Privacy Policy – GardenPilot

Version: privacy-b2c-2026-10-v8
Effective: upon publication
Language version: English

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

PUENJER, S.L.U.
Avinguda Mèxic 17
07007 Palma de Mallorca
Spain
Tax number (NIF): B22974018
Email: support@gardenpilot.de
Represented by: Fin Pünjer, sole director (administrador único)

2. Principles of processing

GardenPilot processes personal data only for specified purposes and only to the extent necessary to provide the platform, perform a contract, maintain security, comply with legal obligations or – following your consent – carry out marketing. In addition, we process comments on posts of our Instagram profile and direct messages to this profile in order to reply to them and to moderate comments (section 18).

GardenPilot uses cloud, payment, email and AI service providers. The providers actually used and their purposes are listed in our current Provider and Subprocessor Register.

Which information is required for registration, a purchase or a requested function is indicated by the relevant input form. If data required to create an account, conclude a contract, process a payment or provide the requested service is not provided, the relevant function or contract may not be available or capable of being concluded. Voluntary information may be omitted.

Choosing the German or English language version determines only the language of the interface and of the relevant contractual/information version. It is not automatically treated as a statement about residence, billing country or another target market.

3. Website access and technical delivery

When GardenPilot is accessed, technically required access data is processed. This may include in particular:

  • IP address,
  • date and time of access,
  • requested address or resource,
  • referrer,
  • browser and device information,
  • technical request, error and security data.

Processing is carried out to deliver GardenPilot technically, ensure availability and security, analyse errors and detect and prevent automated, fraudulent or abusive access.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and abuse-resistant operation of the platform.

Where full IP addresses are stored in GardenPilot's own technical security or server logs, they are generally deleted no later than after 14 days. Longer retention occurs only where a specific security incident makes it necessary; in that case further retention is limited to the necessary scope and period.

Infrastructure and security providers may process their own technical logs under their contractually agreed retention periods. Details are set out in the Provider Register.

4. Internal usage statistics

GardenPilot creates internal statistics to understand reach, technical quality and product usage. The data processed may in particular include:

  • page or screen view,
  • timestamp,
  • broad device type and browser category,
  • referrer domain,
  • technical product or funnel events,
  • country where lawfully collected, and internal market metadata where required for the relevant transaction.

For long-term internal usage statistics, GardenPilot does not store a full IP address as a persistent analytics identifier.

Where an IP address is temporarily required to exclude bots, filter GardenPilot's own traffic or deduplicate events within a limited time window, it is used only during the technical processing or transformed into a short-lived pseudonymous identifier. The identifier is deleted after the required window or rendered unusable by key rotation.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interests are data-minimising reach, function and quality analysis and the prevention of obviously distorted statistical values.

These internal statistics are not used to create individual movement or interest profiles over months based on an IP address.

5. Registration, login and user account

When a user account is registered and used, we process in particular:

  • first and last name, where provided or required,
  • email address,
  • a cryptographic password hash; the password itself is not stored in plaintext,
  • user ID and account status,
  • language and, where separately collected, country or market information,
  • account and security events,
  • information about Credit balances, orders and functions used.

Legal basis: Article 6(1)(b) GDPR where the data is required for the account and contract performance.

Security and abuse data is processed on the basis of Article 6(1)(f) GDPR. Our legitimate interest is protecting users, accounts and the platform against abuse and fraud.

6. Projects, photographs, text and other inputs

Depending on the function, when you use GardenPilot we process in particular:

  • garden and property photographs,
  • text, wishes and preferences entered by you,
  • postal code, country and location information provided by you,
  • project, concept and planning data,
  • generated images, text, planning materials and other results,
  • chat and assistant content.

Legal basis: Article 6(1)(b) GDPR where processing is necessary to provide the GardenPilot service you requested.

Please avoid uploading unnecessary third-party personal data. Photographs with clearly identifiable persons, vehicle registration plates, house numbers or other identifying features should be used only where you have a sufficient legal basis to do so.

7. AI functions and external AI providers

GardenPilot uses specialised AI services for different functions. Depending on the function, text, project information or garden photographs may be transmitted to one or more AI providers.

We transmit only data required for the function requested in each case.

GardenPilot does not use your personal project and content data to train its own general-purpose AI models.

External AI services are used through business, API or cloud products. The rules applicable to the particular service concerning training, short-term security/abuse logs, processing regions and international transfers depend on the specific provider and product. The AI providers currently used in production and the documented conditions applicable to them are identified in the Provider Register.

Legal basis: Article 6(1)(b) GDPR where AI processing is required to provide the service you requested.

For comments on our Instagram posts and direct messages to our Instagram profile, this section applies only with regard to the AI providers used and their processing conditions; the purposes and legal basis are set out in section 18.

8. Automated quality and complaint assessment

GardenPilot may use automated AI systems to check generated content for identifiable technical or substantive defects or to pre-assess a user complaint.

This may involve processing the original garden photograph, the generated result, the project requirements and the reason for complaint provided by you.

Legal basis: Article 6(1)(b) GDPR where the assessment serves contract performance or complaint handling; additionally Article 6(1)(f) GDPR for abuse prevention and consistent quality control.

Under the current product design, GardenPilot does not make a solely automated decision that produces legal effects concerning you or similarly significantly affects you without the possibility of human review. If an automated complaint or quality assessment is adverse to you, you may request manual review by Support.

9. Payment processing

For paid services we use in particular Stripe.

The data processed may in particular include:

  • name,
  • email address,
  • billing address,
  • order and transaction data,
  • amount and currency,
  • payment status,
  • tax information required by law,
  • payment details entered directly with Stripe.

Legal bases: Article 6(1)(b) GDPR for contract and payment processing; Article 6(1)(c) GDPR where statutory tax, accounting or evidential obligations apply.

Stripe may act as an independent controller for certain processing steps based on its own legal obligations or purposes. The current role and transfer information is described in the Provider Register or in Stripe's privacy information.

10. Email communication

10.1 Contract and service emails

We send emails required for registration, login/security, payment processing, invoices, project status or other contract performance.

Legal basis: Article 6(1)(b) GDPR.

10.2 Voluntary reminders and marketing

Project reminders, newsletters or other marketing emails are sent only where an appropriate legal basis exists, in particular your consent.

Legal basis: Article 6(1)(a) GDPR where consent is used.

You may withdraw consent at any time with future effect.

10.3 Email delivery provider

GardenPilot may use Resend for technical email delivery. In particular, the recipient address and the content of the relevant email are processed.

11. Hosting, database, file storage and security

GardenPilot uses external infrastructure and cloud service providers in particular for web hosting/CDN, database and authentication, file storage, server/lambda functions and technical security.

According to the current Provider Register, these include in particular Cloudflare, Supabase and AWS.

Legal bases: Article 6(1)(b) GDPR where processing is required to provide the service; Article 6(1)(f) GDPR for security and stability purposes.

12. Cloudflare Turnstile / bot protection

GardenPilot uses Cloudflare Turnstile to detect automated or abusive requests and protect forms or support functions. Turnstile runs in invisible mode: you will normally not see a checkbox and do not have to solve a task; the check runs in the background when you send a message through the support chat on our contact page.

Technical network, browser and device information may be processed.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is protecting the platform and its users against automated abuse, spam and attacks.

Where Turnstile accesses or stores information on your terminal equipment, this takes place only under the conditions of the applicable rules governing terminal equipment.

13. Cookies, Local Storage and similar technologies

GardenPilot uses technically necessary cookies, Local Storage or similar technologies where required in particular for login, session management, security, language settings or an expressly requested function.

Where German law applies, access to or storage of information on your terminal equipment is governed in particular by Section 25 TDDDG. In all other cases, the applicable national rules on access to terminal equipment and implementation of ePrivacy requirements apply. Technically strictly necessary operations may be permissible without consent under those rules; non-essential marketing or tracking technologies are used only after the consent required in the relevant case has been obtained.

Before activating non-essential tracking technologies, we may ask you for consent through a consent interface.

You may change or withdraw consent at any time with future effect through the consent settings.

We store evidence of your consent decision where necessary to demonstrate compliance with legal requirements.

15. Google Ads

With your consent, we may use Google Ads to measure advertising performance and, where applicable, for remarketing.

Depending on the configuration, the data processed may in particular include technical browser/device data, IP address, page views, referrer, cookie or click identifiers and GardenPilot-defined conversion events.

Legal basis: Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG or the corresponding national provisions governing non-essential storage of or access to information on terminal equipment.

The technology is activated for marketing purposes only after the required consent has been obtained.

16. Meta Pixel

With your consent, we may use the Meta Pixel provided by Meta Platforms Ireland Limited to measure the success of advertising on Facebook and Instagram.

Depending on the configuration, the data processed may in particular include IP address, browser and device data, page/referrer, _fbp, where applicable fbclid, and GardenPilot-defined conversion events.

Under the configuration currently envisaged, GardenPilot does not transmit the content of your garden projects or chat messages through the Pixel.

Legal basis: Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG or the corresponding national provisions governing access to information on terminal equipment.

17. Microsoft Advertising / Bing UET

With your consent, we may use Microsoft Advertising / Bing UET for conversion measurement.

Depending on the configuration, the data processed may in particular include IP address, browser and device data, page views/referrer, UET cookie identifiers, where applicable msclkid, and technical names of funnel/conversion events.

Under the configuration currently envisaged, GardenPilot does not transmit the content of your garden projects or chat messages through UET.

Legal basis: Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG or the corresponding national provisions governing access to information on terminal equipment.

18. Our Instagram presence: comments and direct messages

18.1 Controller and role of Meta

Under the GardenPilot brand we operate the Instagram profile @gardenpilot.ai. Instagram is a service provided by Meta Platforms Ireland Limited (“Meta”). Meta is responsible for operating the platform and for the processing it carries out for its own purposes in doing so. Information on this, including the statistics Meta provides to operators of Instagram profiles, is available in Meta's Privacy Policy.

PUENJER, S.L.U. (section 1) is responsible for retrieving comments on our posts and direct messages to our profile through the official Instagram interface, storing them in our systems, and handling and replying to them.

18.2 What data we process and where it comes from

If you comment on one of our Instagram posts or send our profile a direct message, your communication is addressed to us. However, we do not receive it directly from you; we retrieve it through Meta's official Instagram interface and store it in our database (Supabase, server location Frankfurt am Main; see section 11). In doing so we process:

  • your Instagram username and the user identifier assigned by Instagram,
  • for comments, the text of your comment, its identifier and its time, the post you commented on and, where applicable, the comment you are replying to,
  • for direct messages, the text of your message, its identifier and its time, its assignment to the conversation with us and, where there is an attachment (such as an image, a voice message, a shared post or a story reference), only the information that an attachment is present and what type it is.

In the course of handling, the following data is also created on our side:

  • a categorisation of the individual comment or message by type of request (such as question, feedback, spam or abuse), language and need for action,
  • a draft reply and the handling status,
  • our reply, its time and who approved it.

From your Instagram profile we use only your username and your user identifier.

Please do not share sensitive information in public comments, and do not send us health, access or payment data by direct message either. For matters concerning your user account or payments, you can reach us at support@gardenpilot.de.

We process this data in order to

  • reply to comments on our posts and direct messages to us, in particular questions about our posts and about GardenPilot,
  • moderate comments, i.e. hide or delete spam and offensive or unlawful content,
  • keep a record of which comment or message has been handled and who approved a reply.

To improve our content, we use exclusively pure counts without any personal reference, such as how many questions a post prompted.

The categorisation always relates only to the individual comment or message. We do not combine categorisations per person and do not assess persons. We do not use the data for advertising and do not disclose it to third parties, apart from the service providers named in this section. We do not automatically link comments and messages to a GardenPilot user account; if you yourself give us details of your account in a message, we use them only to handle your request. We publish replies to comments as comments on Instagram, where they are publicly visible. We send replies to direct messages to you as a direct message.

Legal basis: For comments, Article 6(1)(f) GDPR. Our legitimate interest is to reply to questions and feedback on our posts and to keep our profile free of spam and infringing content. In our assessment, anyone commenting on a company's post expects the company to read, reply to and, where necessary, moderate the comment. For direct messages, Article 6(1)(b) GDPR where your message concerns a contract with us or pre-contractual steps, for example questions about our services, prices or your project; otherwise Article 6(1)(f) GDPR, based on our legitimate interest in replying to requests that reach us. Anyone sending a company a message expects the company to read and reply to it. In both cases we limit ourselves to the information required for this purpose and store it only briefly (section 18.5). On balance, we therefore consider that your interests do not override ours.

18.4 AI-assisted draft replies and human approval

In order to reply to comments and messages promptly and accurately, we have an external AI service prepare the categorisation and a draft reply. For this purpose we transmit:

  • the text of the comment or message and, where necessary for understanding, preceding comments or messages in the same thread,
  • content of the relevant post, such as the caption, images and the garden concept shown; for direct messages only where the message refers to one of our posts.

We do not transmit usernames or user identifiers as separate data. In addition, before transmission we remove @-mentions, email addresses and telephone numbers from the texts. Anything else a person writes in a comment or message, such as a first name, a place or details about their own garden, may remain in the transmitted text. We do not store the transmitted content in logs; only technical details such as the time, model and size of the request are logged.

Every draft reply is reviewed by a responsible person, amended where necessary and published or sent only after that person's approval. Replies are never published or sent automatically. Comments are likewise hidden or deleted only at the instigation of a human. No solely automated decision within the meaning of Article 22 GDPR takes place.

The AI services are used as processors under Article 28 GDPR. The providers used and the conditions applicable there to training, retention and processing region are identified in the Provider Register. Where data is processed outside the European Economic Area, the safeguards described in section 20 apply.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is to reply to a growing number of comments and messages promptly and with reliable expertise, for example plant questions about a garden concept shown; without drafts, this would not be possible in the same quality with reasonable effort. We limit the intrusion: the AI service receives only the comment or message, the necessary thread and, where applicable, the post, without usernames, identifiers or recognisable contact details; the providers are bound by contract; the content does not end up in our logs; and the draft has no effect in itself, because a human decides on every reply. In our assessment, it is within what commenters and senders of messages expect that companies use technical aids when replying. On balance, we consider that your interests do not override ours under these conditions.

18.5 Retention period

We store comments and the related handling data for as long as the comment exists on Instagram, but no longer than six months after the time of the comment; we do not import older comments. If a comment is missing in a fully successful synchronisation, we treat it as deleted on Instagram and delete our copy within 30 days. The categorisation, draft reply, our reply and the approval record are deleted together with the comment.

We store direct messages and the related handling data for no longer than six months after the time of the respective message; we do not import older messages. The categorisation, draft reply, our reply and the approval record are deleted together with the message.

Our database is backed up daily; these backups are overwritten after seven days. Until then, deleted data may still be contained in a backup. Retention by the AI providers is subject to the conditions identified in the Provider Register.

Longer, restricted retention takes place only where a specific incident, such as an infringing comment or a threatening message, requires it for the establishment, exercise or defence of legal claims. Pure counts without any personal reference remain unaffected.

18.6 Objection and your other rights

Where the processing of your comments and direct messages is based on Article 6(1)(f) GDPR, you may object to it at any time, under Article 21(1) GDPR, on grounds relating to your particular situation; an informal message to support@gardenpilot.de or a direct message to our profile, in each case stating your Instagram username, is sufficient. We will then delete the comments and messages of yours stored with us and will no longer import future ones into our systems, unless the processing serves the establishment, exercise or defence of legal claims. So that we can respect your objection permanently, we store in a block list only your Instagram user identifier and the date of the entry, for as long as we retrieve comments or messages.

You can delete your comment itself on Instagram at any time; we then delete our copy in accordance with section 18.5. Your other rights are set out in section 22, and your right to lodge a complaint with a supervisory authority in section 23.

19. Recipients and processors

Personal data is disclosed only to external recipients whose services are required for the relevant GardenPilot function.

Processors are bound by contract in accordance with Article 28 GDPR.

The current list of infrastructure, email, AI, payment and marketing providers used is published in the Provider and Subprocessor Register.

20. International transfers

Where personal data is processed outside the European Economic Area or made accessible from there, this takes place only under the statutory conditions.

Depending on the provider, the transfer may in particular be based on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the specific recipient is covered, Standard Contractual Clauses of the European Commission and, where appropriate, supplementary safeguards, or another lawful basis.

The basis used for the relevant provider is documented in the Provider Register. Further information on the safeguards used in each case and, where applicable, a means of obtaining a copy may be requested via support@gardenpilot.de or is linked in the Provider Register.

21. Retention periods

We retain personal data only for as long as required for the relevant purpose or justified by a statutory obligation or a necessary legal-defence purpose.

Technical server and security logs

GardenPilot's own full-IP server/security logs are generally deleted no later than after 14 days, unless a specific security incident requires longer documented retention.

Internal usage statistics

Long-term internal statistics do not contain a full IP address as a persistent user identifier. Short-lived pseudonyms used for bot filtering/deduplication are deleted after the required short time window or technically rendered unusable.

Account and profile data

For the duration of the active account. After account deletion, the data is removed from the operational system unless retention or legal-defence grounds prevent this.

Project photographs, inputs and generated content

Generally until the project or user account is deleted or the relevant purpose ceases to apply. Following a deletion request, operational media is not retained for years solely because of an abstract limitation period. Further restricted retention occurs only where required by specific statutory obligations or for the establishment, exercise or defence of specific legal claims.

Payment, invoice and tax data

For the applicable statutory retention period. Records falling within the EU One Stop Shop scheme may be subject to a retention period of ten years. Other Spanish commercial or tax obligations may provide for different periods.

For as long as required to comply with statutory evidential obligations and to establish, exercise or defend possible claims. Where the general Spanish civil limitation period is relevant, retention may generally be necessary for up to five years; different special periods, suspension or interruption remain unaffected.

Support and complaint data

For handling the matter and subsequently only for as long as required for evidential purposes, statutory retention or specific legal defence.

Instagram comments and direct messages

No longer than six months after the time of the comment or message, for comments earlier if deleted on Instagram; block list for objections only with user identifier and date. Details in sections 18.5 and 18.6.

For as long as GardenPilot relies on the consent and subsequently for as long as necessary to demonstrate its lawfulness.

After the relevant period has expired, data is deleted or, if it has been genuinely and irreversibly anonymised, used only in anonymised form.

22. Your rights

Subject to the GDPR, you have in particular the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent with future effect (Art. 7(3)).

Contact: support@gardenpilot.de

Where we process data on the basis of Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You have the right to object to direct marketing at any time.

23. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority.

For PUENJER, S.L.U., the relevant authority in Spain is in particular:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan 6
28001 Madrid
Spain
www.aepd.es

Under Article 77 GDPR, you may in particular also lodge a complaint with a competent supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

24. Data security

GardenPilot uses appropriate technical and organisational measures, in particular encrypted transmission, role-based access restrictions, protection of privileged access, security logging and measures provided by the cloud and infrastructure providers used.

25. Changes to this Privacy Policy

We update this Privacy Policy when processing purposes, technical operations, providers or legal requirements change.

Material changes are published as a new legal version. If personal data is to be further processed for a new purpose, we provide prior information where required by law. Where additional information or consent is legally required, it is provided or obtained before the relevant processing.