Privacy notice

1. Who is responsible

Saimon Misiaki (Simon Misiak), individual entrepreneur under Georgian law, 1 Nino and Ilia Nakashidze Street, Flat 3, Building 3, Krtsanisi District, Tbilisi, Georgia (official spelling in the imprint), email: info@nighthopper.de.

Representative in the EU under Art. 27 GDPR: Thaleia Melas, 11 Frantz Soumpert Street, 6028 Larnaca, Cyprus.

We have not appointed a data protection officer. Please send questions about data protection to the address above.

2. What this notice covers

This notice covers our website, registration, user accounts in Postfluss, billing and our help with setup.

It does not cover the content that companies process with Postfluss, that is, the emails and chats of their customers. The company in question is responsible for that. We process this content only on its behalf, under the data processing agreement. If you are a customer of such a company and have questions about this, please contact that company. An exception is Swarm Knowledge, which a company can switch on (section 10).

3. Visiting the website

Our website sets no cookies, stores nothing in your browser and uses no analytics or advertising services. It loads nothing from third-party servers; the fonts are hosted by us as well.

To deliver the page to you, the server processes your IP address for the duration of the request. We do not store access logs with IP addresses. The website is hosted on our own server at DeinServerHost (Christian Ralph Hennig, Grubenstraße 21, 66265 Heusweiler, Germany), data centre near Frankfurt am Main.

The legal basis is our legitimate interest in providing the website (Art. 6 (1) (f) GDPR).

4. Registration

When you create an account, we process:

• the company name and email address of the first admin,
• the chosen plan, if you choose one,
• the time and version of the terms and the DPA you accepted, and your confirmation that you act as a business.

We send a link to that address with which you set your password. If nobody sets a password within 7 days, we delete the account together with these details.

To prevent misuse, we count how often registrations come from an IP address and for an email address. For this we store only a hash value, never the address itself. The counters apply for one hour or one day respectively and are deleted afterwards.

The legal basis is the legitimate interest of your company and of us in preparing and performing the contract and in operating the service securely (Art. 6 (1) (f) GDPR). Without a company name and email address we cannot create an account.

5. User accounts

For each person who works with Postfluss in a company, we store:

• name, email address, role and the signature, if they create one,
• the password only as a hash value (Argon2id) and, if switched on, the secret for the second factor,
• sign-ins: they last no longer than 14 days and end after 12 hours without use. We store only a hash value of them, never the token itself.
• a log of actions in the account, such as “user invited” or “setting changed”, with an identifier, the type of action and the time, without IP address and without content.

To prevent passwords from being guessed, we count failed attempts per email address, IP address and user. This, too, only as a hash value and for no longer than 24 hours.

Name, email address, signature and the secret for the second factor are encrypted with the company’s key. These data remain until an admin removes the person or the company is deleted. The log remains until the company is deleted.

In the browser, the app stores only the sign-in token: in session storage for the session, in local storage with “Stay signed in”. In addition, it remembers whether the sidebar is expanded or collapsed. The app also sets up a service worker so that it can be installed like an app and receive push notifications. It stores no content. This is technically necessary for the service you use (section 25 (2) no. 2 TDDDG). The app sets no cookies.

Push notifications are sent only if you switch them on for a device. Then only the type of notification and an identifier or count go through your browser’s push service (Google, Apple, Mozilla or Microsoft), never the subject, sender or text. These services are based in the USA. Where a provider is certified under the EU-US Data Privacy Framework, the European Commission’s adequacy decision applies to it. You can switch the notifications off at any time in the app or in the browser.

The legal basis is the legitimate interest of your company and of us in performing the contract and providing the service securely (Art. 6 (1) (f) GDPR).

6. Billing and payment

We store your company’s plan, credit and bookings. For a bank transfer, we record the payer’s name and IBAN, the amount, the date and the payment reference. We also pay out to an account from which you have paid in.

If you pay via PayPal, we redirect you to PayPal. There, the privacy notice of PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, applies as an independent controller. From PayPal we receive the payer’s name, the amount and the payment identifier.

The legal bases are the contract (Art. 6 (1) (b) GDPR) and our obligations under tax and commercial law (Art. 6 (1) (c) GDPR). We keep booking data as long as these laws require, usually up to 10 years.

7. Help and contact

If you write to us, by email or via the contact form at app.postfluss.com/#/kontakt, we process your details (name, email address, company, message) and the content in order to help you. The form sends the message as an email to our mailbox and stores nothing itself. We delete the records when the matter is settled, unless they belong to the contract or we have to keep them. The legal basis is the contract or its preparation (Art. 6 (1) (b) GDPR) or our legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR).

We send emails from Postfluss itself, such as the registration link or the link for a new password, via [provider for system emails, country]. After sending, we delete the job.

8. Recipients

Your data are received only by service providers we need for operation and who are bound by our instructions:

• Servers and database: our own server at DeinServerHost (Christian Ralph Hennig, Grubenstraße 21, 66265 Heusweiler, Germany); the database runs on the same server
• Backups: on the same server at DeinServerHost, Germany, encrypted
• Key management: Amazon Web Services EMEA SARL, Luxembourg, Frankfurt region. It manages only the keys with which your data are encrypted.
• System emails: see section 7

PayPal receives data as an independent controller if you pay there. Authorities receive data only if the law obliges us to provide them.

9. Where the data are stored

Servers, database and backups are located in the EU. We ourselves are based in Georgia and access the servers from there, for example for operation and support. The GDPR applies to our processing (Art. 3 (2) GDPR).

10. Swarm Knowledge

This applies to users of the app and to customers and employees of companies that switch on Swarm Knowledge. Swarm Knowledge is a switch that an admin of the company turns on in the settings. Without the switch, nothing is counted.

If a company takes part, we create a row in the company’s account for each new customer enquiry. It contains only values from fixed lists:

• the sub-topic of the enquiry, such as “delivery late”,
• the mood (neutral, annoyed or friendly) and whether it was a repeat,
• the company’s broad industry and the month of receipt,
• the outcome (draft sent unchanged, sent edited, sent without a draft, or no reply) and whether the sender followed up within 14 days.

Never stored are texts, names, addresses, numbers or identifiers, not even encrypted or hashed, and which user replied. The row waits in the company’s account for the outcome for 14 days at most. Then it is added to a counter per month and deleted. If the company deletes the enquiry earlier, the row disappears with it.

For the row in the account, we process on behalf of the company (DPA § 11). For forming and using the anonymous counters, we are the controller ourselves. The legal basis is our legitimate interest in improving suggestions and comparison figures for participating companies (Art. 6 (1)(f) GDPR). The counters are so coarse, and we evaluate them only above minimum numbers (at least 5 companies and 50 cases per category), that they reveal neither a person nor an individual company. We never sell them, never give them to third parties and never use them to train models.

The counters stay until the company switches Swarm Knowledge off or its account is deleted. Then we delete all of the company’s counters. If you are a customer or employee of a company and do not want your enquiries to be counted, please contact that company or us (address in section 1). Individual contributions cannot be extracted after closing, because the counters contain no identifier. The company can, however, delete everything it contributed. What exactly we store is on the page Swarm Knowledge: what we store, what never.

11. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). Where we rely on a legitimate interest, you may object on grounds relating to your particular situation (Art. 21 GDPR). Please write to the address in section 1.

You may lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work (Art. 77 GDPR).

We do not make automated decisions within the meaning of Art. 22 GDPR.

12. Changes

If the service changes, we update this notice. The version on this page applies.