Privacy policy
For the website falzup.de / falzup.com and the app at app.falzup.de. Last updated: October 2026.
1. Controller
No data protection officer has been appointed, as there is no legal obligation to do so.
2. In short
- The website sets no cookies and uses no analytics or advertising services (no Google Analytics, no Meta Pixel, no social media plugins).
- Fonts and scripts are loaded from our own server, not from third parties.
- All data is stored on servers in Germany.
- We do not sell data or share it for advertising.
3. Hosting
The website and app run on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its Falkenstein data centre. A data processing agreement under Art. 28 GDPR is in place with Hetzner. All connections are encrypted via HTTPS.
4. Server logs
For every request the server automatically records: IP address, date and time, page requested, status code, amount of data transferred, referring page and browser/operating system. This is needed to deliver the site securely and reliably and to detect attacks (Art. 6(1)(f) GDPR). Logs are deleted after 14 days at the latest.
5. Contact by email
If you write to us, we process your details to answer your enquiry (Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f)). We delete the message once it has been dealt with, unless we are required to keep it. Our email is hosted by INWX GmbH & Co. KG, Prinzessinnenstr. 30, 10969 Berlin, Germany, with whom a data processing agreement under Art. 28 GDPR is in place.
6. Registration and use of the app
What data
- Company and account data: company name, users’ names and email addresses, selected plan. Passwords are stored only as a secure hash, never in plain text.
- Project data: everything you enter in the app, e.g. projects, site addresses, measurements, drawings, notes, uploaded images and order lists.
- Feedback: notes you send via the feedback function, together with the place in the app they refer to.
The legal basis is performance of the contract (Art. 6(1)(b) GDPR).
Your employees’ data
If a company creates accounts for its employees, the company is the controller for that data and FalzUP processes it on the company’s behalf (Art. 28 GDPR). We conclude a data processing agreement with the company for this.
Login cookie
Only the app (not the website) sets a single cookie after login so you stay signed in. It is strictly necessary (§ 25(2) no. 2 TDDDG), contains only a random identifier and expires after 12 hours or when you log out.
Abuse protection
To slow down password guessing, the server counts failed logins per IP address. This count is held in memory only and expires automatically after a short time (Art. 6(1)(f) GDPR).
Location for site addresses
Only when you tap “Use current location” and your device allows it does the app read your location. Our server then sends only the coordinates to the Nominatim address service of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) to turn them into an address. Your IP address is not passed on. The United Kingdom is covered by an EU adequacy decision. The legal basis is Art. 6(1)(b) GDPR.
Backups
So that no measurements are lost, we back up the data daily: encrypted to a second storage location at Hetzner in Falkenstein (Germany), as a copy of the database on the server (30 days) and as a backup of the whole server at Hetzner (the last 7 days). Daily, weekly and monthly states of the encrypted backup are kept for at most 12 months; older backups are deleted automatically.
Retention
We keep account and project data for as long as the account exists. After the contract ends we delete it unless statutory retention duties apply (e.g. for invoices). It disappears from backups after 12 months at the latest.
7. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Just send an email to the address above.
You may also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.
8. No automated decisions
We do not make automated decisions or create profiles.
9. Changes
If new services are added (e.g. a payment provider), we will update this policy.
The German version of this policy is the legally binding one: Datenschutzerklärung.