Privacy Policy

Last updated: [DATE OF LAST UPDATE]

Courtesy English translation. The German version ("Datenschutzerklärung") is the legally binding one under German/EU law.

Note: the controller's street and house number, and the date below, are still placeholders and must be filled in. This policy describes this site's actual, technical data processing as accurately as possible, but is not a substitute for individual legal advice — have it reviewed by a professional before going live.

1. Controller

The controller responsible for data processing under the GDPR is:
Daniel Ehrlich
[STREET AND NUMBER]
55286 Wörrstadt
Germany
Email: support@growassistant.io

2. Hosting

This site is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The hosting provider processes technical connection data on our behalf (data processing agreement per Art. 28 GDPR) that is automatically generated when this site is accessed — including IP address, date and time of access, page requested, browser and operating system used, and referrer URL. This data is processed solely to technically deliver the site, ensure system security, and diagnose faults (legal basis: Art. 6(1)(f) GDPR, legitimate interest in secure and functioning operation) and is automatically deleted after [RETENTION PERIOD, e.g. "7 days"] unless a statutory retention obligation applies. A data processing agreement with ALL-INKL.COM is in place (standard for all All-Inkl hosting customers).

3. No cookies, no tracking, no analytics

This site is static and uses no cookies of its own, no tracking pixels, and no analytics or marketing tools (e.g. Google Analytics). No usage profiles are created. The only exception is the automated spam-protection check on the feedback form, described in section 5 below.

4. Google Fonts (loaded externally)

This site embeds the "Manrope" and "Inter" typefaces via the Google Fonts API (fonts.googleapis.com, fonts.gstatic.com). When a page is loaded, your browser fetches the required font files directly from servers operated by Google Ireland Limited (or Google LLC, USA); in doing so, your IP address is transmitted to Google. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in a consistent, performant presentation without self-hosting font files). More information: Google's privacy policy. [OPTIONAL: self-host the fonts to avoid this external data transfer entirely.]

5. Spam protection on the feedback form (Cloudflare Turnstile)

The feedback form is protected by Cloudflare Turnstile, a privacy-focused alternative to traditional image/text CAPTCHAs. When you open the form, your browser loads a script from Cloudflare (challenges.cloudflare.com) and runs a non-visible challenge in the background; in the process your IP address and certain browser/device signals are transmitted to Cloudflare, Inc. / Cloudflare Germany GmbH and processed to confirm that the submission is not automated. The resulting token is sent along with the form and verified on our server before any message is forwarded; it is not stored beyond that verification. Turnstile does not set advertising or cross-site tracking cookies. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting the form from automated abuse and spam). More information: Cloudflare's privacy policy.

6. Contacting us via the feedback form

The feedback form lets you submit ideas, requests, and change proposals. In doing so we process:

Name or alias (required)
Email address (optional, for follow-up questions only)
Category, title, description, and benefit of the proposal (required)
technical anti-spam metadata (IP address, submission timestamp, and the Cloudflare Turnstile verification result — used only for abuse prevention, see section 5)

Submitted data is sent by email to a project-owned inbox (support@growassistant.io) and processed there to review, cluster, and prioritize proposals. Data is not shared with third parties. Legal basis is Art. 6(1)(a) GDPR (consent given by actively submitting the form) and, where it concerns developing the open-source project, Art. 6(1)(f) GDPR (legitimate interest in product improvement). Data is deleted once it is no longer needed to process the proposal, at the latest after [RETENTION PERIOD, e.g. "12 months"].

To protect against automated spam submissions, the form additionally uses an invisible honeypot field, a minimum fill-time check, and IP-based rate limiting alongside Cloudflare Turnstile (section 5). These purely technical checks are not stored permanently and serve abuse prevention only (legal basis: Art. 6(1)(f) GDPR).

7. External links (GitHub, Instagram)

This site links, in several places, to external services (the GitHub repository, the Instagram profile) as plain links. These are not loaded as embedded widgets — simply visiting this site does not transfer any data to GitHub or Meta/Instagram. Only if you actively click a link does that provider's own privacy policy apply:

8. Your rights as a data subject

Under applicable law you have the right, at any time, to:

access your personal data we hold (Art. 15 GDPR)
rectify inaccurate data (Art. 16 GDPR)
erase your data held by us (Art. 17 GDPR)
restrict processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
object to processing (Art. 21 GDPR)
withdraw consent already given, with future effect (Art. 7(3) GDPR)

To exercise these rights, an informal email to support@growassistant.io is sufficient. You also have the right to lodge a complaint with the competent data protection supervisory authority — for the controller's location in Rhineland-Palatinate, this is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.

9. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Proposals submitted via the feedback form are reviewed and decided on by a human; any AI-assisted pre-sorting is used only to prepare that review, never to make the final decision automatically.