Datenschutzerklärung

This explains how ortwort processes personal data, and reflects the current implementation. Two groups are covered: creators, who hold an account and publish surveys, and respondents, who answer a survey without an account.

1. Controller

Uzay Durdu, Spiegelberg 3, 88090 Immenstaad am Bodensee, Germany.
Contact for data-protection matters: info@ortwort.com.

A Data Protection Officer has not been appointed. The conditions of Art. 37 GDPR and § 38 BDSG (in particular the 20-person threshold for automated processing) are not met by this single-operator service. If the service grows past those thresholds a DPO will be appointed and named here.

2. What we collect and why

Creators (account holders)

• Account: email address; for password sign-in a hashed password (managed by Supabase Auth); for Google sign-in, the email and Google account identifier passed to us by Google. Purpose: providing the service. Legal basis: Art. 6(1)(b) GDPR (contract).
• Profile & usage: credit balance and an append-only credit ledger, plan and subscription status, a referral code, your email-notification preference, and the timestamp and version of the privacy policy you accepted at sign-up. Legal basis: Art. 6(1)(b), and for the consent record Art. 6(1)(c) with Art. 5(2) (accountability).
• Surveys you create: title, description, questions, the target area you draw (a geographic geometry), schedule and response goal. Legal basis: Art. 6(1)(b).
• Payments: we do not receive or store card details. Our Merchant of Record, Paddle, processes the payment; we store only a Paddle customer id, a subscription id, and plan/renewal status returned by Paddle’s signed webhook. Legal basis: Art. 6(1)(b); statutory retention obligations apply to Paddle as seller.
• Referrals: if you were invited, a record linking your account to the inviter so the referral bonus can be paid after your first published survey. Self-referrals are rejected. Legal basis: Art. 6(1)(b) / Art. 6(1)(a).
• Notifications: an in-app notification when your survey receives a response, plus an email to you if you opted in (switchable in Settings). Legal basis: Art. 6(1)(b) / Art. 6(1)(f), with opt-out.

Respondents (no account)

• Answers: your responses to the survey questions.
• Location — location-targeted surveys only. Before the browser location prompt you see a plain-language screen and must actively agree. Your device then reports approximate coordinates. The server uses them once to check whether you are inside the target area (plus a 1 km buffer), then discards them. We store only a coarse geohash of precision 6 (a cell of roughly 1.2 km) and a two-letter country code. Exact coordinates are never stored and never shown to anyone. Global surveys do not request location at all. Legal basis: Art. 6(1)(a) (consent); you may withdraw by not submitting.
• One response per person: if you are signed in, your account id is stored with the response so each survey can be answered once. If you are not signed in, a first-party, HTTP-only cookie (ow_did) is set and stored only as a salted HMAC (device_hash) — it identifies a browser, not a person, and is used solely to block duplicate submissions. Legal basis: Art. 6(1)(f) (integrity of results); for the cookie, § 25(2) TTDSG (strictly necessary for a service you requested).
• Reading accuracy & quality flags: the reported accuracy of the location reading and non-identifying flags about the submission. Legal basis: Art. 6(1)(f).

We do not run web analytics, advertising, profiling or third-party tracking, and we do not use AI processing of your data. If any of that changes, this policy and, where required, a consent mechanism will be added before it is switched on.

3. Server logs

Our hosting provider (Vercel) processes standard request data, including the IP address, transiently to deliver and secure the service. We do not keep our own long-term access logs. Vercel’s data-processing terms apply. Legal basis: Art. 6(1)(f).

4. Processors and recipients

We use the processors below under Art. 28 GDPR, each with a data-processing agreement. Where a processor is outside the EU/EEA, transfers are based on the EU Standard Contractual Clauses and/or the EU–U.S. Data Privacy Framework as provided in that processor’s DPA; Switzerland is covered by an EU adequacy decision.

• Supabase (Supabase, Inc.) — database, authentication and file storage; the project is hosted in the EU (Frankfurt). Also sends account emails (sign-in links, confirmations, password resets).
• Paddle (Paddle.com Market Ltd, United Kingdom) — reseller / Merchant of Record for all payments: runs the checkout, processes payment data, calculates and remits VAT, issues invoices.
• Resend (Resend, Inc., USA) — sends the transactional “new response” notification emails to creators who opted in.
• Google (Google Ireland Ltd) — only if you choose “Continue with Google” to sign in; Google authenticates you and returns your email and account id.
• MapTiler (MapTiler AG, Switzerland) — serves the map tiles shown in your browser and thereby receives your IP address and the map area being viewed.
• Vercel (Vercel, Inc., USA) — application hosting; serverless functions are configured for an EU region.

5. Cookies and local storage

See the cookie information. In short: a Supabase session cookie for signed-in creators, the strictly-necessary ow_did anti-duplicate cookie for anonymous respondents, and a few localStorage / sessionStorage keys for UI preferences and to carry your consent choice through the sign-in redirect. No advertising or analytics cookies are set.

6. Retention

• Account data and everything linked to it is kept until you delete your account. Settings → “Delete account” removes the profile, surveys, questions and responses. Provider backups may persist for a short rolling window as set out in each provider’s DPA (typically up to 30 days).
• Survey responses are kept for as long as the survey exists in your account; deleting a survey deletes its responses. They contain no exact location and, for anonymous respondents, no account link — only a coarse ~1.2 km cell and a country code. We intend to reduce responses to aggregate-only form 12 months after a survey closes.
• The consent record (timestamp and policy version) is kept for the life of the account and for a limitation period thereafter, for accountability.
• Payment and invoice data is held by Paddle as seller under its own statutory retention obligations (German commercial and tax law generally require 6–10 years).

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3)). Contact: info@ortwort.com. You also have the right to lodge a complaint with a supervisory authority. The authority competent for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Königstraße 10a, 70173 Stuttgart, baden-wuerttemberg.datenschutz.de.

8. Children

The service is not directed at people under 16 and we do not knowingly collect their data. There are no age-targeted surveys.

9. Changes

We may update this policy as the service changes. The current version is “2026-08-30”. Material changes are reflected in the version recorded against your account at sign-up.