Privacy Policy

1. Controller

The controller within the meaning of the GDPR is: Ebrahim Seyfi Senorit Seeschwalbentwiete 23 22119 Hamburg Germany Email: kontakt@senorit.de Phone: +49 155 609 88996

2. Categories of Data Collected

We process the following categories of personal data:

• Account data: email address, display name, password hash; with Google sign-in, the Google account ID instead of a password hash; time of last sign-in, time of registration; for password recovery, a one-time token (stored only as a hash, valid for 1 hour); at most the 10 newest sessions per account
• Photos: JPEG images of minerals and artworks that you take or select with the app and save in your entry
• Profile photo (optional): a photo you choose or take as your profile picture. The app crops it to a square on your device and reduces it to at most 512 × 512 pixels. It is stored in our file storage (Cloudflare R2, data centres in the EU), shown only to you in the app and never sent to Google Gemini
• Collector profile: a short free text about your collecting focus (up to 80 characters) that you can enter in your profile, and whether the introduction is complete. The app keeps your birth month and your profile cover piece on your device only.
• Voice notes: audio recordings that you make in the app (RECORD_AUDIO permission) and add to your entry. Like photos, they are stored with the entry and uploaded to file storage (Cloudflare R2). A recording starts only when you choose to
• Identification results: AI-classified mineral name or art style, confidence score, properties, origin, notes
• Gamification data: achievement progress, points, rewards
• Wishlist and settings: stone wish items, user-assigned nicknames
• Purchase data: if you subscribe, we process the Google Play purchase token (stored only in encrypted form), product and plan, subscription status, expiry date, order ID, the automatic renewal flag and your identification usage per billing period, and counters for requests and processing cost per identification (number of tokens processed). We also pass a pseudonymous account identifier to Google Play. We do not receive payment details (card, bank account)
• Session and security data: session token (stored only as a hash), session expiry; counters for sign-in attempts and requests (the IP address and the email address are used for this only as a hash and are not stored in plain text; the counters are deleted after two days at the latest); where applicable, security events (account ID, event type, time); technical operating logs without content (request ID, route family, status code, error type)
• Consent records: your consent or refusal for the terms, the privacy policy and image transmission to Google Gemini, each with version and time. They are kept while the account exists and deleted with it
• Consent to immediate start when buying a pack: the wording (version) with which you expressly asked us to start at once, and the time by our server's clock (Section 4.13)
• Cancellation without signing in: name, the email address of your account, type of cancellation (ordinary or for good cause, with the reason), chosen plan, desired end of the contract and time of receipt (Section 4.13)
• On-device data: notification preferences, birth month, profile cover piece, cache for mineral images and the local collection (they stay on the device and are not transmitted). For the review request (Section 4.15) the app stores nothing on your device. The text of the daily reminder names your display name and the name of a piece from your collection; it is generated on the device and hidden on the lock screen by default. If you use the web version in a browser, the server sets a strictly necessary session cookie (__Host-mineral_session) and your browser stores your collection locally in browser storage. Both are required for the function you asked for (section 25(2) no. 2 TDDDG). We set no tracking or advertising cookies.
• App language and confirmation of your email address: the time of confirmation; until then a one-time code, stored only as a hash and valid for 10 minutes (Section 4.10)
• Security check at registration, password reset and cancellation without signing in: signals from Cloudflare Turnstile (Section 4.12)
• Protection of the free identifications: keyed hashes of your email address, your Google account ID and your internet connection (Section 4.11)

3. Purposes and Legal Bases of Processing

We process your data for the following purposes and on the following legal bases:

• Provision of the app service (account, collection, sync, photos and voice notes): Art. 6(1)(b) GDPR (contract performance)
• Profile photo: Art. 6(1)(b) GDPR. Providing it is optional; you can change or remove the photo at any time
• Sign-in with Google (Section 5): Art. 6(1)(b) GDPR
• AI-assisted identification of minerals and artworks via the Google Gemini API (Section 4.2): your photos are sent to Google only with your separate, voluntary consent under Art. 6(1)(a) GDPR, which you give at registration or before the first scan and can withdraw in Settings. Saving the result and counting your allowance rely on Art. 6(1)(b) GDPR. Without consent, the app remains usable with manual entries
• Checking and managing subscriptions (purchase token, plan, expiry): Art. 6(1)(b) GDPR
• Operational security, abuse protection, request limiting, error analysis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation)
• Consent records: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (duty to demonstrate consent)
• Compliance with statutory retention duties: Art. 6(1)(c) GDPR
• Display of mineral reference images from the Wikipedia REST API: Art. 6(1)(f) GDPR (legitimate interest in service delivery)
• User-initiated external links (Wikipedia, Mindat.org): Art. 6(1)(b) GDPR (contract performance) / Art. 6(1)(f) GDPR
• Local notifications (daily reminders, if enabled): Art. 6(1)(b) GDPR; no data is transmitted to external servers
• Account emails (confirmation code at registration, password reset, confirmation of account deletion, confirmation of a cancellation or withdrawal): Art. 6(1)(b) GDPR
• Consent to immediate start when buying a pack (Section 4.13): Art. 6(1)(b) GDPR (your request is part of carrying out the purchase) and Art. 6(1)(f) GDPR (legitimate interest in being able to show that the right of withdrawal has lapsed under Sec. 356(5) BGB)
• Cancellation without signing in (Section 4.13): receiving and confirming the declaration under Art. 6(1)(c) GDPR in conjunction with Sec. 312k BGB, reviewing a termination for good cause by hand under Art. 6(1)(b) GDPR
• Protection against automated registrations and cancellations and against throwaway or forwarding addresses (Sections 4.11 and 4.12): Art. 6(1)(f) GDPR
• Checking new passwords against known data breaches (Section 4.14): Art. 6(1)(f) GDPR
• Review request from Google Play (Section 4.15): Art. 6(1)(f) GDPR
• Protecting the free identifications against repeated use: Art. 6(1)(f) GDPR (legitimate interest, Section 4.11)

An account requires an email address and password (or sign-in with Google); without them we cannot perform the contract for using the app. All other details are voluntary. Sending photos to Google is voluntary; the only consequence of declining is that identification cannot be used.

4. Processors and Third-Party Recipients

4.1 Cloudflare (accounts, sync and files)

The operator uses Cloudflare Workers, D1, R2 and Cloudflare Email Service for sign-in, account data, synchronization, photos and voice notes, and to send the password recovery e-mail (recipient address, message content). The data needed for the requested function and technical connection data (including IP address) are transmitted. The database (D1) and file storage (R2) are restricted to the EU jurisdiction: account and collection data as well as photos and voice notes are stored and processed there exclusively in the EU. API requests, however, are processed by Cloudflare on its global network at the data centre nearest to you, so technical connection data may also be processed outside the EU. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Transfers to the USA rely on Cloudflare's data processing addendum (Cloudflare Customer DPA) including the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and on Cloudflare's certification under the EU-U.S. Data Privacy Framework. Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/. Data processing addendum: https://www.cloudflare.com/cloudflare-customer-dpa/.

4.2 Google LLC (Gemini API, AI-assisted identification)

When you take a photo of a mineral or artwork and request an identification, we send the photo together with a fixed instruction through our server to the Google Gemini API (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). We do not send your name, email address or account ID. The API key is managed server-side in a secured vault and is not stored in the app bundle. We use the paid Gemini API ("Paid Services"). Google processes the data as a processor under the Data Processing Addendum for Products Where Google is a Data Processor. Google does not use your photos (prompts) or the responses to improve its products. Google logs prompts and responses for up to 55 days, solely to detect and prevent violations of its Prohibited Use Policy and to meet legally required disclosures. Data may be stored transiently or cached in any country in which Google or its agents maintain facilities. The legal basis is your separate, voluntary consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future in Settings, and Art. 6(1)(b) GDPR for the requested result. Transfer to the USA relies on the EU-U.S. Data Privacy Framework (Google LLC is certified; European Commission adequacy decision of 10 July 2023); if that basis lapses, Google's data processing addendum provides standard contractual clauses (Art. 46(2)(c) GDPR). Source: https://ai.google.dev/gemini-api/terms.

4.3 Local Notifications (iOS and Android)

If you enable daily reminders, the app schedules a notification directly on your device. The notification is delivered locally by your device's operating system. No personal data is transmitted to Apple or Google servers. The notification content (title and body, with your display name and the name of a piece from your collection) does not leave your device. Apple Inc. and Google LLC do not act as processors under Art. 28 GDPR for this feature.

4.4 App modules and updates

The app uses locally installed Expo modules for features including the camera, photos and notifications. App builds use local Gradle or Xcode tools. The Android app is installed and updated only through Google Play.

4.5 Wikimedia Foundation (Mineral Reference Images and External Links)

To display reference photographs of minerals in the glossary and detail views, the app fetches publicly available image data from the Wikipedia REST API operated by the Wikimedia Foundation, Inc. (1 Montgomery Street, Suite 1600, San Francisco, CA 94104, USA). Only the mineral name is transmitted as a search parameter; no personal account or device data is shared. The Wikimedia Foundation collects IP addresses as part of its server logs. The legal basis for in-app retrieval of publicly available mineral images is Art. 6(1)(f) GDPR (legitimate interest); the legal basis for the user-initiated external link is Art. 6(1)(b) and/or (f) GDPR. The Wikimedia Foundation's privacy policy is available at https://meta.wikimedia.org/wiki/Privacy_policy.

4.6 Mindat.org / Hudson Institute of Mineralogy (External Link)

The results view offers a link to Mindat.org (operated by the Hudson Institute of Mineralogy, USA) to look up the identified stone in the Mindat database. Tapping this link causes your device to connect directly to Mindat.org via the system browser. The stone name is transmitted as a URL query parameter, and your IP address is collected by Mindat.org as part of its server logs. The app transmits no further personal data. Processing by Mindat.org is governed by its own privacy policy (https://www.mindat.org/privacy-policy.php). The legal basis is Art. 6(1)(b) and/or (f) GDPR.

4.7 Google Play (subscription)

Paid subscriptions are handled through Google Play Billing (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, USA). We do not receive payment details. Our server checks via the Google Play Developer API, using the purchase token, whether a subscription is active. Google Play notifies our server of changes such as renewals, cancellations or refunds through Google Cloud Pub/Sub; these messages contain the purchase token but no payment details (Art. 6(1)(b) GDPR). Privacy policy: https://policies.google.com/privacy.

4.8 Automated photo check

Photos that show nudity or sexual content are not allowed (Terms of Use). So that nobody can misuse the app to keep such photos, we check photos automatically before they are stored on our servers. For manual entries this already happens when you add the photo, even if it stays on your device at first.

• Photos you have identified (Section 4.2): the request to the Google Gemini API includes the question about prohibited content. This causes no additional transfer to Google. If the model flags a photo as not allowed, we reject the identification and store no result, only a note that the photo was rejected. If you then save the photo in an entry and it is uploaded to our servers, the image model checks it once more like any other photo (next point)
• Every photo that is to be stored on our servers (profile photo, photos of your entries when they are uploaded, also when Gemini has already judged them): an image model checks the photo before it is saved. The same applies to a photo you add in a manual entry (a copy reduced to at most 560 pixels is enough here) and to the photos of a backup that you restore on the device. We use the image model Mistral Small 3.1 by Mistral AI on Cloudflare Workers AI. Cloudflare, Inc. (USA) processes the photo on our behalf and uses sub-processors in the USA (CoreWeave, Inc.) and the United Kingdom (Nebius B.V.); the exact place of processing is not fixed. The photo is not stored for the check and not used to train models. Transfers rest on Cloudflare's data processing agreement with standard contractual clauses (Art. 46(2)(c) GDPR), the EU-U.S. Data Privacy Framework (Cloudflare is certified) and, for the United Kingdom, the European Commission's adequacy decision.
• Cache: we keep a fingerprint of the photo (SHA-256 hash) and the result (allowed or not) for 30 days in our database (Cloudflare D1, EU), so the same photo does not have to be checked again. The photo cannot be reconstructed from the fingerprint, and it carries no account reference
• Voice notes are not checked
• Review by a person: no person sees your photo in the automated check. If we refuse a photo, the app shows the reason. If you think the check was wrong, write to us (section 11) and attach the photo; we will review it by hand. You can also object to the check (section 9); we then cannot save the photo.

If the check cannot run, we do not store the photo. The number of checks is limited per account and day. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting the service and others from unlawful and abusive content). The check is a precondition for storing a photo.

4.9 Feedback

In the app you can send feedback to Senorit. We process:

• your message and the chosen category (idea, problem, praise, other)
• technical details: app version, operating system, language, your account ID and a timestamp
• your account email address, only if you switch on "You may reply to my email". Then we can answer you directly

The feedback is sent as an email through the Cloudflare Email Service to the controller's mailbox (Section 11) (email service: Google Workspace, Google Ireland Limited and Google LLC as processors). Please do not include passwords or other confidential details. Counters that limit abuse (per account, per IP hash and overall) are deleted after 24 hours at most. The purpose is to read and answer feedback and to improve the app. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in feedback on our app); using your account email to answer rests on your consent (Art. 6(1)(a) GDPR), which you give with the switch. The email stays in our mailbox until the feedback has been dealt with and we no longer need it; on request we delete it sooner (Section 9).

4.10 Emails from LithoCanvas

We send emails through Cloudflare Email Service (Cloudflare, Section 4.1) from addresses under lithocanvas.senorit.de. Replies reach our mailbox kontakt@senorit.de. We only send emails that belong to your account (Art. 6(1)(b) GDPR):

• when you register with an email address and password, a 6-digit confirmation code. It works for 10 minutes and is stored only as a hash; after five wrong entries it expires. The hash of an expired code is deleted in the automatic maintenance run (every 10 minutes), so it stays stored for up to about 20 minutes. With the code you confirm that the address is yours. If you sign in with Google, Google has already confirmed the address
• the password reset code
• the confirmation of an account deletion
• the confirmation of a cancellation or withdrawal (Section 4.13)

We send no advertising, newsletters or tips. Our emails contain no tracking pixels and no personalised redirects; the logo is embedded in the email. We store the language of your app (German or English) so that the emails arrive in it. If an email cannot be delivered yet, we retry for at most one day. Cloudflare blocks addresses that are permanently unreachable from further sends.

4.11 Protecting the free identifications

The 5 free identifications are available once per person. Your email address must be confirmed for them (Section 4.10), or you sign in with Google. So that nobody uses them repeatedly through further accounts, or by deleting and re-creating an account:

• when you register with an email address, we check whether it comes from a throwaway or forwarding service. We compare the domain of the address (the part after the @) with lists of known services and ask Cloudflare's DNS service (1.1.1.1) which mail servers handle the domain. Only the domain leaves our server, never the full address. We do not accept such addresses
• for every free identification we store a keyed hash (HMAC-SHA-256 with a secret server key) of your email address in a uniform spelling (lower case, without a "+tag", without dots for Gmail), of your Google account ID if you sign in with Google, and of your internet connection (the IPv4 address or the IPv6 /64 prefix), together with the time

Nobody can read the address from a hash. The limits are 5 free identifications per email address and per Google account, and, within 30 days, at most 100 per IPv4 address and at most 25 per IPv6 /64 prefix (a mobile carrier often shares one IPv4 address among many customers). We do not read any identifier of your device for this. The legal basis is our legitimate interest in protecting the free offer from abuse (Art. 6(1)(f) GDPR, recital 47). After an account deletion the entries are no longer linked to any account; we delete the hashes of email address and Google account after 12 months and those of the internet connection after 30 days automatically. The entry for an identification that fails for technical reasons is deleted at once. You can object to this processing under Art. 21 GDPR (Section 9).

4.12 Protection against automated sign-ups (Cloudflare Turnstile)

When you create an account, ask for a password reset code or send a cancellation without signing in, Cloudflare Turnstile (Cloudflare, Inc., Section 4.1) checks that a person is using the app. The check runs in an invisible window of the app; a checkbox appears only when Cloudflare is unsure. According to Cloudflare, it processes your IP address, the TLS fingerprint, the browser identifier (user agent) and the identifier of our check page. Our server only receives the result. If the check cannot be reached, the cancellation form without sign-in accepts nothing; you can then sign in and cancel in the app. The legal basis is our legitimate interest in protecting accounts, mailboxes and running contracts from automated requests (Art. 6(1)(f) GDPR); the access to your device is strictly necessary for this (Section 25(2) no. 2 TDDDG). Cloudflare acts as our processor and, according to Cloudflare, also uses the signals as a controller to improve its bot detection, not for advertising or profiles (Turnstile Privacy Addendum: cloudflare.com/turnstile-privacy-policy).

4.13 App use, purchase flow, packs and contract declarations

So that we can tell whether the app presents its plans and packs clearly, our server stores single steps with your account: identification used (free, from a pack or a plan), plans page shown or closed and where from, plan chosen, pack chosen or bought, plan bought or renewed, info cards shown and tapped and, if you give it, your answer to the question “What is holding you back?” (one of four fixed answers). So that we can see which parts of the app are used and where it is hard to use, the server also stores which screen of the app you open, including when you bring the app back to the foreground. It keeps only the fixed name of the screen (for example “Collection” or “Settings”) and not what the screen shows. Only these fixed words and the time are stored; the app reads nothing from your device for this and uses no third-party analytics tool. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a clear, fair offer and an app that is easy to use). We delete each step after 13 months, at the latest with your account. You can object at any time (Art. 21 GDPR), for example by email. If you buy a pack, we store the encrypted purchase token, the order ID, the quantity and the status (granted, consumed, refunded) while the account exists (Art. 6(1)(b) GDPR). Before you buy a pack you must tick a box with which you expressly ask us to start the 10 identifications at once after the purchase and confirm that your right of withdrawal ends once all 10 identifications are used. Only then does the purchase in Google Play open. We store the wording version and the time (our server's clock) and link the consent to the pack whose purchase is completed afterwards. The legal basis is Art. 6(1)(b) GDPR (your request is part of carrying out the purchase) and Art. 6(1)(f) GDPR (legitimate interest in being able to show that the right of withdrawal has lapsed under Sec. 356(5) BGB). We keep the consent while the account exists; it is part of the data export and is deleted with the account. If you cancel or withdraw in the app, we store the type, the contract, the time it arrived, the name you chose to give and, for termination for good cause, the reason, and send you the confirmation by email (Art. 6(1)(c) GDPR in conjunction with §§ 312k and 356a of the German Civil Code). We keep these details until you delete your account, but at most until three years after the end of the year in which the declaration arrived (§§ 195, 199 BGB); after that we delete them automatically. You can also cancel without signing in: “Cancel contracts here” on the app's sign-in screen (also in the web version) opens a form. It processes your name, the email address of your account, the type of cancellation (ordinary or for good cause, then with the reason), the chosen plan, the desired end of the contract and the time of receipt. The form is protected by Cloudflare Turnstile (Section 4.12) and limits requests per internet connection and per email address (counters only as a hash, 24 hours at most). If an account with a running subscription exists for the address, we store the declaration like a cancellation in the app and send the confirmation only to the address of that account, through the Cloudflare Email Service. The answer on the page is the same for every address and does not say whether an account exists. If there is no matching account or subscription, we do not store the declaration in the app database. So that it is not lost, we send it to the controller (Section 11) as a notice email with the name, the email address entered, type, reason, plan and desired end; we then look for the contract by hand and reply to the address given if we find it. In the confirmation email to the account we leave out links and email addresses from the name and reason. For a termination for good cause sent without signing in, we only stop the renewal and check the reason by hand. For that we send the controller (Section 11) a notice email with request ID, account ID, time of receipt, reason and desired end, without name and email address (sent through the Cloudflare Email Service, mailbox at Google Workspace). If Google Play does not carry out a cancellation or withdrawal, the controller gets a notice email with the request and account IDs to finish it by hand. Legal bases and storage period as above: Art. 6(1)(c) GDPR in conjunction with Sec. 312k BGB for the declaration and its confirmation, Art. 6(1)(b) GDPR for reviewing the reason.

4.14 Check against known password breaches (Pwned Passwords)

When you set a password (registration, password reset, password change), our server checks whether it appears in known data breaches. The server forms the SHA-1 hash of the password and sends only its first 5 characters to the range interface “Pwned Passwords” of Have I Been Pwned (api.pwnedpasswords.com). The interface answers with all known hash endings for that prefix (k-anonymity), padded with filler rows; our server itself compares them with your password. The password and the full hash never leave our server. Your email address, your identifier and your IP address are not transmitted; the recipient sees the connection of our server. If the service cannot be reached, we skip the check. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure accounts). Have I Been Pwned is an independent third party; description of the interface: https://haveibeenpwned.com/API/v3#PwnedPasswords.

4.15 Review request (Google Play)

As soon as your collection holds exactly three finds after a save, the app may trigger Google Play's review prompt (in-app review). For this the app only reads the number of saved finds from your collection on the device. It stores nothing on your device for this, that is no counter and no flag, and it does not transmit the number. Earlier versions of the app stored a counter and a flag; the new version deletes them the first time you save a find after the update. We receive no data from the request. Google Play decides whether the window appears and how often; the app does not learn whether it appeared or whether you left a review. If the number of finds drops and later reaches three again, the request can be made again. You enter a review in Google Play's own interface; it goes to Google Play (Google Ireland Limited, Google LLC) and is handled there under Google's rules. The legal basis of the request is Art. 6(1)(f) GDPR (legitimate interest in feedback on the app). Description: https://developer.android.com/guide/playcore/in-app-review.

5. Sign-in with Google

Signing in with Google is optional; you can register with email and password instead. If you choose it, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; for transfers to the USA Google LLC) sends us, after your confirmation, a signed ID token. It contains your Google account ID, email address and name. Our server verifies the token (signature, issuer, intended recipient, validity) before it creates or opens an account. We store the Google account ID to recognize your account, and the email address and name as account data. We retrieve no other Google data, and no password is created. If the email address already belongs to an account, we link both after you confirm. The legal basis is Art. 6(1)(b) GDPR (contract performance). Google LLC is certified under the EU-U.S. Data Privacy Framework. Google handles the sign-in itself as a separate controller under its own privacy policy: https://policies.google.com/privacy.

6. Storage Duration

We keep data only as long as the purpose requires:

• Account, entries, photos, profile photo, voice notes, progress, wishlist: while the account exists. A removed or replaced profile photo is deleted immediately
• Deleted entries: when you delete an entry, we immediately remove its details, notes and nickname, and its photos and voice notes, from our servers. Only a deletion marker without content (an ID and a time) remains, so that your other devices remove the entry too. This marker stays until you delete your account. For a wishlist entry the marker still holds the stone's name and we delete it after 30 days. Results of earlier identifications (name, properties) stay stored until you delete your account, for your progress and to avoid repeated analyses, with no link to an entry or photo
• Consent records: while the account exists
• Consent to immediate start when buying a pack (wording version, time): while the account exists
• Purchase data (encrypted purchase token, product, plan, status, expiry date, order ID): while the account exists, so that we can check your plan. Technical notifications from Google Play (only an ID and a time, no account reference): 30 days
• Sessions: 30 days from sign-in, immediately on sign-out. At most the 10 newest sessions per account are kept; each new sign-in ends the older ones. We delete expired sessions automatically
• Request-limiting counters (including the IP hash value): only for the relevant window of 1 minute to 24 hours, then deleted automatically
• Buffer for running image analyses: about 1 day
• Uploaded photos and voice notes not linked to an entry: deleted after 1 day
• Security events: 90 days
• Technical operating logs at Cloudflare (a sample of about 10 % of requests, without photos or notes): at most 7 days
• Database backups at Cloudflare (restore points, “Time Travel”): at most 30 days, which is how far back they reach according to Cloudflare. What we have deleted (entries, a whole account, expired hashes) may remain in these backups until then, after which it is gone for good. The backups exist only at Cloudflare, and photos and voice notes are not part of them and are not restored except to repair data loss
• Account deletion: your access is blocked immediately and all sessions end. Account, entries, files (photos, profile photo, voice notes) and purchase data are then deleted, usually at once, otherwise in the automatic maintenance run that runs every 10 minutes and retries failures. This does not cancel a Google Play subscription
• Data on your device (collection, photos, voice notes, settings): it stays on the device after you sign out so that you can sign in again. It is deleted when you delete your account, clear the app data or uninstall the app. The app does not encrypt it itself; your device's protection applies (screen lock, device encryption).
• Confirmation code: it works for 10 minutes. The hash of an expired code is deleted by the automatic maintenance run, which runs every 10 minutes, so it can stay stored for up to about 20 minutes
• Emails not yet delivered: until they are sent, at most one day
• Hashes protecting the free identifications (formed with a secret key): 365 days (12 months) for email address and Google account, 30 days for the internet connection, also after an account deletion (Section 4.11)
• Declarations of cancellation or withdrawal, also from the form without signing in (type, contract, time of receipt, name, reason, desired end): until you delete your account, at most until three years after the end of the year in which the declaration arrived (Section 4.13). We do not store a cancellation without signing in that cannot be matched to an account with a running subscription in the app database
• Notice emails to the operator (a termination for good cause or an unmatched cancellation sent without signing in, a declaration Google Play did not carry out): in the controller's mailbox until the review is finished and we no longer need it
• Statutory retention duties (e.g. Sec. 147 AO and Sec. 257 HGB, 6 or 8 years depending on the document) remain unaffected. Invoices and payment records for subscriptions are kept by Google Play. We do not store invoices in the app database

7. Children

The app is aimed at adults aged 18 and over (Google Play target group: 18 and over) and not at children or teenagers. We do not knowingly collect data from persons under 18. If you believe a person under 18 has created an account, write to kontakt@senorit.de. We will then delete the account.

8. Automated Decision-Making

AI identification results are suggestions. We make no decision based solely on automated processing that has legal or similarly significant effects on you (Art. 22 GDPR). Technical limits such as the request limit only protect against abuse.

9. Your Rights as a Data Subject

You have the following rights under the GDPR:

• Right of access (Art. 15 GDPR): you may request information about the data stored about you at any time.
• Right to rectification (Art. 16 GDPR): you may request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): you may request deletion of your data (see also Section 6 on retention and account deletion; you can start the deletion in the app's Settings).
• Right to restriction of processing (Art. 18 GDPR): under certain conditions you may request restriction of processing.
• Right to data portability (Art. 20 GDPR): you may receive your data in a commonly used, machine-readable format (you can start the export in the app's Settings).
• Right to object (Art. 21 GDPR): you may object to processing insofar as it is based on Art. 6(1)(f) GDPR (legitimate interest).
• Right to withdraw consent (Art. 7(3) GDPR): where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal is not affected.
• Right to lodge a complaint (Art. 77 GDPR): you have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority for Hamburg is: Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Str. 22, 20459 Hamburg, https://www.datenschutz-hamburg.de.

Exercising Your Rights

To exercise your rights, please contact: kontakt@senorit.de

10. Data Protection Officer

We have not designated a data protection officer because the legal requirements (Art. 37 GDPR, Sec. 38 BDSG) are not met. The contact for privacy questions is the controller (Section 11), email: kontakt@senorit.de.

11. Contact for Data Protection Matters

For questions about data protection or to exercise your rights, please contact: Ebrahim Seyfi, Senorit Seeschwalbentwiete 23, 22119 Hamburg Email: kontakt@senorit.de