Information on the processing of personal data in accordance with GDPR
Luis Godoy Alvarez
Stabiusstr. 11
90489 Nuremberg
Germany
Email: hello@findmyseidla.de
This website is hosted by Vercel Inc. When you visit this website, Vercel processes technically necessary connection data. This may include IP address, timestamp, accessed page, referrer URL, browser and device information, and operating system data.
The legal basis for this processing is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the secure, stable and efficient operation of this website.
As Vercel is a US-based provider, personal data may be transferred to the United States. For international data transfers, Vercel refers, among other things, to the EU-US Data Privacy Framework and to the European Commission’s Standard Contractual Clauses.
Further information: vercel.com/legal/privacy-policy
This website may use Vercel Web Analytics after your consent. It helps us understand which content is useful and where the site experience should be improved.
Web Analytics is loaded only after you accept it in the cookie notice. If you reject it, no further optional analytics events are sent. Your decision is stored in your browser. Use “Cookie settings” in the footer to change it or withdraw consent. Account, reader-profile and shared-tour pages are excluded from analytics events; query strings and URL fragments are removed from other events.
Vercel Web Analytics works without cookies. A visit is distinguished by a hash derived from the request itself, not by an identifier stored on your device, and that association is discarded after 24 hours. We use no advertising tools, and we use no session recordings on this website.
More information: Vercel Privacy Policy
This website includes an optional AI chat assistant (“Fränki”). If you use the chat, your entered messages, a shortened conversation context, the address of the page you are using the chat on, and technical information such as IP address, timestamp and a local session identifier are processed. If the page is your account, a profile or a shared tour, only “/” is sent instead of its address.
This processing is used to answer questions about Franconian beer culture, breweries, beer cellars, beer styles, beer hiking, food and travel planning, to prevent abuse, enforce usage limits and protect the technical and economic security of the website.
The chat runs through our own function at Supabase (Supabase Pte. Ltd., servers in Ireland) and from there through an interface provided by OpenAI; under OpenAI’s terms, the provider for customers in the EEA is OpenAI Ireland Ltd., Ireland. Your chat messages, relevant conversation context and the address of the current page may be transmitted to OpenAI and processed there in order to generate an answer; OpenAI also turns your question into numbers with which we search our own texts. Processing may also take place in the USA. Your IP address stays on the website: for the usage limits, our function receives only a check value made from it with a secret key. Please do not enter confidential, sensitive or personal information that is not necessary for your request.
We do not permanently store chat histories in our own database. For abuse prevention, technical access data and rate-limit information may be processed temporarily. We do not ask OpenAI to store answers for later retrieval. According to OpenAI, content sent through its interface is not used for training by default, unless the customer explicitly opts in. For abuse monitoring, OpenAI may retain it, normally for up to 30 days, and longer where legally required or needed to prevent harm.
The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to provide the optional chat, answer user requests, prevent abuse and operate the website in a technically and economically secure way.
Supabase and OpenAI process the data as our processors. For transfers to countries outside the EEA, such as the USA, OpenAI’s data processing terms provide appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an adequacy decision; Supabase refers to the European Commission’s Standard Contractual Clauses. Further information: openai.com/policies/data-processing-addendum
The random chat identifier stays in your browser’s local storage until you clear this website’s data. For usage limits, Supabase stores counters with hashed IP and session identifiers, without chat text. They expire with their minute, hour or day window; expired counters are gradually removed during subsequent requests. Answers may be reused from our function’s memory for up to six hours to avoid repeated paid requests. This is not permanent storage of a chat history.
What this section says about OpenAI also applies to Fränki in the app (8.6) and the bottle scanner’s AI search (8.7).
This website uses system fonts and does not itself embed font services such as Google Fonts. If you load a Google map (section 6), Google Maps loads the Roboto font from Google’s font servers; Google receives your IP address as it does for the rest of the map.
This website may include interactive Google Maps views: in the directory, on the beer hikes and on tour pages, including tours shared by link. A map is loaded only when you consent to external content via the cookie/consent banner or actively choose to load it via the relevant button. Before that, no connection to Google Maps is established. If you load a map with the button, your browser remembers this consent for all maps on the website. You withdraw it with “Reject” under “Cookie settings” in the footer.
“Open route in Google Maps” on one of your tours is a link: only when you click it are the tour’s stops (name and address) sent to Google, and Google Maps opens in a new tab, where Google’s terms apply.
In the directory map you can show your location. Only when you tap the location button and your browser allows it does the page read your location. It stays in your browser: the page uses it to sort places by distance and to show the map around you. It is not sent to our server; Google receives the map section shown.
When the map is loaded, technical data such as IP address, browser and device information, time of access and usage data may be transmitted to Google and processed there. The legal basis is your consent under Art. 6 para. 1 lit. a GDPR. The brewery list remains usable without loading the Google map.
More information: Google Privacy Policy
This website may contain external recommendation, booking, partner or affiliate links, marked with *. If such a link is used as an active affiliate link and you make a booking or purchase through it, we may receive a commission from the respective provider at no additional cost to you. When you click an affiliate link, a cookie from the respective affiliate program may be stored on your device to track the referral. We have no influence over the data processing carried out by these third-party providers.
The following external providers may appear on this website as booking, recommendation or partner links:
Additional providers or partner programmes may be added over time. This list will be updated accordingly.
We also link to our own shop, in the footer and on individual pages. The link leads to shop.findmyseidla.de; that address is served by our host Vercel (section 2) and redirects straight to our shop on Etsy. It is not an affiliate link. Data is transmitted to Etsy only once Etsy itself is called, under Etsy’s terms; within the EEA, Etsy Ireland UC is the controller.
More information: Etsy Privacy Policy
This section applies to the Find My Seidla app for iOS and Android. The data controller is the same as for the website (section 1), and your rights (sections 10 and 11) apply to the app as well. Sections 2 to 7 describe the website: the app uses no Vercel, no analytics tools, no cookie notice and no affiliate links. The account, tours and friends on the website are covered in 8.4, because it is the same account as in the app. When you download the app, Apple (App Store) or Google (Google Play) process data under their own terms.
Find My Seidla is meant for people aged 16 and over.
The app stores saved places, planned tours with your notes, your diary and your settings on your device. A diary post consists of the day it is about, your text, up to five photos and the details you add yourself: a place from our directory, beers (brewery, name, style), a festival and a hike. Without an account, this data does not leave your device. You delete it in the app where it appears, or together with the app.
For the limits on Fränki, the bottle scanner and reports, the app creates a random installation ID. It says nothing about you, is not tied to any account and disappears when you delete the app.
If you allow it, the app uses your location on your device: for distances, for your dot on the map (only once you ask for it), for the Seidla Finder, which shows the places around you in the camera image, and for nearby places when you write a post. The latter only if permission has already been granted, because the app does not ask for it while you write a post. The app sends your coordinates to no server, and a post stores no location, only the place from the directory that you choose. Fränki does not use your location (8.6).
The app uses the camera for the Seidla Finder, for the bottle scanner and, if you wish, for photos for your profile and your diary. For the Seidla Finder and the bottle scanner, the camera image stays on the device: the Seidla Finder only displays it, and the bottle scanner reads the barcode and label in it.
On iOS this is done with Apple’s own image recognition. On Android, Google’s recognition through Google Play services does the reading, and only once you have agreed: the app asks before the first recognition. Even then the image stays on the device, but Google receives technical diagnostic and usage data, such as device model, operating system version, app name and version, a device identifier and an installation-scoped identifier, and performance and error values; no images and no recognised content.
The legal basis is your consent under Art. 6 para. 1 lit. a GDPR. You can withdraw it at any time, in the app under Settings, Privacy, “What comes from Google”; the scanner then asks again the next time. Your decision stays on your device, it is not sent to us and is not part of the copy in your account.
Further information: developers.google.com/ml-kit/android-data-disclosure
When you write a new post on an iPhone, the app shows your photos if you allow it access. They stay on the phone; only the photo you choose goes into the post.
You choose or take photos yourself. The app crops them on the device, scales them down (profile picture 512 × 512 pixels, diary photos at most 1600 pixels on the long side) and removes all metadata before saving, including where the photo was taken.
The app works without an account. If you create one, we process:
The data is held by Supabase (Supabase Pte. Ltd.) on servers in Ireland. Access controls protect your private account data. Profile pictures and photos are held in private storage areas. Section 8.5 describes who can see your profile picture and content shared with friends; tour-sharing links follow the rules below. Supabase acts as our processor; for transfers to countries outside the EU, Supabase refers to the European Commission’s Standard Contractual Clauses.
Further information: supabase.com/privacy
The emails with the code are sent on our behalf by Mailjet (Sinch group) from noreply@findmyseidla.de. The email contains only the code, no link.
Further information: mailjet.com/legal/privacy-policy
The legal basis is Art. 6 para. 1 lit. b GDPR: you use an account that you create yourself.
Deletion: you delete your account yourself in the account area of the app. The app first removes your profile picture and all photos in your diary from the server, and then deletes the account with all data stored there. If photo removal fails, the account remains and you can retry. Photos already removed stay removed, so the process can be partially complete. After successful account deletion, the app also removes everything that belongs to the account from your device, as when you sign out.
Whatever you delete in the app also disappears from the copy on the server a few seconds later, as soon as your device is online. If a second device signed in to the same account still has the entry, it can come back from there. A sign-in session ends when you sign out or delete the account. When you sign out, the app first saves everything to your account and then removes everything that belongs to the account from the device; when you sign in again, it is back.
Signing in on the website: you create an account in the app or on findmyseidla.de, with your email address and a code; it is the same account. When it is created, your name and your username are added, and the time you accepted the house rules, as in the app; as for the account in the app, the legal basis is Art. 6 para. 1 lit. b GDPR. Signed in, you see your posts, your saved things and your tours in your profile. For this we process your email address, to which we send the sign-in code, as in the app. The session is kept in your browser’s storage because signing in needs it, and it ends when you sign out. The website reads and changes your saved things and your tours, with the notes on their stops; your posts it reads and shows you, but never writes. When you are signed in, it shows you your profile picture, your name and your username from the app using your sign-in. The browser processes these contents for display; there is no separate website account database. If you share a tour by link, anyone who has the link sees its title, its day, the transport and the stops; not who shared it, and never your notes. The link contains a randomly generated code and shows your current state. If you delete the link, the tour or your account, it shows nothing any more. On the website you can change your name and your profile picture and delete your account. The picture is scaled down in your browser before it is uploaded, and nothing but the pixels goes up, not even the place the photo was taken. Deleting removes the account with everything in it, as in the app. For the session, Supabase stores the IP address and the browser’s technical identifier, as with the app.
When creating a tour, the website keeps the unconfirmed request in the browser tab’s session storage: its account association, a random request identifier, title, date, transport mode, stops and their notes. This lets a retry after a connection problem reuse the same request without creating a second tour. The local request is removed after confirmation, on sign-out or when switching accounts. Revoking a sharing link cannot recall content already loaded or saved on somebody else’s device.
Cloudflare’s check: when you click “Request a code” or “Send the code again” on the website, the page loads Cloudflare Turnstile from challenges.cloudflare.com. Before every code email, Turnstile checks afresh that a person is requesting the code and not a program. Before that, nothing goes to Cloudflare. The provider is Cloudflare, Inc., USA. According to Cloudflare, features of your browser and your connection are processed, such as your IP address, your browser’s TLS fingerprint and user agent, and this website’s site key with its domain (Turnstile Privacy Addendum). Cloudflare processes them for us as a processor and, in addition, as a controller in its own right, to improve its detection of programs. In doing so, Turnstile stores an entry “cf.turnstile.u” for challenges.cloudflare.com in your browser’s local storage, which stays until you delete it; it sets no cookies. For transfers to the United States, Cloudflare states that it relies on its certification under the EU-US Data Privacy Framework and, should that lapse, on the European Commission’s Standard Contractual Clauses. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest is that no program triggers code emails to other people’s addresses en masse. Reading your browser’s features and the entry in local storage are permitted under § 25 para. 2 no. 2 TDDDG, because they are strictly necessary for the sign-in you request yourself. In the app, from version 1.0.1, Turnstile likewise checks before every code email that a person is asking, as soon as you tap “Send a code”, and not before. For this the app shows a small page of its own in an embedded web view under the address findmyseidla.de and loads nothing from the website there, only Cloudflare’s script; Cloudflare receives the same features as on the website, on the same legal basis, and afterwards the app’s storage holds Cloudflare’s script in the web view’s cache and a storage area for challenges.cloudflare.com; on Android it contains the same entry “cf.turnstile.u” as in the browser. All of it disappears with the app.
Friends on the website: there you see your posts, your friends, their posts and your requests. You can send and accept requests, give “Bassd scho”, report, block and lift a block. The same rules apply as in the app (8.5). The website uses the same account data as the app, with your sign-in. Content and photos are temporarily held in the browser for display; signing out or changing accounts clears the private display cache.
To recover photos after accidental deletion or technical failures, we back up profile pictures, private diary photos and smaller copies of shared photos, including their file and account identifiers. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest is protection against data loss. Manual backup and recovery also take place on our protected computer.
The external copy is held in private Backblaze B2 storage (Backblaze, Inc., USA) in the selected EU region. Photos and associated metadata are encrypted before upload; Backblaze does not receive the private decryption key. The configured automatic backup uses GitHub Actions (GitHub, Inc., USA), where files are temporarily processed unencrypted during the backup run, including outside the EU. GitHub does not receive the private decryption key either. For information about international processing and safeguards, see the privacy notices of Backblaze and GitHub.
Backblaze deletion rules expire each backup version after approximately 30 days plus deletion processing time; replaced versions may expire sooner. An encrypted GitHub artifact retained after a failed automatic run has a retention period of one day. Deleting a photo or account does not immediately remove existing copies held by these providers; these expire according to the rules above.
Friends are optional and require an account (8.4). Once you have chosen a name and accepted the house rules, other people with an account can find you.
You have two names for this. The display name is the one you give yourself and can change later. The username with the @ is chosen once and is fixed after that; it occurs only once among all readers. You can be found by either of them.
Your display name, your username, your picture and the number of your friends are then visible: on your profile, in search, in friend lists and with requests. The names of your friends are visible only to you.
What you share with friends is seen only by confirmed friends. For that, we store the photos as a smaller copy in a private storage area. Requests, friendships, blocks and “Bassd scho” are stored with your account ID. Blocking works in both directions.
If you report a post or a profile, the report reaches us with your account ID and goes out once a day by email (8.8). If someone reports a post of yours or your profile, that email contains your name and the words of the post. We delete handled reports after 30 days; open ones remain until they are handled.
If you delete your account, all of this is deleted. Only your own reports remain, without your ID.
The legal basis is Art. 6 para. 1 lit. b GDPR for the feature you switch on yourself, and Art. 6 para. 1 lit. f GDPR for the reports; our legitimate interest is being able to review posts that someone objects to.
Greetings, and topics Fränki does not cover, are answered by the app itself. All other questions go to our own function at Supabase and from there to OpenAI, which writes the answer; OpenAI also turns the question into numbers with which we search our own texts. Our provider is OpenAI Ireland Ltd., and processing can also take place in the USA. Sent along are the language, the last messages and the directory entries the question is about. Your name, email address and location are not transmitted; the installation ID (8.1) stays with us. If you ask about places near you, the app answers by itself with a pointer to the map, and none of it reaches our server. Please do not enter confidential information.
By default, OpenAI does not use this for training and keeps it for up to 30 days for abuse monitoring. For each installation ID we count how many questions were asked per minute and per day, to limit costs and abuse; we delete these counters after two days. The answer stays stored with us for up to six hours, without the ID and with the question only as a checksum, so that the same question does not cost money twice. What section 4 says about OpenAI applies here too.
The legal basis is Art. 6 para. 1 lit. f GDPR, as for the chat on the website.
When the app reads a barcode, it sends its digits and the language to our server function, and nothing else. No photo: the picture of the back label is read on the phone. If the label names one of our places, that place is sent to our function together with the barcode as a proposed match for review. If we do not know the code, our server asks the public database Open Food Facts about that code, without any information about you.
Accepted entries, confirmations and reports are stored as anonymous suggestions with their content, type and receipt time. Identical suggestions are combined. They await our review before changing public entries and do not count as independent votes. We do not store who submitted a suggestion. What you write in your diary stays in your diary (8.1) and does not go into this shared list.
Suggestions and copies of their original content in the review history become due for deletion 30 days after receipt. The separate private review history, including the decision, review notes and reviewing account’s ID, becomes due for deletion 90 days after the decision. Automatic cleanup runs hourly, even without new suggestions; service failures can delay it. Deleting the reviewing account removes its ID from the history. Verified factual catalog information without personal data may remain.
There is no promise whether or when a suggestion is taken up. Backups follow their own retention cycle; cleanup does not immediately delete every backup copy.
If you tap the AI search, the words from the label, the barcode and the brewery we already know go through our function to OpenAI, which searches the web with them; our provider is OpenAI Ireland Ltd., and processing can also take place in the USA. By default, OpenAI does not use this for training and keeps it for up to 30 days for abuse monitoring. Your installation ID, name, email address, location and the photo are not sent to OpenAI; the search is set to Germany, not to your location. We store the answer without your ID, so that the same bottle does not cost money twice. The installation ID only counts how often a search is made per day, and is deleted the next day. What section 4 says about OpenAI applies here too.
On Android, Google’s recognition does the reading of barcode and label, and only after your consent; see 8.3.
The legal basis is Art. 6 para. 1 lit. f GDPR.
If something about a place is wrong, or a place is missing, you can report it from the app. The report goes to our own server function: which place it is about, what is wrong, your words on it, the language and the anonymous installation ID (8.1). No name, no location. Nobody but us sees the report.
We send ourselves new reports once a day through Mailjet to hello@findmyseidla.de, without the ID. The ID only limits how many reports can come from one phone, and is deleted after seven days. We delete handled reports after 30 days; open ones remain until they are handled.
The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest is a correct directory.
The app shows maps using the Google Maps SDK from Google, and only once you have agreed. Before that the map stays a placeholder with “Show map”, and nothing goes to Google. If you agree, Google receives technical data such as IP address, device information and the map section shown. “Open in Google Maps” and handing over a tour open Google Maps outside the app, where Google’s terms apply.
Further information: Google Privacy Policy
The legal basis is your consent under Art. 6 para. 1 lit. a GDPR. You can withdraw it at any time, in the app under Settings, Privacy, “What comes from Google”; the map then turns back into a placeholder at once. Your decision stays on your device, it is not sent to us and is not part of the copy in your account.
The headlines under “News” are fetched from the media outlets by our server function; the app does not contact the outlets itself. If you tap a headline, an article on the website, or the legal notice or privacy policy, the page opens in your browser. There the terms of the respective provider apply, and for our website sections 2 to 7 and 8.4.
On the “Support Find My Seidla” page in the app, you can buy Find My Seidla a Schnitt, a Seidla, a Maß or a Schäufele. These are in-app purchases through Apple’s App Store or Google Play: purchase, payment and receipt run entirely through these stores and under their terms. We receive no payment or account data, only the store’s confirmation on your device that the purchase is complete. The app talks to the purchase system only when you open the “Support Find My Seidla” page or when an earlier purchase has not yet been completed; until then, the app only remembers on your device that a purchase is open.
Further information: Apple, Google
The legal basis is Art. 6 para. 1 lit. b GDPR.
“Visit the shop” opens shop.findmyseidla.de in your browser. The address redirects through our hosting at Vercel (section 2) straight to Etsy, where Etsy’s terms apply.
When the directory is loaded, and with every request to our server functions, Supabase processes technical connection data such as IP address and time. Supabase deletes these logs after seven days. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest is secure and stable operation.
The app contains no advertising, no tracking, no analytics or crash reports of its own and no push notifications (for the diagnostic data ML Kit sends to Google on Android after your consent, see 8.3). The fonts are built into the app; no font service is loaded. Data goes only to the services named here.
You delete your account in the app (8.4) or by email (8.15), individual entries where they appear, and everything on your device together with the app. You withdraw your consents to Google under Settings, Privacy (8.3 and 8.9). For access, a copy of your data and all other rights, write to hello@findmyseidla.de (section 10).
In the app: Profile → gear icon → Account → Delete account.
Without the app: write from your account’s email address to hello@findmyseidla.de, subject “Delete account”. We delete your account within 30 days, with everything that belongs to it on our server: name, username, profile picture, your posts and their photos, the copy of your saved places and tours, friendships, requests, blocks and Bassd scho. Existing photo backups follow the retention periods in section 8.4.1.
What stays: reports you sent about posts, profiles or places stay without your account ID until we delete them 30 days after handling them. If you delete the account in the app, the app also removes everything of it that was on your phone; the same happens when you sign out. If we delete the account after your email, you remove what is on the phone by deleting the app.
If you write to us, we process your email address, your name where you give it, and the contents of your message in order to answer it. The legal basis is Art. 6 para. 1 lit. f GDPR; where your message concerns your rights (section 10), it is Art. 6 para. 1 lit. c GDPR.
Our mailbox hello@findmyseidla.de is not held by us but by the “Private Email” service of Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA, acting as our processor. Your messages are therefore stored in the USA. Namecheap bases this transfer on the European Commission’s standard contractual clauses.
The daily email about new reports from the app (8.5 and 8.8) also passes through this mailbox. If someone reports a shared post or a profile, that email contains the name and the words of the reported post, which therefore rest in this mailbox as well.
We delete ordinary enquiries one year after they are settled. Requests concerning your rights we keep for three years, because we must be able to show that we answered them.
More information: namecheap.com/legal/general/privacy-policy-2
You have the following rights regarding your personal data:
To exercise your rights: hello@findmyseidla.de
You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. For us, the relevant supervisory authority is in particular:
Bayerisches Landesamt für Datenschutzaufsicht, BayLDA
Promenade 18, 91522 Ansbach, Germany
www.lda.bayern.de
We reserve the right to update this privacy policy as necessary to reflect current legal requirements or changes to the website. The version in effect at the time of your visit shall apply.
Last updated: October 2026
