Privacy Policy

Last updated: 16 October 2026

Controller

Thorsten Meyer
Blombergstrasse 11 C
82393 Iffeldorf
Germany
Email: contact@gewerkton.com

Scope

This policy describes how personal data is processed when you visit gewerkton.com and when you request access to the Gewerkton application.

Hosting and server logs

This website is hosted in Germany. The hosting provider automatically stores technical access data (IP address, date and time, requested page, browser type) in server log files for the purpose of operating and securing the service (Art. 6(1)(f) GDPR). Log data is deleted according to the provider's retention cycle.

Cookies and advertising

This website sets no cookies and uses no advertising trackers.

Web analytics with Grynlume (only with your consent)

To understand how this website is used and to improve it, we use Grynlume, a web analytics service that we operate ourselves. Grynlume is loaded only after you have clicked “Allow” in the statistics window. If you decline or do not choose, no analytics data is collected. Grynlume sets no cookies.

What is collected. When you open a page, a small script loaded from grynlume.grimfaste.com sends: the address of the page, the address of the page you came from (referrer), the width of your browser window, how far you scroll, how long the page is in view, and clicks on file downloads and on links to other websites.

How you are counted. On our server, your IP address and your browser identification (user agent) are combined with a random key that changes every day at midnight (UTC) and turned into a one-way hash. This hash is used only to count visits on that day; it changes the next day, so visits on different days cannot be linked. The IP address and the full user agent are not stored. From the user agent, only the browser type and the operating system are kept. No location is derived from your IP address.

Where the data is processed. The statistics are stored on our own server in Germany. Requests to grynlume.grimfaste.com are passed through the network of Cloudflare, Inc. (USA), which forwards them to our server and processes your IP address for this transfer. Cloudflare participates in the EU-U.S. Data Privacy Framework.

Filtering automated traffic. To keep bots out of the statistics, the browser identification (user agent) of a visit and the host names of referring websites may be sent to TypeSafe AI, Inc. (USA) for automatic classification. Your IP address, the pages you visit and the daily hash are not sent. For TypeSafe's processing of this data, TypeSafe's own privacy policy and terms apply. The transfer is based on the EU standard contractual clauses in TypeSafe's data processing agreement.

Legal basis and withdrawal. The processing is based on your consent (Art. 6(1)(a) GDPR; for reading information in your browser, Section 25(1) TDDDG). You can withdraw your consent at any time with effect for the future by opening Privacy settings (also linked at the bottom of every page) and choosing “Decline”. If your browser sends a Do Not Track or Global Privacy Control signal, we treat this as a refusal and do not ask. We ask again after twelve months.

Storage period. Analytics data is deleted automatically after 14 months; this also applies to the daily totals derived from it. Backup copies of the statistics database are kept for about one week and then deleted. The statistics contain no data that identifies you directly.

Preferences stored in your browser

This website stores up to three entries in your browser to remember your own choices: gewerkton:region (the region you selected, in localStorage), gewerkton:language-hint (records that you dismissed the language suggestion, in sessionStorage) and gewerkton:statistik (your choice in the statistics window and its date, in localStorage). If you decline statistics, the entry pa_ignore is also set so that no analytics script already loaded on the page continues to count. Your browser language and time zone are read locally to preselect a region. None of this data is transmitted to us or to any third party, and it is not used to identify or track you. Storage is strictly necessary for the functionality you requested (Section 25(2) no. 2 TDDDG). You can delete these entries at any time in your browser settings.

Contact by email

If you contact us at contact@gewerkton.com, the data you provide (email address, name, message content) is processed to handle your request (Art. 6(1)(b) GDPR) and deleted when no longer required, unless statutory retention obligations apply.

The Gewerkton application (beta)

This website itself processes no project data. For the Gewerkton application (web app and mobile app), the following applies during the beta:

• Hosting. The cloud beta at dev.gewerkton.com runs on a virtual server in Frankfurt am Main, Germany, provided by Hostinger. Organisations can instead run Gewerkton in their own data centre (on-premises).
• Speech transcription. Recordings of meetings and dictations are transcribed on Gewerkton's own server (or the customer's own systems) with an open-source speech model (Whisper). Audio is not sent to an external speech service or to an AI provider. Recordings are made only after the documented consent of all participants, in line with Section 201 of the German Criminal Code (StGB). Recording of whole meetings is offered only to selected organisations that Gewerkton enables individually; the organisation, as the controller, obtains the participants' consent and informs them and, where required, its works council.
• AI provider in the beta: NVIDIA (USA). For organisations without their own AI key, AI features are processed by NVIDIA Corporation in the USA through its API service. Data categories without personal reference are sent there, for example plan content, models, manufacturer documents, operating data, photos without identifiable persons and key figures; data with personal reference is sent only with consent, as described below. Free texts addressed to people, delivery notes, invoices, contracts and shift handovers are not sent to NVIDIA. Transcripts of meetings and dictations are sent to NVIDIA for evaluation only if the organisation's administrator has allowed this in the AI settings and the participants' consent before the recording included evaluation by Gewerkton's AI provider. Before sending, Gewerkton replaces the names of participants, project members and the organisation's users with placeholders (such as “Person A”) and puts them back into the suggestions afterwards; this replaces names only and is not full anonymisation, so company names, addresses and other content remain in the text. Without both consents, the transcript is kept and no AI suggestions are created. Plan data is sent only after the site manager has confirmed for the project that the people named in the plan's title block have consented; if the wording of that confirmation changes, a new confirmation is required.
• Own AI key. An organisation can instead store its own key for one of 14 AI providers, including EU-based providers such as Mistral. Its requests then run under that organisation's own contract with the provider it chose, and are not sent to NVIDIA.
• Suggestions only. AI results are suggestions; nothing becomes binding without approval by a person.
• Site surroundings (beta): map and municipality search. When you open the “Location” step of the site surroundings in Gewerkton Studio, your browser loads map images of the official basemap.de map directly from the German Federal Agency for Cartography and Geodesy (BKG) via sgx.geodatenzentrum.de. For technical reasons the BKG receives your IP address and the map area shown, i.e. the approximate location of the construction site. Gewerkton sends no address, project data or user data in this process. The BKG is responsible for this delivery itself. Legal basis: Art. 6(1)(f) GDPR (displaying the official map for the function you requested). The municipality search uses an official list of German municipalities (BKG VG250) shipped with Gewerkton and runs entirely in your browser; search terms are not sent to anyone.
• Mobile app. The iOS and Android app stores project data in an encrypted database on the device and synchronises it with the server. It uses the camera, the microphone (only after documented consent), notifications and NFC for the functions they are needed for. It contains no advertising and no tracking. To delete your account, see Delete your account.

Details of processing for customers are governed by the agreement and the data processing agreement concluded with each customer. This section is general information and not legal advice.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a supervisory authority.