Privacy policy
Stand: August 2026
This is an English translation for convenience. The German version is the authoritative text to the extent permitted by law. This policy explains how adiuto (the “platform”) processes personal data under the General Data Protection Regulation (GDPR).
1. Controller
The controller under the GDPR is:
Simon Gabriel Neuffer (for adiuto)
c/o POSTFLEX PFX-373-202
Emsdettener Straße 10
48268 Greven
Germany
Please do not send parcels to this address.
Email: info@adiuto.org
2. Privacy contact
No data protection officer has been appointed. Please send privacy questions and data-subject requests to the postal or email address above.
3. Legal bases
We process personal data in particular on the following legal bases:
- Article 6(1)(a) GDPR — your consent, for example to push notifications,
- Article 6(1)(b) GDPR — performance of the user contract, including accounts, missions and matching,
- Article 6(1)(c) GDPR — compliance with legal obligations,
- Article 6(1)(f) GDPR — legitimate interests, especially secure, stable and abuse-resistant operation.
4. Hosting, platform access and logs
When you access the platform, we process technically necessary connection data, including the time and target of the request, data volume, browser and operating-system information, IP address and, where applicable, error data. We need this to deliver the service, diagnose faults and defend against attacks (Article 6(1)(f) GDPR). Access and application logs are deleted within 7 days. For authenticated sessions, the authentication system also stores the IP address and browser user agent to protect the session.
The platform, database, search index and analytics system run on a server in the Nuremberg data centre in Germany. The hosting and email provider is netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. netcup processes data on our behalf under an Article 28 GDPR agreement. Details: netcup privacy policy.
5. Cookies and local storage
We use only technically necessary session cookies for sign-in. They are required to provide the service you requested. Your browser may store functional settings locally on your device, such as assistant state. We do not use marketing cookies or advertising trackers.
6. Registration and account
For an account we process your email address, display name and credentials. Passwords are stored only as cryptographic hashes. We send an email to verify the address. Processing is necessary to perform the user contract (Article 6(1)(b) GDPR). Your account remains until deletion; self-service deletion is available in account settings.
7. Sign in with Google
If you choose “Sign in with Google”, Google sends us your name, email address and, if available, profile image so that we can create your account or sign you in (Article 6(1)(b) GDPR). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may process data in third countries. Google sign-in is optional; email and password are available as an alternative. Details: Google privacy policy.
8. Location data and address geocoding
To search nearby, you may voluntarily share your device location or choose a place. Device coordinates are used for that search, are not sent to the AI provider and are not stored in the assistant transcript. A default location remains in your account only if you choose to save it, until you change or delete it. The legal basis is consent (Article 6(1)(a) GDPR).
Addresses entered by initiative coordinators are sent server-side to KEPTAGO LTD (“Geoapify”), N. Nikolaidi and T. Kolokotroni, ONISIFOROU CENTER, 8011 Paphos, Cyprus, to determine coordinates. We use Geoapify's EU-only endpoint and store the returned coordinates with the location. Geoapify acts as our processor under Article 28 GDPR. The legal basis is Article 6(1)(b) and (f) GDPR. Details: Geoapify data processing agreement.
9. Missions, initiatives and content
When you pledge a donation, take on a task or manage an initiative, we process the necessary details, such as task, amount, drop-off location, time slot, role and membership. This is required for matching and fulfilment (Article 6(1)(b) GDPR). Published needs, locations and initiative descriptions are publicly visible.
For direct handovers, coordinators may enter a recipient's contact details (name, email address, phone number and organisational notes). The initiative must be authorised to do so. No later than our first email, the person receives the source of the data and a link to this policy (Article 14 GDPR). We remove contact details 90 days after pickup or cancellation; the non-personal workflow status remains for inventory records.
10. Email notifications
We send service emails, such as verification and mission or initiative notices, through netcup GmbH's SMTP infrastructure. This involves the recipient address, message content and technical delivery data. The legal basis is Article 6(1)(b) and (f) GDPR, and the processing is covered by the agreement described in section 4.
11. Push notifications
With your consent (Article 6(1)(a) GDPR), we send browser push notifications. We store the push endpoint and keys supplied by your browser. Delivery uses the push service of your browser or operating-system vendor, such as Google, Mozilla or Apple, which may process data in third countries. You may withdraw consent in settings or your browser; we then delete the subscription.
12. AI assistant
The assistant processes your input, the prior conversation needed for the response and necessary platform context, such as active filters, tasks or initiative data. This data is sent to the paid Gemini API service of Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Google processes inputs and outputs for us under the Google Cloud Data Processing Addendum and does not use them to improve its products for this paid service. Google may keep limited safety and abuse-prevention logs and may process data through subprocessors in third countries; the addendum provides safeguards including EU standard contractual clauses.
The legal basis is Article 6(1)(b) and (f) GDPR. We automatically delete raw transcripts after 90 days and immediately delete transcripts linked to a deleted account. We retain only coarse statistics without message text or a user identifier. Do not enter Article 9 special-category data, third-party confidential data or emergency information. AI output can be incorrect and must be reviewed before use. Details: Gemini API terms and Google Cloud Data Processing Addendum.
13. Telegram integration for initiatives
Coordinators may voluntarily connect a Telegram group or channel to their initiative. We process its Telegram chat ID, type and title, the connecting account and delivery status. We send Telegram only task information intended for publication and a platform link, never donor or recipient data. Telegram processes data under its own terms and may do so in third countries. The connection can be removed in initiative settings. Details: Telegram privacy policy.
14. Search, webhooks and external links
We operate the search index ourselves. It contains catalogue, task and location data including coordinates, but no account or donor profiles. Initiatives may configure their own webhooks and are responsible for processing in the receiving system. External links, such as Telegram, PayPal or provider information, transfer data only when you open them; the third party's notices then apply.
15. Audience measurement
We use the cookieless Umami analytics software through a same-origin integration. It creates no personal user profiles; we operate the software and database ourselves on the infrastructure in section 4. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in aggregate analysis and improvement of the platform.
16. Backups
To ensure availability, we create encrypted backups on infrastructure we own. They are used only for disaster recovery, are not accessible in normal operation and are deleted within 35 days. If a backup is restored, deletions made since that backup and expired retention periods are automatically reapplied before service resumes.
17. Retention and deletion
Where no specific period is stated above, we keep data only while required for its purpose or a legal obligation. Account data remains until self-service deletion or other termination. We then erase or irreversibly anonymise all personal data linked to the account; non-personal status and quantity data may remain. adiuto neither processes payments nor issues donation or tax receipts, so there are currently no corresponding tax or commercial retention records.
18. Your rights
Subject to the statutory requirements, your rights include:
- access (Article 15 GDPR),
- rectification (Article 16 GDPR),
- erasure (Article 17 GDPR),
- restriction (Article 18 GDPR),
- data portability (Article 20 GDPR),
- objection to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR),
- withdrawal of consent for the future (Article 7(3) GDPR).
You may also complain to a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the alleged infringement (Article 77 GDPR).
19. Changes
We update this policy when our processing or the law changes. The version published on the platform applies.