Privacy policy

Who is responsible

The controller for pelletyze.com, pelletyze.de and the app on pelletyze.app is Daniel Brüggemann. Write to [PENDING] about anything in this policy. The postal address is in the imprint.

Hosting

Vercel hosts the website and the app. When you open a page, your browser sends technical data such as your IP address, the date and time, the page and your browser type. Vercel processes this data to deliver the pages and keep them secure. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a working and secure service.

The fonts are delivered from our own host, so your browser does not contact Google or any other font service.

We set only cookies that the service needs: one that keeps you signed in to the app and one that remembers your language. Legal basis: § 25(2) TDDDG.

Website analytics

We count visits with Pirsch, a cookie-free analytics service from Germany. Pirsch does not store your IP address. It builds an anonymous identifier from your IP address and browser that changes every day, so we see how many people visit, not who they are. Query strings in links are not sent to Pirsch, and the unsubscribe page passes no referrer to the next page. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing how the website and the app are used.

Pirsch runs on all pages of the website and the app.

Invite signup

When you sign up for an invite, we store your email address, the language of the page and the time of the signup.

To keep out spam bots, the form carries a signed timestamp and a hidden field. Our server also sends your email address and your IP address to StopForumSpam (stopforumspam.com), a public database of known spammers. StopForumSpam answers whether they are listed. If they are, we keep the signup marked as spam and send you no email. We do not store your IP address.

We send you a confirmation email through Uberspace (Jonas Pasche, Mainz) (borrelly.uberspace.de). The operator also gets a short email with your address for each signup, including those marked as spam, and for each unsubscribe. The signup email also names the language. Every invite email has a link to a page where one click on the confirm button deletes your signup right away.

Legal basis: Art. 6(1)(b) GDPR, because you asked for an invite; for the spam check, Art. 6(1)(f) GDPR, our legitimate interest in a service free of abuse.

What the app stores

Your account: your email address and your password, which Supabase stores only as a hash.

Your profile: a username and a full name, both optional.

Your fillings: the date, the number of bags and the values calculated from them, also when you import them from a CSV file. Only your account can read your fillings.

To run and secure the service, Supabase logs technical data about requests from the app, such as your IP address and the times you sign in.

Legal basis: Art. 6(1)(b) GDPR, because we need this data to provide the app to you; for the technical logs, Art. 6(1)(f) GDPR, our legitimate interest in a secure service.

Who processes your data

We use these service providers. They process data only on our behalf and under a data processing agreement (Art. 28 GDPR).

Supabase (Supabase Inc.): database and login for the app and the invite list, hosted in the EU (region eu-central-1, Frankfurt). Vercel (Vercel Inc.): hosting of the website and the app. Pirsch (Emvi Software GmbH, Germany): cookie-free analytics. Uberspace (Jonas Pasche, Mainz): sending invite emails.

StopForumSpam is not our processor. It receives your email address and IP address once per invite signup for the spam check described above.

Supabase and Vercel are US companies. Where they can access data from outside the EU, the transfer is based on the EU-US Data Privacy Framework or the EU standard contractual clauses (Art. 45 and 46 GDPR).

How long we keep it

App data stays until your account is deleted. Invite signups stay until you confirm the removal through the link in the invite email or ask us to delete them. Vercel and Supabase keep technical logs only as long as needed for operation and security. Supabase backups are overwritten on a rolling basis, so deleted data also disappears from them after a short time.

Deleting your account

On the overview page, Delete all fillings removes all your fillings right away. To delete your whole account, write to [PENDING]. We then delete your login, your profile and all your fillings.

Your rights

You have the right to access (Art. 15 GDPR), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Write to [PENDING].

Right to object: where we process data based on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation (Art. 21 GDPR).

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example the one where you live.

We do not use automated decision-making or profiling.

Changes

We update this policy when the website or the app changes. The date at the top shows the current version.