Transaktionale E-Mails (Bestätigung der Registrierung, Passwort-Reset, Aufgaben-Erinnerungen). |
USA (mit Subprozessoren in Kanada)
Third country |
| Google LLC (Firebase Cloud Messaging) | Push-Benachrichtigungen für Android-Geräte (Gieß-Erinne- rungen, Ernte-Hinweise). |
USA
Third country |
| Apple Inc. (Apple Push Notification service) | Push-Benachrichtigungen für iOS-Geräte. |
USA
Third country |
| Functional Software, Inc. (Sentry) | Crash- und Fehler-Reporting, ausschließlich in der Produktions- umgebung. Keine personenbezogenen Inhalte; übertragen werden Stack Traces, Geräte-Modell, App-Version. |
USA
Third country |
| Google LLC (Sign in with Google) | Optionale Anmeldung über ein Google-Konto. Nur aktiv, wenn die Nutzer:in den Login-Button bewusst nutzt. |
USA
Third country |
| Apple Inc. (Sign in with Apple) | Optionale Anmeldung über eine Apple-ID. Nur aktiv, wenn die Nutzer:in den Login-Button bewusst nutzt. |
USA
Third country |
6. Third-country transfers
Some of our processors are outside the EU / EEA. For transfers to these countries we rely on the safeguards under Art. 46 GDPR listed below:
- Namecheap, Inc. (PrivateEmail) (USA (mit Subprozessoren in Kanada)): Standardvertragsklauseln (Art. 46 Abs. 2 lit. c DSGVO).
- Google LLC (Firebase Cloud Messaging) (USA): Standardvertragsklauseln + EU-US Data Privacy Framework.
- Apple Inc. (Apple Push Notification service) (USA): Standardvertragsklauseln.
- Functional Software, Inc. (Sentry) (USA): Standardvertragsklauseln + EU-US Data Privacy Framework.
- Google LLC (Sign in with Google) (USA): Standardvertragsklauseln + EU-US Data Privacy Framework.
- Apple Inc. (Sign in with Apple) (USA): Standardvertragsklauseln.
A copy of the Standard Contractual Clauses used for any given transfer is available on request to info@beetlotse.de.
7. Your rights
You have the right at any time to:
- Access to your data (Art. 15 GDPR).
- Rectification of inaccurate data (Art. 16 GDPR).
- Erasure ("right to be forgotten", Art. 17 GDPR).
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR).
- Object to processing based on legitimate interest (Art. 21 GDPR).
- Withdraw consent at any time, with effect for the future (Art. 7(3) GDPR).
Email info@beetlotse.de; we respond within the 30-day window required by Art. 12(3) GDPR.
8. Right to complain to a supervisory authority
You also have the right to lodge a complaint with a data- protection supervisory authority (Art. 77 GDPR). Ours is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Wilhelmstraße 7, 65185 Wiesbaden
Phone: +49 611 1408-0
Email:
poststelle@datenschutz.hessen.de
Web: https://datenschutz.hessen.de/
9. Cookies and similar technologies
This site uses only strictly necessary cookies (login, banner dismissal). No tracking, no analytics, no advertising cookies. See the cookie overview for the full list.
10. Server logs
When you visit the site, our server temporarily records your IP address, the timestamp of the request, the URL requested, the HTTP status code, the referer, and the user-agent. Logs are deleted within 14 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
11. Automated decision-making
We do not make solely automated decisions, including profiling, that produce legal effects on you.
12. Changes to this policy
We update this policy when our processing or our processor list materially changes. The current version always lives here.