Skip to content

Privacy policy

Zur Information, maßgeblich ist die deutsche Fassung. For information only; the German version is binding. Deutsche Fassung

As of 30 October 2026

1. Controller

Feldmelder is offered by Ramazan Usanmaz (sole proprietorship), Albert-Altwicker-Straße 31, 47445 Moers, Germany.

E-mail: [email protected]. We have not appointed a data protection officer because there is no legal obligation to do so.

2. In brief

  • No analytics or tracking tools, no advertising, no social media plugins.
  • We serve fonts, icons and scripts ourselves; nothing is loaded from third-party servers (CDNs, font services). The only exception is the map in the signed-in portal (section 6).
  • Only technically necessary cookies, therefore no cookie banner (section 10).
  • Our servers are located in Germany. The connection to the website is encrypted (TLS).

3. Hosting and server logs

The website and the portal run on servers in Germany. At present we operate them on our own hardware in Germany; a data centre in Germany is planned for production. If we change the operator, we will update this policy.

For every request our web server logs the time, the requested address, the status code, the amount of data transferred, the referrer and the user agent (browser and operating system). The sender recorded in this log is the internal address of our reverse proxy, not your IP address. The logs serve the secure and stable operation of the service (Art. 6(1)(f) GDPR); they are rotated by size and continuously overwritten.

4. Cloudflare (reverse proxy and DNS)

Our domains are operated through Cloudflare: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare answers DNS queries, accepts the encrypted connections and forwards them to our server through an encrypted tunnel. In doing so, Cloudflare processes your IP address, the transmitted content and metadata of the request (e.g. requested address, time, user agent) and cookies passed through, in order to establish the connection and to fend off attacks. If you write to an address at feldmelder.de, Cloudflare (Email Routing) receives the message and forwards it to our mailbox.

Cloudflare acts as our processor under its data processing agreement. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; the European Commission’s standard contractual clauses apply in addition. The legal basis is our legitimate interest in a secure and available service (Art. 6(1)(f) GDPR). More information: www.cloudflare.com/privacypolicy.

5. Contact and demo requests

Through our forms (request a demo, request an offer, contact, security report) we collect: name, e-mail address, optionally company, phone number and message, for offers the selected plan, the page from which you opened the form, the language, the time, the user agent and your confirmation of the privacy notice. We do not store your IP address in clear text, only as an irreversible check value formed with a secret key (HMAC); it is used to refuse more than five requests per hour from the same network.

Against spam we use a field that is invisible to people and a minimum completion time; no captcha and no third-party service is used. Requests are stored in our own database on our server. We may be notified of new requests by e-mail (section 7).

The purpose is to answer your request and, where applicable, to prepare a contract (Art. 6(1)(b) GDPR), and our legitimate interest in handling requests and preventing abuse (Art. 6(1)(f) GDPR). We delete requests once they are settled and no contract follows, at the latest twelve months after the last contact; statutory retention obligations remain unaffected. The same applies to e-mails sent to us.

6. Customer accounts in the portal

For portal users we process: e-mail address, role and organisation, language setting, the password only as an Argon2id hash, with two-factor sign-in the TOTP secret (stored encrypted), where applicable the Telegram chat ID, the times of registration and last sign-in, sign-in attempts (e-mail, IP address, time, success) and an audit log of security-relevant actions (e.g. sign-ins, commands sent, changes of rights) with time and IP address. Devices signed in to the mobile app are stored with device name, platform, user agent, time of last use and, if push notifications are used, the device’s push token; sign-in tokens only as a hash.

The purpose is to provide the portal under the contract (Art. 6(1)(b) GDPR); sign-in attempts and the audit log also serve security and the traceability of commands to plants (Art. 6(1)(f) GDPR). Sign-in attempts are deleted automatically after 30 days. We store account and audit data as long as the customer account exists; after the end of the contract we delete or return them in accordance with the data processing agreement.

The map in the signed-in portal loads map tiles from the servers of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). The OpenStreetMap Foundation thereby receives your IP address and user agent. The European Commission has adopted an adequacy decision for the United Kingdom. The legal basis is Art. 6(1)(f) GDPR (showing plant locations).

7. E-mail delivery via Brevo

We send the portal’s e-mails (alarm messages, invitations, password resets, notices of new requests) via Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). Brevo processes the recipient address, subject, content and delivery status as our processor in the EU. The legal basis is Art. 6(1)(b) GDPR, for notices of new requests Art. 6(1)(f) GDPR. No text messages (SMS) are sent at present.

8. Notifications via Telegram

Customers can additionally receive alarm messages via Telegram. This happens only if a customer sets it up for a contact. We then transmit the content of the alarm message (e.g. plant, tracker, type of alarm) to the chat ID assigned by Telegram. The data is transferred to Telegram (Telegram Messenger Inc. or Telegram FZ-LLC, Dubai, United Arab Emirates) and is subject to Telegram’s terms; there is no adequacy decision for the United Arab Emirates. The customer decides to use this channel (Art. 6(1)(b) GDPR).

9. Data from the Feldmelder Box (processing on behalf)

The Feldmelder Box sends operating data of the plant (angles, mode, weather values, alarms, command acknowledgements). We process this data and the alarm contacts stored by the customer (name, e-mail address, phone number, Telegram chat) on behalf of the customer under the data processing agreement. The customer is the controller for this data. Raw plant data is deleted after 90 days; aggregated 15-minute values are kept for evaluations.

10. Cookies and local storage

We set only one technically necessary cookie: the session cookie __Host-session. It stores the sign-in, the selected language and protection against forged form submissions (CSRF); it is signed, transmitted only over HTTPS and valid until the browser is closed, after a sign-in for at most twelve hours. Your choice between the light and dark design is stored locally by your browser (localStorage) and is not transmitted to us. As both are strictly necessary for the service you request, no consent is required (§ 25(2) no. 2 TDDDG).

11. Data security

All connections to the website, to the portal and from the Feldmelder Boxes are encrypted with TLS; boxes identify themselves with their own device certificates. Further measures are described on the security page and in the annex to the data processing agreement.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw consent at any time with effect for the future. Write to us at [email protected].

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

13. Changes

We update this policy when our service or the law changes. The version published here applies.