Privacy

Privacy policy

Last updated: 30 July 2026

1. Controller

Philipp Jürgen Weissgerber
Bärenweg 31A, 76149 Karlsruhe, Germany
Email: me@myrddin-gwais.de

2. Scope and legal bases

This policy explains how personal data is processed when you visit this website or request a photo analysis. Depending on the processing operation, we rely on Article 6(1)(b) GDPR to provide the requested analysis, Article 6(1)(f) GDPR for secure and abuse-resistant operation, and Article 6(1)(a) GDPR for optional advertising services.

3. Hosting and server logs

The service is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When you access the website, the web server and reverse proxy process technical connection data such as IP address, time, requested resource, response status, transferred amount, referrer and user agent. Processing is necessary to deliver the website, diagnose errors and defend against attacks (Article 6(1)(f) GDPR).

Log data is deleted or rotated when it is no longer required for operational security. Data needed to investigate a specific security incident may be retained until that incident has been resolved and any legal retention periods have expired.

4. Technically necessary storage

These storage operations are strictly necessary to provide the expressly requested service or to remember your privacy choice. They are therefore based on Section 25(2)(2) TDDDG and Article 6(1)(b) or (f) GDPR. No analytics cookie is used.

5. Abuse prevention and quotas

To enforce daily usage limits, your IP address is transformed into a pseudonymous HMAC value using a secret stored only on the server. The database stores this value, event type and time. Usage events are automatically deleted after 31 days. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting the limited analysis service against automated or excessive use.

6. Uploaded images and context

You choose whether to upload an image and may provide optional information such as strain, growing medium and notes. Images are validated, reduced in size and processed in working memory. They are not placed in a gallery and are not permanently stored on the Grow server. Please do not upload people, licence plates, addresses or other identifying or sensitive information.

7. OpenAI API

For the requested image analysis, the prepared image and the context you provide are sent to the OpenAI API. For customers in the EEA, the contracting provider is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Processing is required to provide the analysis you requested (Article 6(1)(b) GDPR).

API requests are sent with store: false, so no Responses API application state is retained for this request. OpenAI may retain content in abuse-monitoring logs for up to 30 days by default and may process data through subprocessors outside the EEA. OpenAI uses safeguards including the EU Standard Contractual Clauses for relevant transfers. API content is not used to train OpenAI models unless the account owner has explicitly opted in. Further information is available in the OpenAI API data-controls documentation and the OpenAI Data Processing Addendum.

8. Rewarded advertising and consent

Google Rewarded Ads are currently enabled. When advertising is enabled, Google Ad Manager is loaded only after you have actively allowed “Rewarded advertising” in the privacy settings. Before consent, no Google advertising script or advertising frame is requested.

The initial advertising configuration requests non-personalised ads only. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may nevertheless process identifiers, device and browser data, IP address, advertising interactions and consent signals, and may involve companies in third countries. The legal bases are your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw consent at any time with future effect using the “Privacy settings” button. Withdrawal does not affect the lawfulness of prior processing. Further information: Google Privacy Policy.

9. Contact by email

If you contact us by email, we process your contact details and message to answer the request. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual enquiries and otherwise Article 6(1)(f) GDPR. We delete correspondence when it is no longer needed, unless statutory retention duties apply.

10. Recipients and international transfers

Recipients are limited to hosting and technical service providers required to operate the service, particularly Hetzner and, when you request an analysis, OpenAI. Google becomes a recipient only after advertising consent and only when the rewarded-ad function is active. Data is disclosed to public authorities only where legally required.

11. Your rights

Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20) and objection (Article 21). You may withdraw consent at any time with future effect. Contact: me@myrddin-gwais.de.

12. Right to complain

You may complain to a data-protection supervisory authority. The authority responsible for Baden-Württemberg is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany; baden-wuerttemberg.datenschutz.de.

13. Automated decisions

The visual estimate does not produce legal or similarly significant effects. No automated decision-making within the meaning of Article 22 GDPR takes place.

14. Security and updates

We use TLS encryption, restrictive security headers, input validation, CSRF protection and access limits. We update this policy when processing operations, providers or legal requirements change.

This English version is a faithful convenience translation. The German version is authoritative where legally permissible.