Privacy Policy
Last updated: July 2026
This privacy policy informs you, in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), about how we process your personal data when you use our website (breedbase.de) and the BreedBase app (iOS, Android, and web).
1. Controller
BreedBase
Owner: Sarah Suer
Benninghauser Straße 19
59329 Wadersloh
Germany
Email: info@breedbase.de
No data protection officer has been appointed, as there is no legal obligation to do so.
2. Hosting and Infrastructure
All core platform data (database, user accounts, uploaded media, backups) is processed exclusively on servers we operate at Hetzner Online GmbH (Gunzenhausen, Germany) in data centers in Germany and Finland — entirely within the European Union. Hetzner acts as our hosting provider under a data processing agreement (Art. 28 GDPR).
When you access our website or app, our servers process technically necessary connection data (IP address, timestamp, requested resource, browser/device type) in server logs. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Log data is deleted after approximately 30 days.
3. What Data We Process and Why
3.1 Account and Registration
When you register, we collect your name, email address, and credentials; optionally a postal address, phone number, and kennel name. Identity management runs on open-source software (Ory Kratos) that we host ourselves on our EU servers. Purpose: providing your account and the platform features. Legal basis: performance of contract (Art. 6(1)(b) GDPR).
Your postal address (street, postal code, city, country) is optional. We need it only where you submit documents to us for review: when you submit a dog or a pedigree for review, we ask for it at that point, because our reviewers compare it against the name and address on the pedigree or health certificate you submitted. You can use the platform in full without that review. Purpose: reviewing the breeding and health documents you submit. Legal basis: performance of contract (Art. 6(1)(b) GDPR). Your street and postal code are visible only to you and to our reviewers, never to other users. City and country are shown as a coarse location on your profile and are visible to other signed-in users. You can change or delete the address at any time in your profile.
3.2 Dog, Breeding, and Journal Data
Dog profiles (breed, pedigree, health test results), litter records, breeding history, and journal entries you create. Legal basis: performance of contract (Art. 6(1)(b) GDPR). You control which of this content is publicly visible via the visibility settings.
3.3 Photos and Videos
Media you upload is stored on our own object storage on Hetzner servers (Germany, with backups in Finland). Camera and photo library access only occurs after you grant it via the operating system's permission prompt. Legal basis: performance of contract (Art. 6(1)(b) GDPR).
3.4 Community Features (Feed, Profiles, Messages)
Feed posts, public profile information, and direct messages to other users. Content you publish is visible to other users. Legal basis: performance of contract (Art. 6(1)(b) GDPR). Deleted messages are permanently removed after 90 days, deleted feed posts after 30 days.
3.5 Push Notifications
Only with your approval via the operating system's permission prompt. Delivery uses Firebase Cloud Messaging (Google LLC, USA) and the Apple Push Notification Service, which involves processing a device token; Google is certified under the EU-US Data Privacy Framework (see Section 6). Legal basis: consent (Art. 6(1)(a) GDPR); you can withdraw it at any time in your device settings.
3.6 Subscriptions and Payments
Paid subscriptions are handled through the Apple App Store or Google Play. Payment data (e.g. credit card details) never reaches our servers — it stays with Apple and Google as independent controllers. To manage subscription status, our service provider RevenueCat, Inc. (USA) processes transaction and receipt data plus a pseudonymous user ID under a data processing agreement incorporating the EU Standard Contractual Clauses. Legal basis: performance of contract (Art. 6(1)(b) GDPR).
3.7 Email Delivery
We send transactional emails (registration confirmation, password reset, account notices) via Mailgun (Sinch Email), using exclusively the EU region with data processing in the EU. Legal basis: performance of contract (Art. 6(1)(b) GDPR) and our legitimate interest (Art. 6(1)(f) GDPR) in delivering important account information.
3.8 Analytics (Rybbit)
We run the open-source analytics software Rybbit ourselves on our own EU servers — no data is transferred to third parties. Rybbit works without cookies. It records usage events (page views, feature usage, device type); for logged-in users, a pseudonymous user ID is linked. Analytics runs only after your explicit consent via our consent banner (Art. 6(1)(a) GDPR, Section 25(1) of the German TDDDG) and can be withdrawn at any time under Settings → Privacy. Retention: 13 months.
3.9 Map Services (Explore Feature)
For the map view, we load map tiles from CARTO (based on OpenStreetMap data) via the provider's CDN. This transmits your IP address and the viewed map area to CARTO; processing in the USA is possible. Maps are loaded only after your consent via our consent banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG; for the third-country transfer, Art. 49(1)(a) GDPR). We use your device's location only after you grant it via the operating system's permission prompt, exclusively to show relevant places, and we do not store it permanently. We maintain the places database server-side — your searches are not sent to OpenStreetMap.
3.10 Early-Bird Signup on the Website
If you sign up on the website with your email address to be notified about the launch, we process it based on your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time; the address will then be deleted.
3.11 Automatic Pedigree Detection (Premium)
If you upload a pedigree document and start the automatic pedigree detection (a Premium feature), we send a rendered image of that document to our EU AI processor OVHcloud (OVH SAS) for analysis. Processing takes place exclusively in the EU (Gravelines, France) under a data processing agreement (Art. 28 GDPR); the document is processed solely to extract the ancestor data. OVHcloud undertakes for this service that inputs are neither used to train its own models nor retained beyond the processing. The detected ancestors are only suggestions — you review and confirm each entry yourself before it is added to your pedigree, so no automated decision with legal effect is made (see Section 9). Legal basis: performance of contract (Art. 6(1)(b) GDPR), in the alternative our legitimate interest in a usable pedigree feature (Art. 6(1)(f) GDPR). Pedigree documents can name third parties (e.g. breeders or previous owners); informing those persons individually would involve disproportionate effort, so we provide this transparency information instead (Art. 14(5)(b) GDPR), and the analysis is instructed to ignore breeder/owner names and extract only dog ancestor data.
The analysis runs only when you start it yourself — uploading a document triggers nothing on its own, and without your explicit start no document leaves our platform. The system used is built on the vision-language model Qwen2.5-VL, operated by OVHcloud inside the EU; we are both provider and deployer of that system within the meaning of the AI Act, Regulation (EU) 2024/1689. Ancestors newly added to your pedigree from an AI suggestion are marked as such, and stay marked for as long as that entry stands, so machine-proposed and hand-entered entries remain distinguishable. If you later replace an entry yourself, it carries your own entry's marking instead. Wherever the detection is started or its result is shown, we tell you that an AI system is involved — in the spirit of the AI Act's transparency requirements, and whether or not we would be obliged to in the individual case.
4. Consent Management
Services requiring consent (analytics, maps) are disabled by default and only loaded after your decision in the consent banner. Your choice is stored locally on your device and — for accountability purposes (Art. 7(1) GDPR) — in versioned form on our servers. We ask again whenever there are material changes. You can change your decision at any time under Settings → Privacy; declining has no effect on core functionality.
5. Recipients and Processors
We do not sell your data. The only recipients are:
| Recipient | Purpose | Location/Processing | Safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Hosting, storage, backups | Germany/Finland (EU) | DPA (Art. 28 GDPR) |
| Sinch Email/Mailgun (EU region) | Transactional email | EU | DPA with Standard Contractual Clauses |
| RevenueCat, Inc. | Subscription management | USA | DPA with EU Standard Contractual Clauses |
| OVHcloud (OVH SAS) | Automatic pedigree detection (only on request, Premium) | EU (Gravelines, FR) | DPA (Art. 28 GDPR) |
| Google LLC (Firebase Cloud Messaging) | Push notifications | USA | EU-US Data Privacy Framework |
| Apple Inc. / Google (app stores, push) | App distribution, purchases, delivery | USA | Independent controllers; their own privacy policies apply |
| CARTO | Map tiles (only after consent) | EU/USA | Consent (Art. 49(1)(a) GDPR) |
| Other users | Content you publish | — | Your visibility settings |
| Authorities | Only where legally required | — | Legal obligation |
6. Transfers to Third Countries
Transfers to countries outside the EU/EEA only occur in the cases listed above (RevenueCat, Google/Firebase, Apple, and CARTO where applicable) and are safeguarded by EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), certification under the EU-US Data Privacy Framework (EU Commission adequacy decision), or your explicit consent (Art. 49(1)(a) GDPR). All core platform data remains in the EU.
7. Retention Periods
| Data | Duration |
|---|---|
| Account, dog, breeding, and media data | Until you delete your account or the content |
| Deleted direct messages | Permanently removed after 90 days |
| Deleted feed posts | Permanently removed after 30 days |
| Notifications | 90 days |
| Server logs | approx. 30 days |
| Login session | 30 days |
| Analytics data (only with consent) | 13 months |
| Early-bird email addresses | Until withdrawal or after the launch phase ends |
Statutory retention obligations (e.g. for invoice data) remain unaffected.
8. Your Rights
You have the right at any time to:
- Access the data we store about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing based on legitimate interests (Art. 21 GDPR)
- Withdraw consent with effect for the future (Art. 7(3) GDPR)
An informal message to info@breedbase.de is sufficient. You can also request the deletion of your account and data via this address.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestr. 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.
9. No Automated Decision-Making
We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The automatic pedigree detection (Section 3.11) only produces suggestions that you review and confirm yourself; it does not make any decision with legal or similarly significant effect.
10. Data Security
All connections are TLS-encrypted. We apply state-of-the-art technical and organizational measures (access controls, separated systems, encrypted backups within the EU) to protect your data against unauthorized access, alteration, or loss.
11. Changes to This Privacy Policy
We update this policy whenever our processing activities or the legal situation change. The current version is always available on this page; we will inform you in the app about material changes.
12. Contact
For any privacy-related questions, you can reach us at:
Email: info@breedbase.de