Privacy Policy

1. Responsible Party

Craftium Jan Kosse
Schönfließer Str. 34
13465 Berlin
E-Mail: craftium.berlin@gmail.com

2. Collection and Storage of Personal Data

When visiting our website, information is automatically collected by the hosting provider (Vercel Inc.). This data includes IP address, browser type, operating system, referrer URL, hostname of the accessing computer and time of the request. This data is not merged with other data sources.

3. Registration and User Account

During registration we collect the following data:

• Email address
• Password (stored encrypted)
• Optional: display name

Data is stored with our database service provider Supabase (Supabase Inc., USA). Supabase uses SOC-2 certified data centers. The legal basis is Art. 6 Para. 1 lit. b GDPR (performance of contract).

4. Sensor Data

When you connect sensors to your account, the following data is collected and stored:

• Temperature and humidity measurements
• Calculated dew point values
• Measurement timestamps
• Device IDs of connected sensors and actuators

This data is required for ventilation control calculation (legal basis: Art. 6 Para. 1 lit. b GDPR). Measurement data is automatically deleted after a maximum of 90 days.

5. Payment Processing

For payment processing we use the service provider Stripe (Stripe Inc., USA). When upgrading to the Pro plan, you are redirected to Stripe. Stripe collects and processes payment data (credit card number, expiration date, CVC) directly. We only store the Stripe customer ID and subscription status. Legal basis: Art. 6 Para. 1 lit. b GDPR.

Stripe Privacy Policy: https://stripe.com/privacy

6. Email Notifications

If you enable email notifications, we use the service Resend (Resend Inc., USA) for sending. Only the email address and notification content are transmitted. Legal basis: Art. 6 Para. 1 lit. a GDPR (consent).

7. Push Notifications (Mobile App)

If you use our Android app and enable push notifications, a device token (Firebase Cloud Messaging Token) is generated and stored in your user profile. This token is exclusively used to send you notifications (e.g. sensor offline, ventilation activated/deactivated).

For sending we use Firebase Cloud Messaging (Google Ireland Ltd.). Google receives the device token and message contents. No personal data beyond the token is transmitted to Google. Legal basis: Art. 6 Para. 1 lit. a GDPR (consent). You can disable push notifications at any time in your device settings.

Google/Firebase Privacy Policy: https://firebase.google.com/support/privacy

8. Mobile App

Our Android app (available on Google Play Store) is a hybrid app that displays the web application in a native wrapper. The same privacy provisions apply as for the web application. Additionally, the following data is collected:

• Device token for push notifications (see section 7)
• Device platform (Android/iOS) for display adaptation

The app requires "Internet" permission for data transfer. Push notifications require an additional permission that is requested on first launch.

9. Cookies

We exclusively use technically necessary cookies for authentication (session cookie). No tracking or analytics cookies are used.

10. Your Rights

You have the right to:

• Information (Art. 15 GDPR) – What data we have stored about you
• Rectification (Art. 16 GDPR) – Correction of inaccurate data
• Erasure (Art. 17 GDPR) – Deletion of your data
• Restriction (Art. 18 GDPR) – Restriction of processing
• Data portability (Art. 20 GDPR) – Export of your data
• Objection (Art. 21 GDPR) – Objection to processing

To exercise your rights, contact us at craftium.berlin@gmail.com.

11. Right to Complain

You have the right to file a complaint with a data protection supervisory authority regarding the processing of your personal data.