ℹ️ This is a non-binding English translation provided for convenience. The legally binding version is the German one: Deutsche Fassung.

Privacy Policy

Last updated: 3 July 2026

1. Controller

The controller responsible for data processing within the meaning of the GDPR is:

Marius Erdmann (kontiTec)
Brunnenstraße 1a, 56459 Langenhahn, Germany
E-mail: info@gruenki.de · Phone: +49 152 53622816

A data protection officer is not legally required and has therefore not been appointed. Please direct privacy-related inquiries to the e-mail address listed above.

2. Overview

gruenki is an AI chat service. We only process the data required to operate the service. Your content is processed and stored in Germany; personal content is held field-encrypted (encrypted at rest) in the database. We do not use your content for advertising, do not sell it, and do not train any AI models with it.

3. What data we process

• Account data: e-mail address and password (stored only as a hash); when signing in via Google, the identifier provided by Google.
• Chat content: your messages and the assistant's responses, your persistent memory, reminders and to-dos.
• Uploaded files: documents and images you upload for processing, as well as the text extracted from them.
• Team/organisation data: memberships, roles and shared content (e.g. team knowledge base).
• Technical data: server log data necessary for operation.

4. Purposes and legal bases

We process this data to provide you with the service (performance of a contract or usage relationship, Art. 6(1)(b) GDPR) and to ensure IT security and stable operation (legitimate interest, Art. 6(1)(f) GDPR). We document your consent to the terms of use and to this privacy policy as evidence (Art. 5(2) GDPR). Where consent is required for individual, optional processing operations, it is based on Art. 6(1)(a) GDPR and can be withdrawn at any time. Providing account data (e-mail) is required for registration and use of the service; you provide chat content and uploads voluntarily.

5. Storage location and security

Your data is processed and stored in Germany. Personal content is stored field-encrypted (encrypted at rest). The data of different users and teams is strictly separated from one another at a technical level (tenant separation). The connection is encrypted (HTTPS).

6. Processors and third-party services

To provide individual functions, we use service providers who act on our behalf:

• AI language model: The AI assistant's responses are generated on the operator's own hardware in Germany (Westerwald). No external cloud AI service is used to generate the responses; for this purpose, your inputs do not leave the infrastructure controlled by the operator in Germany.
• Google sign-in (optional): If you sign in with Google, Google transmits an identifier and your e-mail address to us for authentication. The provider is Google Ireland Limited; processing in the USA by Google LLC may take place (basis: EU Standard Contractual Clauses or the EU-US Data Privacy Framework, Art. 44 et seq. GDPR). The Google resources required for the Google sign-in (the sign-in script from accounts.google.com) are only loaded from Google, and contact with Google is only established, once you actively click the "Continue with Google" button. Merely opening the application does not contact any Google service. Signing in with Google is voluntary – alternatively, sign-in with e-mail and password is available. The legal basis for loading the Google resources and for the item Google sets in the process is the consent you give by clicking (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
• Web/research function (optional): If you use web search or deep research, the search terms required for it are transmitted to an external search service in order to deliver up-to-date results. The provider is Serper (serper.dev), which provides Google search results; processing outside the EU (in particular in the United Kingdom and/or the USA) may take place, safeguarded by appropriate guarantees within the meaning of Art. 44 et seq. GDPR (the EU Commission's adequacy decision for the United Kingdom, or EU Standard Contractual Clauses or the EU-US Data Privacy Framework for the USA). Only the search terms of the respective request are transmitted – not your account, your other chat content, or uploaded files. The function is optional and only active at your explicit request.
• E-mail delivery: For sending system e-mails (e-mail address confirmation at registration, team invitations, reminder notifications) we use Sendinblue SAS (“Brevo”), 106 boulevard Haussmann, 75008 Paris, France, as a processor. The recipient's e-mail address and the content of the respective system e-mail (e.g. the text of a reminder) are transmitted; processing takes place within the EU. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).
• Server hosting: STRATO GmbH, Berlin – operation of the app and database in a data centre in Germany, powered by renewable electricity.
• Payment processing (only for paid plans): For processing payments we use Mollie B.V., Amsterdam (Netherlands). If you subscribe to a paid plan, the data required for the payment (including name, e-mail address, invoice amount and the payment details you select) is transmitted to Mollie and processed there within the EU. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Mollie processes the payment data predominantly as an independent controller in order to fulfil its own legal and regulatory obligations (e.g. anti-money-laundering and payment services supervision), not as our processor. Details can be found in Mollie's privacy policy.

If you use gruenki as a controller in the context of commissioned processing (e.g. as a club, organisation or business processing personal data of third parties), we will provide you with a data processing agreement (DPA under Art. 28 GDPR) on request. Please send your enquiry to info@gruenki.de.

7. Cookies and local storage

We do not use advertising or tracking cookies. For sign-in, a technically necessary item is stored in your browser's local storage so that you stay signed in (Section 25(2) TDDDG – technically required). Cookies from Google (e.g. the g_state item used by the Google sign-in) are only set after you have actively clicked "Continue with Google" and thereby consented to the Google sign-in (Section 25(1) TDDDG) – not already when the page is opened. If you subscribe to a paid plan, you are redirected to our payment service provider for the payment, who sets the cookies required for the payment on its own page.

8. Logging (security/access log)

To ensure security (Art. 32 GDPR), we log security-relevant events – e.g. sign-ins, account and role changes, password changes, as well as export and deletion requests. This log contains exclusively metadata (time, affected account, type of action) and no content of your messages or files. The legal basis is our legitimate interest in IT security (Art. 6(1)(f) in conjunction with Art. 32 GDPR). These logs are automatically deleted after 90 days.

Error reports from the mobile apps: If a technical error occurs in the iOS/Android app (e.g. a failed function or an aborted purchase), the app transmits a technical error report to our server in Germany. It contains exclusively technical details (error message, affected processing step, device type and OS version) and never the content of your messages. Nothing is transmitted unless an error occurs. We do not use external crash or analytics services (such as US crash reporters). The legal basis is our legitimate interest in stability and troubleshooting (Art. 6(1)(f) GDPR); the reports are deleted with the automatic rotation of the server logs (typically after a few weeks).

9. Retention period and deletion deadlines

We store personal data only for as long as is necessary for the respective purpose (storage limitation, Art. 5(1)(e) GDPR). Specifically:

• Account and associated content (chats, memory, files, to-dos): for as long as your account exists. You can delete them yourself at any time.
• Inactive accounts: After 24 months without use, your account is flagged for deletion; final deletion takes place no earlier than 30 days later. Any renewed sign-in or use cancels the flagging.
• Acknowledged reminders: 90 days after their due date. Open and future reminders are retained.
• Completed research reports: 180 days.
• Unaccepted team invitations: 30 days.
• Security/access log: 90 days (see Section 8).
• Incognito mode: Conversations are not stored.
• Invoice and payment records (paid plans only): These are subject to the statutory retention period of 8 years (Sec. 147 AO, Sec. 14b UStG) and are therefore kept even after account deletion (Art. 17(3)(b) GDPR). The receipts are designed as small-amount invoices containing no personal recipient data; when the account is deleted, the link to your account is removed.

10. Consent and evidence

Upon registration, we document that and when you agreed to the terms of use and to this privacy policy in their respective valid version (version status and time). If these documents are updated, we will ask you to confirm again at your next login. This serves the purpose of demonstrability (Art. 5(2) GDPR).

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). You can trigger a complete export of your data and the deletion of your account at any time directly within the service.

In addition, you have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (LfDI RLP), Hintere Bleiche 34, 55116 Mainz – but you may contact any supervisory authority.

12. Automated decisions and AI notice

No automated decision in an individual case, including profiling, with legal effect or similarly significant impairment (Art. 22 GDPR) takes place. Note: The AI assistant's responses are generated automatically, may be incorrect, and do not constitute binding decisions or professional advice.

← Back to home