Legal

Legal notice

Information pursuant to Section 5 DDG (Digitale-Dienste-Gesetz, German Digital Services Act)

Contact

Phone: +49 40 228150700
E-mail: kontakt@taviroo.de

VAT identification number

VAT identification number pursuant to Section 27a German VAT Act (UStG): DE251083631

Responsible for content pursuant to Section 18(2) MStV (German Interstate Media Treaty)

Florian Möllenkamp, Carl-Petersen-Straße 29, 20535 Hamburg

Consumer dispute resolution

We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.

Image credits

All graphics, animations and the short film on the home page are our own designs; they show simplified app interfaces with invented sample data. Font: Jost (SIL Open Font License 1.1).

Privacy policy

TAVIROO is an app for independent consultants (“you”). The customer data you work with is stored on your device – not with us. This page explains which data nevertheless reaches us, for what purpose and for how long.

1. Controller

Florian Möllenkamp, Carl-Petersen-Straße 29, 20535 Hamburg, Germany. Phone +49 40 228150700, e-mail: kontakt@taviroo.de.

We have not appointed a data protection officer because we are not obliged to do so.

2. Roles

• We are an independent controller for your app account, sign-in, subscription, team functions, the video button, content reports, this website and support.
• We are a processor for the mailbox: we forward your customers’ encrypted answers to you and store them only for as long as is necessary for delivery (see DPA).

3. Hosting

Our server is operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, in a data centre in Germany. IONOS processes the data as a processor (Art. 28 GDPR (DSGVO)).

4. Your app account

For your account we store: your e-mail address, the version of the Terms (AGB) and the DPA (AVV) you agreed to, your statement that you act as an entrepreneur, and the time the account was created. For each signed-in device we store a random device identifier, the device name, the platform (iOS/Android), the app version, when the device was last active and – if you allow notifications – the push token. We store sign-in tokens only as a hash.

Purpose: sign-in, operation of the app and performance of the contract (Art. 6(1)(b) GDPR).

5. Sign-in by e-mail code and e-mail service

Instead of a password, we send you a six-digit sign-in code by e-mail. We store the code only as a hash; it is valid for 10 minutes. To send it, we use the e-mail service of STRATO GmbH, Berlin (servers in Germany), as a processor. It receives your e-mail address and the text of the e-mail containing the code. We do not write codes or e-mail addresses to our logs.

6. Your public link

Whatever you enter for your public page – display name, texts, image links, contact options, legal notice, questionnaire, rules and product list – is visible to everyone who opens your link. You decide what appears there.

7. End-to-end encryption (mailbox)

Your customers’ answers are encrypted in their browser and only decrypted again on your device. We cannot read the content. We delete encrypted answers as soon as your device has collected them, after 30 days at the latest. The same applies to a move to a new device (maximum 48 hours).

8. Subscription

You take out the subscription via the App Store (Apple) or Google Play (Google). Payment is handled by the respective store; we do not receive any payment data. So that we can activate your subscription, the app sends the purchase receipt signed by the store to our server; we verify it with Apple (App Store Server API) or Google (Google Play Developer API) and receive ongoing notifications from the store about renewal, cancellation, refund and expiry. For this we store: the store, the subscription identifier (for Apple the original transaction ID, for Google only a hash value of the purchase token), the product, the subscription status (trial, active, cancelled, payment problem, expired), the end of the term and whether it is a test purchase. To prevent a subscription from being transferred to other accounts, the app passes a random, non-descriptive identifier of your account to the store when you purchase. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). We store this information for as long as your account exists; when the account is deleted, we remove the link to the store subscription. The privacy notices of Apple or Google apply to the payment. Statutory retention obligations (for example for tax purposes) remain unaffected.

9. Push notifications

Push notifications are prepared. If you allow them, we store your device’s push token and, via the Apple Push Notification Service or Firebase Cloud Messaging (Google), send only a notice without content, for example “New analysis”. Customer data is never included in a notification. You can switch notifications off at any time in your device settings.

10. Team (feature being introduced)

If you set up or join a team, we store the team name, who is a member and since when, invitation codes only as a hash, messages from the team lead to the team and shared packages (message templates, product lists). The team lead sees only members’ display names, joining dates and whether they have been active in the last 30 days – no customer data and no figures. Customer data is never shared.

Members can report messages and shared content. We then store the report, who reported it and a copy of the reported content in order to review it. The team lead does not find out who made the report. We delete reports six months after receipt.

11. Video button (feature being introduced)

If you have a video edited, you upload it to our server. There it is stored encrypted (AES-256-GCM, one key per job), briefly decrypted for processing, the audio is converted into text on our own server (Whisper, without third-party providers) and an edited video with subtitles is created from it. We delete the original immediately after processing, and the result (also encrypted) and the text suggestion 24 hours after completion – or immediately if you delete the job. Please do not upload videos in which customers can be seen or heard.

12. AI content via Higgsfield (feature being introduced)

This feature is currently not activated; no data is transmitted to Higgsfield. If it is activated, the following applies: for AI images and videos you connect the app to your own Higgsfield account (Higgsfield AI). The photos or videos you select for this go directly from your device to Higgsfield using your own key – not via our server. This processing is governed by your own contract with Higgsfield and its privacy policy; we receive nothing from it. Your Higgsfield key remains protected on your device.

13. Reports about public pages

Using the report button on public pages, anyone can report illegal content. We store the link, the reason, the description and – only if provided – an e-mail address for the confirmation of receipt.

14. Logs and visits to this website

When you use this website or the app, our server processes the information technically required for delivery, including your IP address. In our logs we store only the time, the type of request (without parameters and without personal link content), the status, the duration and the shortened IP address (IPv4 without the last block, IPv6 only the first 48 bits). The logs are deleted after 14 days. Purpose: secure operation and troubleshooting; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

15. No cookies, no tracking

This website and the app set no cookies and use no tracking and no advertising. Nothing is stored on or read from your device that is not strictly necessary for display (Section 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act)) – which is why there is no cookie banner. Fonts, images and videos are hosted on our own server; no external fonts, images or scripts are loaded.

16. Storage period and deleting your account

You can delete your account at any time: in the app under Einstellungen (Settings) → Konto löschen (Delete account) or without the app at taviroo.de/en/konto-loeschen with a code sent by e-mail. We then delete your e-mail address, your profile, your link content, your keys, pending mailbox envelopes, moves, videos and devices; a team you lead is dissolved. Only an account entry without an e-mail address remains, so that your previous link name stays blocked and does not go to anyone else. You delete data on your device and backup files in your own cloud storage yourself. You cancel your subscription in the App Store or on Google Play.

17. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You can also lodge a complaint with a data protection supervisory authority, for example the Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information).

General Terms and Conditions (AGB)

1. Service

We provide you with an app and a personal analysis link. The app helps you manage enquiries, look after contacts and provide result pages.

2. Trial period

You can try the app free of charge for 14 days. No costs arise if you do not renew.

3. Subscription

The subscription runs through the App Store or Google Play. Billing is carried out by the respective store. You can see prices and terms there before you buy.

4. Cancellation

You can cancel at any time with effect from the end of the billing period. Cancellation takes place in the App Store or on Google Play. You can delete your account at any time in the app or at taviroo.de/en/konto-loeschen.

5. Content rules

The following are prohibited in particular: medical diagnoses, promises of cure, health or psychological tests presented as such, and content that violates applicable law.

6. Reporting

You can report violations via the report button on public pages, in the app for team messages and shared content, or by e-mail to kontakt@taviroo.de. We review reports and respond promptly; in the event of violations we remove content and may block accounts.

Data Processing Agreement (DPA / AVV)

1. Subject matter

We process personal data on your behalf: forwarding encrypted questionnaire answers to you and storing them for a maximum of 30 days, after which they are deleted.

2. Technical and organisational measures

• End-to-end encryption of the answers.
• Transport encryption (TLS) for all connections.
• Access restrictions and logging.
• Hosting in the EU.

3. Subprocessors

• Hosting: IONOS SE, Montabaur (data centre in Germany).
• E-mail service for sign-in and deletion codes: STRATO GmbH, Berlin (servers in Germany).
• Push services for notifications without content (Apple, Google).

We will only use further subprocessors after informing you in advance.

Accessibility

We design the website and app to be easy to read and use: sufficient contrast, visible focus, keyboard operation, text alternatives for images, light and dark colour schemes, and a still image instead of motion if your device has “Reduce motion” switched on.

If you come across a barrier, please write to us at kontakt@taviroo.de.