Privacy Policy

1. Data controller

2. Personal data collected

We collect the following data:

3. Purpose of processing

• Providing, maintaining, and developing the service
• User account management and authentication
• Generating and delivering inspection reports
• Training and improving AI models (anonymised)
• Customer communication, billing, and technical support
• Legal obligations and security

4. Legal basis for processing

The processing of personal data is based on:

• Contract (Art. 6(1)(b)): Service delivery and user account management
• Consent (Art. 6(1)(a)): Marketing communications, cookies
• Legitimate interest (Art. 6(1)(f)): Service development, security, analytics
• Legal obligation (Art. 6(1)(c)): Accounting, regulatory obligations

5. Data retention and location

Personal data is retained for as long as the user account is active. After account deletion, data is erased within 90 days. Billing data is retained for 6 years in accordance with accounting legislation.

6. Data sharing

We do not sell or disclose personal data to third parties for marketing purposes. Data may be shared with:

• Sub-processors: Cloud services (infrastructure), Stripe (payments)
• Authorities: When required by law
• At the customer's request: Delivery of reports to designated recipients

7. Cookies & browser storage

We use only essential browser storage for the service to function:

• Login session management (JWT token in browser localStorage – not in a cookie)
• Language preference (localStorage)

We do not use Google Analytics, advertising cookies, or profiling tools. Usage is measured with Vercel's built-in analytics (cookie-free, no personal data collection). The platform is hosted on Vercel (web) and Hetzner (API, database) – DPAs with these processors are in place.

8. Data subject rights (GDPR)

Under the EU General Data Protection Regulation (GDPR), you have the right to:

9. Security

We protect data through technical and organisational measures:

• All traffic encrypted (TLS/HTTPS)
• Passwords hashed with bcrypt (12 rounds)
• Role-based access control (4 user roles)
• Login attempt rate limiting and account lockout
• Audit logs for all user actions
• OWASP Top 10 protections (SQL injection, XSS, CSRF)
• Regular security audits

10. Changes to this privacy policy

We update this privacy policy as needed. Significant changes will be communicated by email or through the service at least 30 days in advance.

11. Contact for data protection matters

For all questions regarding the processing of personal data, please contact: