Privacy

Controller

Christin Mikolai
Neue Querstraße 14
16303 Schwedt/Oder
Germany
hello@fimvory.com

Scope

This notice covers the Fimvory website and its contact and beta forms. Using the app, including sign-in, calendar connections or AI, requires additional privacy information about those features.

Website hosting

The public website is hosted by Railway Corporation in the EU West region (Amsterdam, Netherlands). Technical connection data is processed to deliver and secure the website and diagnose errors, including IP address, requested address, time, browser information and request status. The legal basis is Article 6(1)(f) GDPR, based on my legitimate interest in operating a secure and reliable website.

The website code does not log contact or beta form contents. The hosting provider’s technical logs are separate. Railway describes three days of log availability on its Free plan; older logs may become available after a plan change, so this does not establish permanent deletion after three days.

Railway privacy · Data processing terms · Logging information

Cookies, language preference and external content

No analytics cookies are set without your consent. If you explicitly select a language in the footer, the preference is stored as fimvory-language in your browser’s localStorage until you clear the site data. A new selection overwrites the value. It is only used to retain your chosen language, not for advertising or recognising visitors.

This requested function relies on section 25(2)(2) TDDDG. Where personal data is processed, the basis is Article 6(1)(f) GDPR and the interest in retaining your chosen display preference. Images, fonts and website scripts load from the website’s own server. Amplitude analytics and session replay load only after your explicit consent.

Usage analytics and session recordings with Amplitude

With your consent, we use Amplitude, Inc. for usage analytics and session replay: page views, clicks, navigation, session duration, browser and device information, attribution information and pseudonymous device and session identifiers. Session Replay reconstructs page views and interactions, with a configured sample rate of 100 % of consenting sessions. Our configuration excludes contact and beta forms from recordings. Entered first names, email addresses and messages are not sent as custom analytics events.

We use the EU data region. Amplitude remains a US provider; EU hosting does not rule out access from third countries. Processing relies on Article 6(1)(a) GDPR and section 25(1) TDDDG. You can reject without losing website functionality and withdraw anytime through Privacy settings in the footer. Withdrawal does not affect the lawfulness of prior processing.

Your choice, version and timestamp are stored for up to 180 days in localStorage as fimvory-analytics-consent to respect and document your choice (section 25(2)(2) TDDDG; Article 6(1)(c) with Article 7(1) GDPR). After consent, Amplitude uses AMP_ cookies and technical browser storage. Analytics cookies are configured for 180 days and may renew during use. Withdrawal stops further collection and removes accessible Amplitude cookies and local identifiers. Contact hello@fimvory.com to request deletion of data already sent.

Analytics events have an enabled automatic retention period of six months from ingestion by Amplitude. Ordinary session recordings are generally retained for 30 days under our plan. Bookmarks or comments can extend retention of individual recordings; these features are not used for routine analysis. Applicable deletion requirements and data subject rights remain unaffected.

Amplitude privacy · Processing terms and transfer safeguards

Contact forms and email

When you contact me, I process your email address, message and any other information you provide to respond. You may optionally provide your first name so I can address you personally. Email address and message are required in the contact form; without them I cannot handle a request through that form. Providing the information is voluntary.

General enquiries rely on Article 6(1)(f) GDPR and my interest in responding. Enquiries about a contract or pre-contractual steps you request rely on Article 6(1)(b) GDPR.

Requests go to hello@fimvory.com. I keep them for as long as needed to handle the enquiry and necessary follow-up, then delete them unless statutory retention or the necessary establishment, exercise or defence of legal claims requires otherwise.

Beta interest

The beta form collects your email address and, optionally, your first name, your wishes for Fimvory and information about your current planning. Your first name is used to address you personally; the other optional answers help me understand expectations. Please do not include passwords, health information or other particularly confidential data in free-text fields.

Submitting the form requests beta information and an invitation, based on your consent under Article 6(1)(a) GDPR. I handle requests personally through beta@fimvory.com. This does not automatically grant app access, subscribe you to a general newsletter or share your details for third-party advertising.

You can withdraw consent at any time by writing to hello@fimvory.com. Withdrawal does not affect the lawfulness of earlier processing. I delete the data when you withdraw or the purpose of the beta invitation and handling your interest ends, unless statutory retention applies. Later app participation is separate.

Form delivery and mailboxes

Enabled contact and beta forms use Resend by Plus Five Five, Inc. to send your email address and completed fields to my hello mailbox for contact requests or beta mailbox for beta requests. Your email address is used as Reply-To so I can respond personally. Forms cannot be submitted without configured delivery.

Spacemail by Spaceship provides the mailboxes and stores incoming messages. These services support the purposes described above. Technical delivery records, security data and backups may have separate provider retention rules.

Resend privacy · Resend data processing terms · Spaceship privacy · Spaceship data processing terms

Processing outside the EU

Railway and Resend are US providers; personal data may be processed outside the EU or EEA. Resend identifies the United States as its primary processing location. Choosing a European sending or hosting region does not alone exclude other processing outside the EU.

Railway, Resend and Spaceship publish data processing terms covering international transfers and EU Standard Contractual Clauses. You can request information about the applicable safeguards and copies of relevant documentation from hello@fimvory.com. Provider documents are linked above.

Abuse prevention

The server validates input and request origins, limits request sizes and uses a hidden field to detect simple bots. When you submit a form, your browser solves a short ALTCHA proof-of-work challenge hosted by this website. The server checks its signature, expiry and single use. This does not contact an external CAPTCHA provider or use cookies or browser storage.

To limit automated mail, a server-side database stores submission timestamps, one-time challenge identifiers and keyed hashes of submitted email addresses, but no form messages or readable email addresses. Records older than 24 hours are removed on startup, on submissions and by hourly cleanup. The database persists across restarts. Short-lived connection counters also protect the endpoints from bursts. The basis is Article 6(1)(f) GDPR and my legitimate interest in preventing spam, overload and abusive email sending.

Your rights

Subject to applicable legal conditions, you have rights of access, rectification, erasure, restriction and data portability. For processing based on legitimate interests, you can object on grounds relating to your particular situation. You can withdraw consent at any time for future processing. Contact hello@fimvory.com to exercise your rights.

You can lodge a complaint with a data protection authority, particularly where you live, work or believe an infringement occurred. The authority responsible for my location in Brandenburg is the Brandenburg Commissioner for Data Protection and Access to Information.

This website does not make automated decisions producing legal or similarly significant effects or use related profiling.