OWNAMIC – Privacy Policy

1. Introduction

Ownamic UG (limited liability) (hereinafter also referred to as "Ownamic," "we," "us," or "our") operates the OWNAMIC application in the form of a mobile app and, where applicable, supplementary web services (hereinafter collectively referred to as the "Services"). The application allows private individuals to digitally inventory, photograph, organize, and analyze tangible assets using AI-powered features.

This Privacy Policy describes how we process personal data in connection with your use of our Services. This Privacy Policy specifically takes into account the requirements of the General Data Protection Regulation (GDPR) as well as other applicable data protection laws in the countries where our Services are offered or used, including certain data protection laws in the United States.

This Privacy Policy applies to all persons using our Services worldwide. In particular, it explains:

• what personal data we process,
• for what purposes we process it,
• on what basis the processing takes place,
• which third parties are involved,
• how long data is stored,
• whether data is transferred to third countries, and
• what rights you have.

To the extent that our Services contain links to third-party websites or applications, only the privacy notices of those third parties shall apply to them. We have no control over the data processing carried out by such third parties.

2. Controller

The controller within the meaning of Art. 4 No. 7 GDPR is:

Commercial Register: Amtsgericht Hanau, HRB 101361 | VAT ID: DE464583791 | Represented by: Dr. Adrian Vogel

A data protection officer has not currently been appointed. Data protection inquiries may be sent to the email address stated above.

3. Processing Activities

Below, we provide information on the individual processing activities, grouped according to their respective purposes. Within each processing activity, we identify the categories of data processed, the relevant basis for the processing, any recipients or involved third parties, and the storage period.

3.1 Technical Operation and Provision of the Services

We process personal data in order to ensure the technical provision of the Services, the stability and security of the system, and the use of the application.

Categories of data processed

• IP address
• date and time of access
• accessed content and URLs
• HTTP status codes
• amount of data transferred
• device and system information, e.g. operating system, app version, device type
• a pseudonymous daily visitor key for anonymous reach measurement, derived from the IP address and browser information by means of a keyed hash whose secret is regenerated every day and never stored; the IP address itself is not stored

Basis of processing

The processing is carried out to ensure the secure, functional, and stable operation of the Services. Where the GDPR applies, the processing is based on Art. 6(1)(f) GDPR.

For anonymous reach measurement (which pages are visited and in which order), we derive a visitor key from the IP address and the browser identifier using a secret that exists only in the server's memory and is replaced every day. Neither the IP address nor the browser identifier is stored, no cookie is set, and no information is stored on or read from your device. Once the daily secret has been replaced, the key can no longer be linked to you or to your later visits. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in understanding how our website is used).

When you click “Continue” or “Continue with Google” in a registration box, we count that click in the same anonymous way, together with a code for the page the box was on (e.g. “blog-doestaedning”) – without the e-mail address you entered. In the same way we count the steps of a sign-in – a code requested, a code entered correctly, a sign-in with a passkey – with the page code the sign-in link carried, but without the e-mail address and without any link to your account. If a registration fails (for example because a service cannot be reached or a confirmation code has expired), we store the time, the step, the reason, the page code and the daily visitor key so that we can fix the problem – but no e-mail address. These entries are deleted after 30 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a registration that works and in understanding which content helps people get started.

Visitor question: if you reach us through a campaign link from one of our YouTube videos (recognisable by the utm_source tag in the link), you will see a short, voluntary question once, after about 30 seconds on a page – for example, what is holding you back from trying OWNAMIC. Whether and when the question appears is determined by our server solely from the existing connection to your browser and the campaign tag in the link; no information is read from your device for this. So that the question does not appear again, your browser notes in the tab's session storage (sessionStorage) that it has already been shown; this value is not transmitted to us and is deleted when you close the tab (Section 25(2) no. 2 TDDDG). We count anonymously on which page the question was shown, answered or closed and – in steps of 10 seconds, up to five minutes – how long the visit stayed on its landing page while the connection lasted, and whether there was a first interaction during the visit (a decision in the cookie banner, a click on a link of our website, an answer to the question) – recognised only by actions our server processes anyway, not by scrolling, tapping or tab visibility –, and store the answer you tapped together with the link's campaign tags, the coarse browser family (such as "Chrome/Android") and the referring website (its domain only, such as "m.youtube.com") – without an IP address, visitor key, user account or any other identifier. An answer written in your own words is stored separately and without any link to these counts; e-mail addresses, links and longer sequences of digits are removed automatically before storage. Please do not enter any personal data there. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in improving our offer based on voluntary feedback). Answers in your own words are deleted after 180 days, the anonymous counts after 365 days.

Cookie banner decisions: which button you choose in the cookie banner ("Allow", "Decline" or, under "Details", "Save selection") is counted anonymously – together with the page you decided on and the campaign tags (utm parameters) of the link your visit began with. No further cookie is set for this, nothing is read from your device and no IP address, identifier or browser information is stored. Your actual decision stays in the consent cookie as described. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in understanding how the banner is used); the counts are deleted after 365 days.

Taps on the landing page (without consent, anonymous): if you reach us through a campaign link (utm parameters) or from a search engine and are not signed in, our server counts, on the page where your visit began – in sections of 10 seconds, up to five minutes –, which of our own controls you tapped (such as "Pricing: monthly/yearly" or a link to another page of our website), your decision in the cookie banner and your answer to the visitor question, and derives from this the section of the page you reached at least. Only actions our server processes anyway to carry out the function in question are recorded; nothing is read from or stored on your device for this – no scrolling, no mouse movements, no input. One row per visit is stored with the page, the link's campaign tags, the coarse browser family, the domain of the referring website, country and network type – without an IP address, visitor key, user account or any other identifier. It is only evaluated in aggregate per campaign and page; groups of fewer than five visits are not shown individually. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in understanding which parts of our landing pages are used). The rows are deleted after 365 days.

Interactions on the landing page (only with your consent): if you are not signed in, reached us through a campaign link (utm parameters) or from a search engine and agreed to analytics in the cookie banner ("Allow"), a script on the page where your visit began records, in sections of 10 seconds (up to five minutes), how often you point at links, buttons or fields with the mouse (hover), tap or click and select fields (focus), which elements these were – named by the label our page gives them, such as "Button „Start for free“ · Pricing", never with what you enter – and how far down you scrolled the page at most (in percent). No mouse movements or coordinates, no keystrokes, no field contents. Our server fetches these values every 10 seconds over the connection that is open anyway; nothing is stored on your device for this. They are stored together with the page, the link's campaign tags, the coarse browser family, the domain of the referring website, country and network type, a random identifier of the visit and the daily changing visitor key of our reach measurement (see above), so that we can relate them to the anonymous page sequence of the same day – without an IP address and without a user account. The purpose is to understand which parts of our landing pages visitors use and where they drop off. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time via "Cookie Preferences"; recording then stops immediately and the data of your visit and of your visitor key of the same day are deleted. Older data can no longer be attributed to you once the daily key has changed. Like the anonymous page views, the data are deleted after 365 days; the visitor key and the visit identifier are removed after 90 days.

Country and network type: From the IP address of a page request, our own server determines the country (country code, e.g. "DE") and whether the address belongs to a data centre, a cloud provider, Google's checking services or Apple's iCloud Private Relay (e.g. "aws", "hosting", "relay"). To do so, we compare it with locally stored, publicly available lists (the address ranges published by the providers and the country and network-operator databases of DB-IP); the IP address is not transmitted to anyone and not stored. Only the country code and the network type are stored, without any reference to you, together with the other anonymous counts. The purpose is to recognise automated requests and to keep our reach measurement accurate. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in accurate usage figures and in defending against automated requests, cf. Recital 49 GDPR).

Free scan without registration: If you use the free scan on one of our landing or tool pages, we send your photo to an AI service (Google AI API), which recognises the items on it; we do not store the photo. So that every visitor gets the scan once, we set a cookie with a random identifier in your browser, whose hash we keep for 365 days. We also store on our server a hash of your IP address, for 24 hours for IPv4 and for 30 days for IPv6 (its network prefix); addresses of iCloud Private Relay are exempt. Both hashes are formed with a secret key; without it, no IP address can be calculated back from a hash. Until you register, the result and your photo stay only in your browser tab's session storage. The legal basis is our legitimate interest in protecting a free but cost-incurring service against misuse (Art. 6(1)(f) GDPR).

IP Geolocation by DB-IP (CC BY 4.0)

Recipients / integrated third parties

• Hostinger International Ltd. as provider of VPS hosting, server location: Frankfurt am Main, Germany
• Microsoft Ireland Operations Ltd. / Azure Storage for encrypted storage of files and content, storage location: Frankfurt am Main, Germany

Storage period

Server log data is generally deleted no later than 30 days after collection, unless longer retention is required in individual cases for technical reasons.

3.2 Registration and User Account

We process personal data in order to create a user account, enable login, and manage the account.

Categories of data processed

• email address
• sign-in and confirmation codes sent by e-mail (stored exclusively as a hash value and overwritten by the next code); a password set before October 2026 is deleted after the switch to sign-in by code
• registration timestamp
• sign-in and account status data, including your signed-in devices: browser and operating-system family, the country of the sign-in (not the IP address), the time of the sign-in and of the last use, and a random device identifier. Signed-out sessions and sessions unused for 60 days are deleted after 180 days at the latest.
• optional display name / username
• origin of the registration: the page through which you registered (e.g. a blog post, a tool or a topic page), the way of registering (e-mail or Google), the time of confirmation and the time you created your first object

Basis of processing

The processing is carried out to perform the user relationship and to provide functions requiring registration. Where the GDPR applies, the processing is based on Art. 6(1)(b) GDPR.

We process the information on the origin of the registration on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is to understand which of our content helps people get started and to shape our offering accordingly. The information is deleted together with your account. You can object to this processing at any time (Art. 21 GDPR); an informal message to us is sufficient.

Recipients / integrated third parties

• Hostinger International Ltd. (application hosting)
• Microsoft Azure Storage (encrypted data storage in Frankfurt)

Storage period

The data is stored for as long as the user account exists and is deleted without undue delay when the account is deleted. It may remain in our encrypted database backups for up to 30 days longer; if a backup is restored, we carry out the deletion again. Statutory retention obligations remain unaffected.

3.3 Sign-in via Google (Google Login)

We optionally offer you the possibility to sign in or register using your Google account.

You can also start the Google sign-in directly from blog posts, tools and topic pages. A connection to Google is only made when you click “Continue with Google”: before that, no Google scripts are loaded on our pages and no data is transmitted to Google.

Categories of data processed

• Google account ID
• email address
• where applicable, display name
• where applicable, profile picture as provided by Google

Basis of processing

The processing is carried out to provide the login function requested by you. Where the GDPR applies, the processing is based on Art. 6(1)(b) GDPR.

Recipients / integrated third parties

• Google LLC / Google Identity Services

Google processes the data generated in connection with the authentication process under its own data protection responsibility. Google's privacy policy also applies: https://policies.google.com/privacy

Storage period

The basic data transmitted by Google is stored for the duration of account use and is generally deleted within 30 days after account deletion, unless statutory obligations prevent deletion.

3.4 AI-Supported Image Analysis and Asset Identification

The application allows the analysis of uploaded images in order to automatically recognize, categorize, describe, and support value-related assessments of items.

Categories of data processed

• uploaded images
• metadata contained in images, where applicable
• analysis results derived from the images
• additional user input relating to the respective item

Basis of processing

The processing is carried out to provide the contractually owed core functionality. Where the GDPR applies, the processing is based on Art. 6(1)(b) GDPR. If, in exceptional cases, special categories of personal data are visible in images and their processing becomes relevant, consent may additionally be required.

Recipients / integrated third parties

• Google Ireland Limited – Gemini Enterprise Agent Platform to perform the AI-supported analysis
• Microsoft Azure Storage for encrypted storage of image files and analysis results in Frankfurt

Note regarding the AI provider

According to the information available, inputs, files, and responses processed under the Google Ireland Limited – Gemini Enterprise Agent Platform service are processed on servers within Europe (EEA) and are not used to train Google's models. However, Google may temporarily log inputs and outputs for security and abuse prevention purposes.

Storage period

Images, documents, scans and analysis results are stored encrypted for as long as the account is in use and are deleted without undue delay when the account is deleted, unless statutory retention obligations apply.

3.5 AI-Supported Assistant

The app provides an AI-powered assistant that allows users to ask questions in natural language about the items in their inventory and retrieve information.

Categories of data processed

• user text inputs
• conversation content
• contextual data from the user account, insofar as required to process the request
• generated responses

Basis of processing

The processing is carried out to provide the requested function. Where the GDPR applies, the processing is based on Art. 6(1)(b) GDPR.

Recipients / integrated third parties

• Google Ireland Limited – Gemini Enterprise Agent Platform
• Microsoft Azure Storage for storing relevant content in Frankfurt

Note

Please do not enter sensitive personal data into the AI assistant unless this is necessary for the use of the application.

Storage period

Conversation data is stored encrypted, generally for the duration of use but for no longer than 12 months; older messages are deleted automatically. It is deleted without undue delay when you delete your account.

3.6 Payment Processing

We process data for the purpose of handling paid services and subscriptions.

Categories of data processed

• billing data
• transaction data
• payment status
• where applicable, partial information regarding the payment method used

Basis of processing

The processing is carried out to perform the contractual relationship and to comply with statutory retention obligations. Where the GDPR applies, the processing is based on Art. 6(1)(b) and (c) GDPR.

Recipients / integrated third parties

• Stripe Payments Europe, Ltd. as payment service provider

We do not store complete credit card data on our own servers. Payment processing is carried out by Stripe in accordance with its own privacy policy: https://stripe.com/privacy

Storage period

Billing and transaction data is retained for 10 years in accordance with statutory retention obligations.

3.7 Handling Support Requests

We process personal data in order to handle user inquiries, provide technical support, and clarify issues relating to our Services.

Categories of data processed

• email address
• name or user identifier, where provided
• content of the request
• communication and case-related data
• where applicable, technical information you provide to us for error analysis

Basis of processing

The processing is carried out to handle your request and provide support services. Where the GDPR applies, the processing is based on Art. 6(1)(b) GDPR and, where necessary, on Art. 6(1)(f) GDPR.

Recipients / integrated third parties

Where an external email or support service provider is used, such provider will act as a processor.

Storage period

Support requests and related communication data are generally stored for up to 3 years after completion of the matter, unless longer retention is required for legal defense purposes or due to statutory obligations.

3.8 Transactional Communication

We process personal data in order to send you transactional communications relating to your account and your use of the Services, in particular registration confirmations, sign-in codes and security notices about your account.

Categories of data processed

• email address
• sending and delivery information
• time and content of the message

Basis of processing

The processing is carried out to perform the user relationship and provide essential communication functions. Where the GDPR applies, the processing is based on Art. 6(1)(b) GDPR.

Recipients / integrated third parties

• Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (e-mail delivery via Microsoft Exchange Online)

The e-mail service provider acts as our processor. For notices whose dispatch we have to be able to evidence – such as confirmations of cancellations, withdrawals, subscriptions and contract changes – we keep a copy in our mailbox. We keep no copy of e-mails containing confirmation codes or password-reset links.

Storage period

Data relating to data transmission and logs is generally deleted after 6 months, unless a longer retention period is required.

3.9 Object Transfer (Digital Handover)

We process personal data to allow you to digitally transfer the documentation of items, including their attached files and maintenance history, to other users via a transfer link.

Categories of data processed

• Item metadata and factual historical data (e.g., maintenance logs, purchase dates)
• Associated documents (e.g., invoices, receipts) which may contain personal data of the transferring user or third parties
• Transfer link and status data
• Audit log entries related to the transfer

Basis of processing

The transmission of the item history and associated documents to the receiving user is based on your explicit consent. Where the GDPR applies, the processing is based on Art. 6(1)(a) GDPR.

Recipients / integrated third parties

• The receiving user (new owner of the item)

Storage period

The immutable audit log of the transferred item retains the factual history to prevent fraud and ensure provenance. However, upon completion of the transfer or upon deletion of your account, any personal data identifying you as the transferring user is anonymized or removed from the log.

3.10 Shared Spaces (Shared View of Objects)

We process personal data to enable you to make selected objects or collections visible within a shared area (a “Shared Space”) to a limited number of users you have invited, and to evaluate them together there. Ownership of your objects remains entirely with you; other members can neither modify, delete, nor export your objects.

Categories of data processed

• Name, category, condition and images of the objects you contribute
• Free-text entries you provide (e.g. description, place of purchase) that may contain information about other individuals
• Value and financial data of your objects – only if you have separately enabled this for your membership
• Membership data: display name or a display label you choose, join date, time of last access
• Invitation data: invitation token, validity period, status
• Log entries relating to joining, leaving, contributing and removing objects, and to configuration changes
• Events (without attachments), voice messages, the “Intended for” note and the status derived from the events (e.g. lent out, sold) of your objects – only if the Shared Space offers this and you show it for your contribution

Documents, receipts and the object history are not shown within a Shared Space.

Basis of processing

Making your objects visible to other members is based on your explicit consent (Art. 6(1)(a) GDPR). Consent is given separately for (i) each object or collection you contribute, (ii) the disclosure of your value and financial data and (iii) showing events, voice messages, the “Intended for” note and the status.

You can withdraw each of these consents at any time with effect for the future by removing the respective contribution, disabling the disclosure of financial data or the display of events, voice messages, “Intended for” or status, or leaving the Shared Space. Withdrawal takes effect immediately; the lawfulness of processing carried out up to that point remains unaffected.

The operation of the Shared Space as such (membership management, invitations, logging) is carried out to perform the user agreement (Art. 6(1)(b) GDPR).

Recipients / integrated third parties

• The other members of the respective Shared Space (at most four further individuals)

No transfer to other third parties takes place. Members cannot in turn authorize other individuals to access your objects.

Storage period

Contributed objects remain visible to the other members until you remove the contribution, leave the Shared Space, or it is dissolved. Visibility then ends immediately; your objects themselves remain unchanged in your inventory.

Invitations that are not accepted are deleted after their validity expires plus a subsequent period of 30 days. Log entries relating to Shared Spaces are deleted after 24 months. If your account is deleted, all data identifying you in other members’ logs is anonymized or removed.

Note on the disclosure of financial data

If several members have disclosed their value data, these are combined into shared metrics. From such a metric and their own values, a member can infer the sum of the values of the other contributing members. If exactly two members have disclosed their values, the total value of the respective other member is thereby precisely identifiable.

Note on information about other individuals

Free-text fields may contain information about other individuals (e.g. names of tradespeople, sellers or landlords). This information is shown to the other members. Before contributing, please check whether your entries contain such data.

3.11 Surveys

Where we conduct surveys to improve our Services, we process personal data for the purpose of conducting, evaluating, and following up on such surveys.

Categories of data processed

• contact data, insofar as used for the survey invitation
• survey content and responses
• voluntarily provided additional information

Basis of processing

Participation in surveys is generally voluntary. Where the GDPR applies, the processing is regularly based on Art. 6(1)(a) GDPR or, where user surveys are conducted to further develop our Services, on Art. 6(1)(f) GDPR.

Recipients / integrated third parties

Where we use external tools or service providers for surveys, they will be engaged as processors.

Storage period

Personal survey data is stored only for as long as necessary for carrying out and evaluating the survey. It is then deleted or anonymized.

3.12 Analytics and Evaluation of User Behavior

We process usage data in order to analyze and further develop the functionality, usability, and performance of our Services.

Categories of data processed

• usage and interaction data
• information on functions accessed
• session and event data
• technical device and connection data
• aggregated or anonymized evaluation data

Basis of processing

Where the evaluation is based exclusively on anonymized data, no personal data is processed. To the extent that personal or pseudonymized usage data is processed in individual cases, such processing is carried out depending on the specific setup for the optimization of our Services. Where the GDPR applies, such processing is then based on Art. 6(1)(f) GDPR or, where legally required, on consent pursuant to Art. 6(1)(a) GDPR.

Recipients / integrated third parties

At present, the evaluation is carried out via an internal analytics dashboard. No third-party analytics tools are currently used.

Storage period

Personal or pseudonymized usage data is stored only for as long as necessary for analytics and optimization purposes. Anonymized evaluations may be stored permanently.

3.13 Marketing, in particular Google Ads Conversion Tracking

We process personal data in order to measure the reach and effectiveness of our marketing activities and to promote our Services in a targeted manner.

Categories of data processed

• usage and event data
• technical device and browser data
• IP address or shortened IP address, where technically applicable
• information on whether users accessed our Services via advertisements or performed specific actions there

Basis of processing

Marketing-related tracking and conversion measurement are carried out only where any legally required consent has been obtained. Where the GDPR applies, the processing is based on Art. 6(1)(a) GDPR and on the applicable provisions protecting terminal equipment, in particular Section 25 TDDDG.

Recipients / integrated third parties

• Google Ireland Limited / Google LLC in connection with Google Ads Conversion Tracking

Storage period

The storage period depends on the specific technical implementation and the settings of the service used. Consent-based marketing data is stored only to the extent necessary and for the respective intended purposes.

3.14 Protection Against Automated Access / CAPTCHA

We use protective mechanisms to safeguard our Services against automated access, misuse, and spam, in particular in connection with registration and login.

Categories of data processed

• IP address
• technical connection data
• interaction data to distinguish human from automated use

Basis of processing

The processing is carried out for the security and integrity of the Services. Where the GDPR applies, the processing is based on Art. 6(1)(f) GDPR.

Recipients / integrated third parties

• PrivateCaptcha (https://privatecaptcha.com) – Intmaker OU, registration code 16430441, registered at Parnu mnt 139b, Tallinn, Harjumaa, Estonia, 11317

Storage period

Processing takes place on a session basis; data is generally stored only for as long as technically necessary.

3.15 Embedded Videos (YouTube)

Our home page, some of our topic pages and some of our blog posts embed videos from the YouTube platform. We use a two-click solution and YouTube's privacy-enhanced mode (youtube-nocookie.com) for this: the preview images are served from our own servers, and no connection to YouTube is made until you click one. Only once you click does your browser load the YouTube video player, and in doing so data is transmitted to YouTube or Google.

Categories of data processed

• IP address
• technical connection and device data (e.g. browser type, operating system, language setting)
• address of the referring page and time of access
• information about the playback of the video; once playback starts, YouTube may store or read cookies or similar technologies on your device

Basis of processing

The connection to YouTube is established solely on the basis of your consent, which you give by clicking the preview image. Where the GDPR applies, the processing is based on Art. 6(1)(a) GDPR and — where information on terminal equipment is accessed — on Section 25(1) TDDDG. The consent applies only to the page view in question; on your next visit the video again loads only after a click. You can withdraw it at any time by leaving or reloading the page.

Recipients / integrated third parties

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (operator of YouTube)

This may involve a transfer to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists. Further information can be found in Google's privacy policy: https://policies.google.com/privacy

Storage period

We ourselves do not store any data in connection with the video. We have no influence on how long YouTube or Google retains data; this is governed by Google's privacy policy.

3.16 Weather display

On request, the dashboard shows a weather forecast for your location; the AI assistant can also look up the weather for a place when you ask. Your location is only determined if you allow it in your browser or on your device. The request to the weather service is made by our server, so your IP address is not passed on to the weather service.

Categories of data processed

• location coordinates (latitude and longitude) or the place you name
• the weather data retrieved

Basis of processing

The processing serves to provide the feature you have called up. Where the GDPR applies, it is based on Art. 6(1)(b) GDPR. You can withdraw the location permission in your browser or on your device at any time.

Recipients / integrated third parties

• WeatherAPI.com (Apixu Ltd., United Kingdom); an adequacy decision of the European Commission exists for the United Kingdom

Storage period

We do not store your location; the weather data is used for display only.

3.17 Finder page and shared object history

Users can create public links for individual objects: a QR code for a finder page and a link to the object's history. Anyone who opens such a link does not need an account. Through the finder page, a person who has found an object can send the owner a message; we forward it by email without showing the owner's name or email address. If the finder gives their email address, the owner can answer through OWNAMIC: we forward the answers in both directions, so that neither side learns the other's email address unless they write it into a message themselves. The owner can report the object missing; the finder page then says so. The shared object history shows the name, photos and selected events of an object, but never prices, costs or valuations.

Categories of data processed

• for messages through the finder page: your message (including anything you write about where you found the object) and any phone number or other contact you choose to give
• IP address, only temporarily in memory to limit the number of messages
• time of the last visit and number of visits of a link, without reference to the visitor
• if you give your email address: the address, stored encrypted, and check values (hashes) of the reply links, so that answers can be forwarded to you; the answers themselves are not stored

Basis of processing

A message is forwarded at your request and serves to return the found object; the legal basis is Art. 6(1)(f) GDPR (the owner's legitimate interest and your interest in the return). The finder page and the object history are provided to perform the user agreement with the owner (Art. 6(1)(b) GDPR).

Recipients / integrated third parties

• the owner of the object, who receives your message and any phone number or other contact you chose to give by email – not your email address; we forward answers through OWNAMIC, so you do not learn the owner's address either
• the email delivery service we use, as a processor

Storage period

We do not store messages from finders or answers; they are only delivered by email. Links in messages are removed before delivery. If you give your email address, we store it encrypted so that answers can be forwarded, and delete it 30 days after the last message, or earlier when the owner switches the finder page off or transfers the object. The IP address is not stored but used for at most one hour as a counter in memory. Links are stored only as a check value (hash); the owner can switch them off at any time, and they are switched off automatically when the object is transferred.

3.18 Measuring search ads (Google Ads, Microsoft Advertising)

We run search ads with Google and Microsoft (Bing). When you reach us through such an ad, the ad network appends a click ID to the address of our page (Google: "gclid", "gbraid" or "wbraid"; Microsoft: "msclkid"). We use no cookies, no local storage and no script of the ad networks for this: our server reads the ID from the requested address and keeps it in working memory for at most 24 hours without storing it. To match it to a later registration, it forms an encrypted check value from the network range of your IP address and your browser identifier; the IP address itself is not stored. Only if you have allowed "Ad measurement" in the cookie banner (with "Allow", or by selecting it under "Details") – or, if you have not answered that question there, tick the optional ad-measurement box when registering – do we store the ID with your account and, once your registration is confirmed, send it together with the time to the ad network concerned, which counts that the ad led to a registration. Without your consent, nothing is sent.

Categories of data processed

• Click ID of the ad (gclid, gbraid, wbraid or msclkid)
• Time of the ad click and of the registration, a fixed conversion value
• Time of your consent (proof under Art. 7(1) GDPR)

Basis of processing

Storing the ID with your account and sending it to the ad network are based on your consent (Art. 6(1)(a) GDPR). Holding the ID briefly in working memory until you register is based on our legitimate interest in being able to offer you this choice (Art. 6(1)(f) GDPR). Consent is voluntary and not required for registering. You can withdraw it at any time with effect for the future; reopen the cookie banner (cookie button) and decline "Ad measurement", or send us an informal message; data not yet sent is then no longer transferred and is deleted. For processing by Google and Microsoft, please refer to their privacy policies.

Recipients / integrated third parties

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Ads, via the Google Data Manager API). Transfers to the USA are possible; Google is certified under the EU-US Data Privacy Framework.
• Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft Advertising). Transfers to the USA are possible; Microsoft is certified under the EU-US Data Privacy Framework.

Storage period

Without consent: at most 24 hours in working memory, never stored. With consent: the click ID is deleted as soon as the transfer has succeeded or has finally failed; the transfer record after 30 days, at the latest together with your account. Registrations that are never confirmed are not sent.

4. Cookies

Our Services use cookies and similar technologies, in particular for technical provision, security, and where activated for analytics or marketing purposes.

4.1 Technically Necessary Cookies

We use technically necessary cookies and comparable storage technologies in order to:

• manage user logins and sessions,
• provide security functions,
• ensure the stability and integrity of the Services.
• Sign-in and registration cookies “ow_signup” and “ow_pending”: they keep the e-mail address you entered encrypted for the next step of the registration, the e-mail confirmation or the sign-in by code, so that it does not appear in the address bar; for a sign-in, “ow_pending” also holds a random identifier that binds the code to this browser (15 and 30 minutes respectively, only under /account). The cookie “ownamic_device” holds a random, encrypted device identifier (400 days) so that we can tell your signed-in devices apart, warn you by e-mail about a sign-in from a new device and apply the passkey confirmation per device.

Basis of processing

Where the GDPR applies, the subsequent processing of personal data is based on Art. 6(1)(f) GDPR. Where access to information on your terminal device is involved, such access is based on the applicable provisions protecting terminal equipment, in particular Section 25(2) TDDDG.

Storage period

Depending on the function, until the end of the session or for a limited period insofar as technically necessary.

4.2 Your Settings Options

You can manage, restrict, or delete cookies and comparable technologies through your browser or device settings. Please note that this may impair the functionality of the Services.

We currently do not honor general browser Do Not Track (DNT) signals. Where required by applicable law, technical Global Privacy Control (GPC) signals may be taken into account.

4.3 Consent Management / Management of Consent Settings

When we use cookies, analytics tools, or marketing technologies that require consent, we use a consent management process. This allows us to record, store, and keep track of your choices regarding specific categories of technologies. We process this information to document your consent decisions, respect your preferences during subsequent visits or uses, enable only the technologies you have approved, and comply with our legal accountability and documentation obligations.

Categories of data processed

• information on whether and to which categories you have consented or objected
• time of consent or refusal
• technical proof data for documenting the consent decision
• where applicable, pseudonymous identifiers as well as device or browser information
• where applicable, IP address in shortened or technically processed form

Basis of processing

The processing is carried out for the administration and documentation of your consent decisions. Where the GDPR applies, it is based on Art. 6(1)(c) GDPR and, additionally, on Art. 6(1)(f) GDPR. Where access to information on your terminal device is involved, the applicable provisions protecting terminal equipment also apply, in particular Section 25 TDDDG.

Recipients / integrated third parties

The management of consent settings is currently carried out via the technical functionality integrated into our Services. No external consent management service provider is currently used.

Storage period

Consent decisions and related proof data are stored only for as long as necessary to respect your settings and ensure data protection documentation.

5. International Data Transfers

Ownamic generally hosts and stores data in Frankfurt am Main, Germany, in particular via Hostinger VPS and Azure Storage.

However, for certain features we use services from providers where personal data may also be processed outside the EU or EEA, in particular in the United States or other countries with globally distributed server locations. Conversely, data processing for our AI image analysis and the AI assistant (Agent Platform) is conducted on servers within the European Union (or EEA), meaning no third-country transfer occurs for these services.

This applies in particular to:

• Google Identity Services for Google Login
• where applicable, Google Ads Conversion Tracking, insofar as this function is activated
• WeatherAPI.com in the United Kingdom for the weather display; an adequacy decision of the European Commission exists for this

Where personal data is transferred to third countries, we rely on appropriate safeguards, in particular:

• the EU-U.S. Data Privacy Framework, UK-U.S. Data Bridge, Swiss-U.S. Data Privacy Framework where applicable, and
• Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

6. Data Subject Rights

Depending on your place of residence and the applicable data protection law, you may in particular have the following rights:

• access to the personal data we process about you
• rectification of inaccurate or incomplete data
• erasure of your personal data
• restriction of processing
• data portability
• objection to certain data processing activities
• withdrawal of consents with effect for the future
• complaint to a competent supervisory authority

Where the GDPR applies, these rights arise in particular from Art. 15 to 21 GDPR and Art. 77 GDPR.

If you are located in the European Union, you may in particular contact the supervisory authority responsible for Ownamic.

To the extent that rights under the laws of other countries apply to you, in particular under the CCPA/CPRA or comparable U.S. state privacy laws, you may also exercise such rights against us, including rights of access, correction, deletion, and where provided by law, objection to certain data uses.

Ownamic does not sell personal data.

To exercise your rights, simply contact us at: info@ownamic.com

7. Minors

Our Services are not intended for persons under the age of 18. We do not knowingly collect personal data from children under 18. If you believe that a child under 18 has provided us with personal data, please contact us at info@ownamic.com. We will review the matter and, where appropriate, delete the relevant data.

8. Account Deletion

If you wish to request deletion of your user account, you may do so:

• within the application via the account settings, insofar as such functionality is provided, or
• by email to info@ownamic.com

Upon receipt of your request, we will review the request and delete your account and the personal data associated with it, unless statutory retention obligations prevent deletion.

9. AI features and how AI content is marked

Several OWNAMIC features use artificial intelligence. They run on Google Gemini; your inputs are sent to that provider for processing. The AI features are:

• Item capture, valuation and revaluation — recognises objects in your photos and in a video walkthrough, estimates values and refreshes them in scheduled revaluations, including research on the open web.
• OWNY Studio — generates new images of your items and removes backgrounds.
• OWNY News — writes headlines and summaries about topics related to your items, based on published reporting.
• Daily Insights, Object Stories, collection profile and the daily knowledge check — generate descriptive text.
• AI-Assistant OWNY — answers your questions, optionally searching the web, and suggests next steps and storage locations in Smart Actions and in sorting with OWNY.

AI-generated images are marked in two ways: visibly, with the European Commission's AI label shown on the picture and in the app, and machine-readably, with an IPTC "digital source type" written into the image file so other tools can detect it. AI-written text carries a notice on the surface where it appears, and in exported documents. These markings stay with the file when you export or share it.

AI results can be wrong and are not legal, financial or medical advice. Photos you take are stored with their capture time; the location is only recorded if you switch that setting on.

10. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy from time to time, in particular where changes are made to our Services, the technical systems used, the legal framework, or the processing of data.

The current version will be made available in the app and/or on the related online offerings. In the event of material changes, we will inform you separately in accordance with legal requirements.