Privacy policy

1. Who is responsible and how to reach us

The controller responsible for processing your personal data is iBeekeeper UG (haftungsbeschränkt), represented by its managing director Marcel Gläser, Lessingstraße 4, 15345 Altlandsberg, Germany, phone +49 33438 151134, email: service@ibeekeeper.de.

For any questions about data protection and to exercise your rights, a message to service@ibeekeeper.de is sufficient. We have not appointed a data protection officer because we are not required to do so under Art. 37 GDPR and § 38 BDSG (German Federal Data Protection Act).

This notice applies to our website www.ibeekeeper.de, the web application webapp.ibeekeeper.de, the iBeekeeper apps for iOS and Android, the manufacturer portal, the supplier portal and our interfaces.

2. The key points in brief

We process your data in order to provide you with iBeekeeper. We do not sell any data and do not use any third-party advertising or tracking services. Your beekeeping data is stored on servers in Germany that we rent from OVH GmbH, Cologne. We also run email and the AI assistant iBee via OVHcloud, in data centres in France. You can export your data at any time and delete your account yourself.

3. Visiting the website www.ibeekeeper.de

When you access our website, our server processes technically necessary data: IP address, date and time, page accessed, amount of data transferred, referrer and browser identifier. This is necessary to deliver the page and to fend off attacks (Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation). The logs are deleted after 14 days; entries relating to security incidents are kept until the incident has been resolved, for no longer than 90 days.

Audience measurement: We count page views with our own statistics running on our server. We record the page accessed, the referring page, the browser language and the device type. We also count clicks on the links to registration and on our tools. We do not set any cookies for this, do not store anything on your device, do not store any IP address and cannot attribute page views to any person (Art. 6(1)(f) GDPR; legitimate interest: improving the website). If you arrive at our website via a campaign link (UTM parameters) or from another website, we append these parameters and the domain of that other website to the links to registration in the web application, without storing anything on your device (section 7).

We deliver fonts and icons from our own server. The website does not embed any content from Google, Facebook, YouTube or other platforms.

4. Account, registration and sign-in

To use iBeekeeper, you create an account. Email address and password are mandatory; name, address and other profile details are optional. You can choose a name or a pseudonym to be displayed to other users. We process this data to perform the contract of use (Art. 6(1)(b) GDPR). We also store which version of the terms and conditions and of this notice you have agreed to or taken note of (Art. 6(1)(c) and (f) GDPR, proof).

Sign in with Apple: If you choose “Sign in with Apple”, we receive an identifier and the email address from Apple Inc. or Apple Distribution International Ltd. (on request, an address forwarded by Apple). Apple processes data under its own responsibility.

Signed-in devices: For signing in to the apps, we store for each device a device identifier, device type, app and version as well as the time of last use, in order to secure your sign-in, to show you your devices in the settings and to apply the device rule of your package (Art. 6(1)(b) GDPR).

We store your account data for as long as your account exists. If you delete your account, the data is deleted after a period of 14 days during which you can reverse the deletion. If you have orders or invoices, the data that we must keep for tax and commercial law reasons is anonymised or blocked until the retention obligation expires (accounting vouchers and invoices eight years, books ten years).

Deleting your account: You can delete your account at any time in the web application and in the apps under “Settings”, or request deletion without signing in by emailing service@ibeekeeper.de.

5. Packages, orders, payment and invoices

When you order a package or an add-on product, we process billing name, billing address, where applicable company and VAT identification number, the selected product, term, prices, payment status and invoices (Art. 6(1)(b) GDPR). We keep invoices and accounting vouchers for eight years and books for ten years in accordance with § 147 AO (German Fiscal Code) and § 257 HGB (German Commercial Code) (Art. 6(1)(c) GDPR).

End of a paid package: if a paid package ends, we retain data that go beyond the scope of the free package unchanged for a further 90 days. We then create a backup file with the data of your account, make it available to you for download for 90 days and remove the surplus data from the Service; after these 90 days, the backup file is deleted. Accounting entries, invoices and records of treatments are retained until the end of the statutory retention period (Art. 6(1)(b) and (c) GDPR, Section 9.7 of the T&Cs).

Mollie: Payments in the web application are processed by Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, the Netherlands. Mollie receives the amount, order number and the payment details you enter at Mollie during the payment process (e.g. IBAN for direct debit). As a payment institution, Mollie is itself responsible for payment processing; details: https://www.mollie.com/de/privacy. The legal basis is Art. 6(1)(b) GDPR.

Purchases in the apps: If you buy a package in the iOS app, Apple handles the purchase, payment and subscription management under its own responsibility. We receive a purchase receipt from Apple with product, term and transaction identifiers, but no payment details, and verify it with Apple in order to activate your package and detect renewals (Art. 6(1)(b) GDPR).

6. Your beekeeping data in the service

We process what you enter in iBeekeeper in order to provide you with the service (Art. 6(1)(b) GDPR): colonies, locations with coordinates, hive cards, treatments, feedings, harvests, inventory, tasks, notes, photos, voice notes, documents, point of sale, cash book and invoices as well as readings from connected sensors and hive scales.

We store photos and audio recordings in the object storage of OVH GmbH in Germany. We remove the location, time of capture and device identifier from photos before they are stored or passed on to a service.

The data remains stored until you delete it or delete your account. You can export it at any time in a common, machine-readable format.

Change history: We record who created, changed or deleted one of your entries and when, so that you can trace and undo changes; people with whom you share a colony see its history (Art. 6(1)(b) GDPR). We delete entries in the history after three years. We keep entries relating to accounting entries, point of sale, orders and consents as evidence for up to eleven years, and entries relating to treatments for as long as the record of the treatment (Art. 6(1)(c) GDPR).

Data of your customers: If, as a business, you record personal data of third parties, for example customers in point of sale, cash book and invoices, we process this data on your behalf in accordance with Art. 28 GDPR. You are then the controller; our data processing agreement applies.

7. Storage on your device and usage statistics of the web application

The web application and the apps store on your device what is technically necessary for the service: your sign-in (access and refresh tokens), language, view settings and cached data for offline use. This is permitted without consent under § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). We do not set cookies for advertising or tracking.

To improve the application, we record on our server which pages and features are used and which campaign links (UTM parameters) users come from. We do not store any identifier on your device for this. If you are signed in, we store these events with their time, linked to your account, together with the pages you visited last. The events are evaluated in aggregated form; only our team sees them individually, for example to trace an error or to answer your enquiry. On registration, we store with your account where (web application, iOS app, Android app) and how (with a password or with Apple) you registered, which campaign link or which link on our website you came through, the domain of the referring page without the exact address, and the origin channel derived from this; we do not store values that contain an e-mail address. We delete the events and this information after 14 months (Art. 6(1)(f) GDPR; legitimate interest: improving the service). You can object (section 19).

8. Maps, place search, weather, fonts and icons

Maps: Map views load map images from the servers of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. In doing so, your browser or app transmits your IP address and the map section displayed to the OpenStreetMap Foundation. For the United Kingdom there is an adequacy decision of the EU Commission (Implementing Decision (EU) 2021/1772, extended in December 2025 until 27.12.2031). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in displaying maps). Privacy information: https://osmfoundation.org/wiki/Privacy_Policy

Place search: If you search for an address or a place, the request (search text or coordinates) may be sent via our server to the place search service Nominatim of the OpenStreetMap Foundation; your IP address is not passed on.

Weather: We obtain weather forecasts from our own weather server, which runs at OVH GmbH in Germany. For this we transmit the coordinates of your locations, but no details about you as a person.

Fonts and icons: The web application loads fonts and icons from our own server; no data is transmitted to third parties in the process.

9. Notifications on your device

If you allow notifications, we store the push token of your device. We send notifications via our own push server to the Apple Push Notification Service (Apple) or Firebase Cloud Messaging (Google), which deliver them to your device. The token and the text of the notification are transmitted. Data may be transferred to the USA in the process: Google LLC is certified under the EU-US Data Privacy Framework; Apple bases transfers to the USA on the standard contractual clauses of the EU Commission. The legal basis is Art. 6(1)(b) GDPR. You can switch off notifications at any time in the settings of the device or the app.

10. iBee, our assistant

iBee is the AI assistant in the application. iBee answers questions, converts voice notes into text, analyses photos and suggests entries; on request, iBee proactively gives hints about your colonies. You are communicating with an AI system; responses from iBee are generated automatically and are labelled as such, visibly with the “AI” mark and in machine-readable form with a provenance marker (provider, model, time), which we store with the answer and which is also included in the data export. If you include an assessment from iBee with a beekeeper question, it remains recognisable there to everyone as generated by AI. They are suggestions; you make the decision on treatments, feedings and other measures. No automated decision within the meaning of Art. 22 GDPR takes place.

What is processed is what you give iBee (question, voice recording, photo) and the areas of your beekeeping that you have released in the settings under iBee, for example colonies, hive cards, treatments, feedings, harvests, locations, inventory, weather and sensor readings. Without the release of an area, iBee sees nothing from it. Photos are reduced in size and stripped of location, time of capture and device identifier before analysis.

The language models, speech recognition and image analysis are provided to us by OVH GmbH, Oskar-Jäger-Str. 173/K6, 50825 Köln, Germany, as our processor under Art. 28 GDPR (OVHcloud AI Endpoints). Processing takes place in the OVHcloud data centre in Gravelines, France. OVHcloud does not store the inputs and responses, does not use them further and does not use them to train models.

We store your conversations in your account until you delete them. iBee remembers key statements from conversations for 14 days and proven insights for 60 days. For each request we log the scope of processing (not the content) in order to manage costs and usage limits.

The legal basis is Art. 6(1)(b) GDPR, because you request the feature; the inclusion of released areas is based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the settings.

11. Photos for the beekeeping knowledge base and translation of public texts

If you provide a photo of a forage plant for the beekeeping knowledge base, you release it for publication. To identify the plant, we transmit a reduced copy without location, time of capture and device identifier to Anthropic Ireland, Limited, Dublin, Ireland, which processes it as our processor under Art. 28 GDPR; processing also takes place at Anthropic PBC in the USA. Anthropic does not use the data to train models. For public texts on our platform (e.g. glossary, catalogues, names in selection lists) we use Anthropic for translation; these texts contain no personal data. Photos from your operation, hive cards, notes, locations and conversations with iBee are never transmitted to Anthropic. The transfer to the USA is based on the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR), which are part of our contract with Anthropic; you can obtain a copy on request. The legal basis is Art. 6(1)(b) GDPR in conjunction with your release for publication.

12. Collaboration, community and public content

If you share colonies or locations with other users, they see the released data. If you create a public link, anyone with the link can see the released content. You can revoke releases and links at any time.

A public batch page can be created for each harvest. Only the details you release yourself are published, never the location of your colonies (Art. 6(1)(b) GDPR).

Lab reports: you can upload reports from laboratories (PDF or image) for each harvest and record measured values. We store the files in non-public storage; only you can access them. On the public batch page, the measured values, laboratory and date of the latest report appear only if you release them, and the file itself only after an additional release. Reports often contain your name and address; once you release the file, these details become visible to anyone who scans the QR code. The legal basis is Art. 6(1)(b) GDPR and, for publication, your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time by switching off the release. If you delete the report or your account, we delete the file as well. If you delete the harvest, the file can no longer be retrieved immediately and is deleted at the latest once the 90-day trash period has expired.

In the community you can create a profile, publish posts, comments and marketplace listings and send messages. You decide what other users see of you in the settings under “Privacy and visibility”. Photos that you release for the beekeeping knowledge base are shown publicly in the application and on www.ibeekeeper.de with the name you have chosen.

The legal basis is Art. 6(1)(b) GDPR. We process reports about content (“Report” function) in order to review them and to fulfil our obligations under the Digital Services Act (Art. 6(1)(c) and (f) GDPR); we keep the content of a report and our decision for up to two years.

Beekeeper questions: In the “Beekeeper questions” room, you can ask other beekeepers a question, including directly from a photo, a hive card, an image analysis or an answer from iBee (“Ask other beekeepers”). All logged-in users see your question with its text, topic and time, your name as you determine under “Privacy & Visibility”, and your profile picture. We show photos as a copy from which we have removed the capture location, capture time, device identifier and other capture data; your original photo remains private. If you include iBee’s assessment, everyone sees it with your question. If you ask about a colony, we show its breed, hive type and the date of the last inspection, and its name only if you select this when asking. In addition, we show a rough region, namely the country and the federal state or a comparable region, which we determine from the place of the apiary, rounded to about one kilometre, or from the postcode and country in your profile; you can omit it when asking. We never show the exact location. Internally, we link the question to the colony, the hive card, the original photo and the image analysis from which it originates; other users do not see this link (Art. 6(1)(b) GDPR).

Answers to beekeeper questions: All logged-in users see answers and follow-up questions with the name of the person answering, as that person determines under “Privacy & Visibility”. So that every question receives an answer, our team sees unanswered questions with your username and answers itself where necessary; these answers are written by our staff, they appear under “iBeekeeper-Team”, and internally we store who answered. We notify you of answers to your questions in the application and on your device (Section 9), and for the first answer additionally by e-mail; if someone reacts approvingly to your answer, we tell you so with their name. You can switch off these notifications under “Privacy & Visibility”. We store questions and answers until you delete them or your account (Art. 6(1)(b) GDPR). If you delete a question, we remove the copies of the photos immediately and the question with all answers permanently after 30 days. In order to check whether every question receives an answer quickly and to improve the room, we store when a question was first answered and whether this was by our team, and we record the asking and answering of questions as usage events with the entry point, topic, number of photos and time until the answer; Section 7 applies to this, with deletion after 14 months (Art. 6(1)(f) GDPR).

Short questions: If you have used a feature several times, for example the frame grid in the hive card, image analysis, colony groups, the weight check or the honey label, we briefly ask you at that point how helpful the feature is for you, at most once in 30 days. Whether we ask is determined from the number of your entries for that feature. We store when and where (web application, iOS app, Android app) we asked, the number of your entries at that time, your rating from 1 to 5 stars, your optional text, the language and when you answered or skipped the question. The answers are evaluated in aggregated form per feature; only our team sees them individually. We delete answers to short questions three years after the question (Art. 6(1)(f) GDPR; legitimate interest: improvement of the Service). You can object at any time, with “Don’t ask again” on the question or in the settings under “Help shape”; we store this decision with its time and do not ask you again afterwards.

Wish list: Under “Help shape” we keep a wish list that all logged-in users can see. We formulate the wishes on it ourselves, without names or other personal data, and link them internally to the reports they come from. If you submit a wish there, we treat it as a report (Section 15). If you support a wish, we store your vote with its time; others only see the number of votes, not who supported it. All logged-in users see your comments with your first name and the initial of your last name; we can hide comments. When we implement a wish, we notify everyone who supported it (Section 9). We store votes and comments until you withdraw the vote, delete the comment or delete your account (Art. 6(1)(b) GDPR).

Naming for implemented wishes: When we implement a wish, we link the news item about it to the reports it comes from and notify you if your report is among them (Art. 6(1)(b) GDPR). Without your consent, the news item only says “At the request of the community”. If you consent in the settings under “Help shape”, we name your first name and the initial of your last name there, visible to all logged-in users (Art. 6(1)(a) GDPR). We store the consent with its time. You can withdraw it there at any time; your name will then no longer appear under any news item.

Feedback on news: Under each news item you can choose “Helpful”. We store your vote until you withdraw it or delete your account; others only see the number. What you write under “What else is missing for you?” we create as a report with a reference to the news item; Section 15 applies to it, including the storage period (Art. 6(1)(b) GDPR).

“Early Beekeepers” circle: Under “Help shape” you can apply for the “Early Beekeepers” circle, with a reason if you wish, or we invite you personally. We store the application, the reason, the invitation, our decision on admission with an internal note and any departure, each with its time; we notify you of an invitation and of admission (Section 9). Members see selected new features earlier and belong to the private community group “Early Beekeepers”; the other members of this group see their membership, with names as each member determines under “Privacy & Visibility”. You can leave the circle at any time; this ends the early access and the membership in the group. We delete rejected and withdrawn applications, declined invitations and ended memberships one year later (Art. 6(1)(b) GDPR).

Associations: If you create a group with the category “Association”, we maintain an organisation for it whose members are the active members of the group; founders and board manage it in the group. The member list shows names and roles as each member determines under “Privacy & Visibility”; e-mail addresses and your beekeeping data are not visible even to the board, except as figures in the association overview if you consent. Association events (title, date, time, place and description) are visible to the members and, for public associations, to all signed-in users. Document folders that the board shares for the association are visible only to the members, and with the setting “Visible to the board only” only to the board; members cannot change or delete them. For the location of an association, we store the postcode, place name and the position of the place, but no address. For “Near me”, we calculate the distance from the postcode in your profile or, if it is missing, from the place of one of your apiaries, rounded to about one kilometre; we do not show this information to anyone else. We notify you about new posts in your groups and new association events (Section 9); you can switch off both under “Privacy & Visibility”. Shares that other users give you take effect only when you accept them under “Shared with me”; shares with an association are accepted by its board, and if the board itself shares, they apply immediately. You can end an accepted share there at any time. When you leave an association, all shares with that association end for you. The legal basis is Art. 6(1)(b) GDPR.

Association overview: If you expressly consent in an association, data from your beekeeping feeds into an overview that only the board of that association can see: number of colonies, share of colonies with a hive card in the last 30 days, treated colonies, average mite drop per day, dissolved and lost colonies and the harvest of the current year. The overview only appears once at least five members have consented, and each figure only if it is based on the data of at least five beekeepers. The figures are rounded; names, apiaries and individual colonies are not visible, and the board only sees how many members have consented. We store whether and when you consented and when you answered our question. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the association group or under “Privacy & Visibility”; from then on your data no longer feeds in. Your consent ends when you leave the association.

Hornet observations (Asian hornet): At your apiary you can record when and for how long you observed the Asian hornet (Vespa velutina) and how many hornets you saw. On a voluntary basis you can also record details on weakened or lost colonies, a sighted nest, attacks on people, measures taken, your training in nest removal and your equipment for finding nests, as well as notes. With each observation we store the postal code and country of the apiary, which we pre-fill from the address of the apiary or of your profile. We store this information in your account; only you and the people with whom you share the apiary can see it (Art. 6(1)(b) GDPR).

For each observation you can additionally decide whether it may be included in an anonymised evaluation. This release is switched off by default. The legal basis is your consent (Art. 6(1)(a) GDPR); we store when you gave it and when you withdrew it. The purpose is to give bee institutes, beekeepers' associations and authorities an overview of the spread of the Asian hornet and its consequences for colonies, for example as a basis for action plans.

Released observations are only evaluated in aggregated form per calendar year, country and postal code area; for this we use at most the first three characters of the postal code. An area is only shown once at least three different beekeepers have contributed to it. Otherwise we combine it with other areas that are too small and share the same first two characters or the same first character, or leave it out. Name, username, e-mail address, postal address, coordinates of the apiary, notes and the location of a nest are never evaluated and never passed on. We show the aggregated figures to logged-in beekeepers in iBeekeeper and pass them on to bee institutes as a table. These figures do not allow any conclusions to be drawn about individual persons and are therefore no longer personal data.

You can withdraw your consent at any time with effect for the future: remove the tick “Release for anonymous evaluation” from the observation or delete the observation. It will then no longer be included in any new evaluation. Anonymised figures that have already been passed on can no longer be attributed to individual observations and therefore cannot be recalled. Your observations are deleted together with your account and are included in the complete data export and in information provided under Art. 15 GDPR.

Supporter contribution: If you pay a supporter contribution, we process the amount, term and billing data as for a package (section 5) and show you a badge in your profile that only you can see (Art. 6(1)(b) GDPR). Before it expires, we remind you by email about renewing your support (Art. 6(1)(b) GDPR). Mention as a supporter: If you expressly consent, we publish the name you provide on www.ibeekeeper.de (Art. 6(1)(a) GDPR). For this we store the name and the time of consent. You can withdraw your consent at any time in the web application under “Settings”; the name is then no longer displayed and is deleted.

Reviews: If you use iBeekeeper regularly, we occasionally ask you for a review, in the web application after you save a hive card. Whether we ask is determined from your account: the age of the account, the number of days with newly created hive cards in the last 60 days, open error reports of your own and technical errors in the last 14 days. We store when and through which channel (web application, iOS app, Android app) we last asked and how you answered, including “Don't ask again”; after that we do not ask again, otherwise at most every 120 days (Art. 6(1)(f) GDPR; legitimate interest: asking only users who know the Service for a review and not pestering them). If you submit a review, we store the stars, your optional text, language and time and, as evidence of regular use, the number of these days and the age of your account (Art. 6(1)(f) GDPR; legitimate interest: improvement of the Service and verifiable customer reviews). Your stars are included without your name in the average and the count that we show on www.ibeekeeper.de. We only publish the text, your first name, the initial of your last name and your region there if you expressly consent when submitting and we have checked the review (Art. 6(1)(a) GDPR). We derive the region from the postcode and country in your profile, for example a federal state; if it cannot be determined, we show the country. You can withdraw your consent at any time in the web application under “Settings”, “Your reviews”, or by sending us a message; the review is then no longer displayed. Reviews are included in the complete data export and are deleted together with your account.

13. Regional comparisons from anonymised data

What we do

When you use iBeekeeper, you enter information about your beekeeping, for example when you treat, feed or harvest your colonies, how many colonies you keep and in which area your apiaries are located. We combine this information with that of other beekeepers in order to offer regional comparisons and hints, for example: In your area, 70 percent of beekeepers have started the summer treatment.

How we ensure your anonymity

We only evaluate groups that comprise at least five different accounts and at least ten colonies. Locations are first coarsened to a grid of about ten kilometres; exact coordinates do not leave our systems. Individual accounts, apiaries or colonies cannot be identified in the results and cannot be calculated back. Sample data and deleted accounts are not taken into account.

Legal basis and objection

The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in giving our users professional orientation and improving the application. You can object to the inclusion of your data at any time in the settings under Privacy and visibility, Regional comparisons; from then on, your information will no longer be included in new evaluations. Results already calculated contain no data relating to you and remain in place.

Where the results appear

We may publish results of these evaluations in the application, in notifications and on our website, always only in the aggregated form described above.

14. News by email (newsletter)

If you agree in your account, we occasionally send you news about iBeekeeper by email, for example about new features, important changes or tips. The legal basis is your consent (Art. 6(1)(a) GDPR).

Subscription uses the double opt-in procedure: after your agreement you receive an email with a confirmation link. Only once you confirm the subscription via this link will you receive news. An unconfirmed link expires after seven days.

For this we use the email address of your account. To be able to prove your consent, we store the times of request, confirmation and withdrawal, the wording and version of the consent text, the language and the place where you agreed (settings or notice in the application). We do not store IP addresses in this context. We do not pass this data on to third parties. Sending takes place from our application itself via our email service at OVH GmbH, Cologne (OVHcloud E-Mail Pro, data centres in France), through which all other emails of the application are also sent; we do not use an external newsletter service.

You can withdraw your consent at any time with effect for the future: via the unsubscribe link in every email, in the application under “Settings”, section “Information”, or by sending us a message. The lawfulness of processing carried out until the withdrawal remains unaffected.

After a withdrawal, we no longer use your address for news. We keep the proof of consent and withdrawal for up to three years after the end of the year of withdrawal in order to be able to prove the consent (Art. 6(1)(f) in conjunction with Art. 7(1) GDPR). Data stored for other purposes, such as your account, remains unaffected.

15. Emails, help and reports

We send emails for confirmations, invoices, reminders and notices about your account via our email service at OVH GmbH; mailboxes and sending run in OVHcloud data centres in France (Art. 6(1)(b) GDPR). If you write to us at service@ibeekeeper.de or send a report in the application, we process your message, your contact details and, if you have an account, the account data needed to handle it. Emails to service@ibeekeeper.de are automatically transferred to our reporting system and answered there. We only assign a reply to an existing enquiry if it comes from an address that belongs to that enquiry; otherwise we create a new enquiry. The legal basis is Art. 6(1)(b) GDPR, otherwise point (f) (answering your enquiry). We delete completed enquiries three years after their completion, together with all messages and attachments, unless there is a retention obligation, for example for cancellations and withdrawals.

16. Connection to third-party AI assistants (ChatGPT, Claude)

You can connect your iBeekeeper account via our interface to an AI assistant of another provider, for example ChatGPT (OpenAI) or Claude (Anthropic). To do so, you grant the assistant access on our consent page to the extent you select there. If the assistant then retrieves data, we transmit it to this provider at your instigation. The respective provider is itself responsible for further processing there; its privacy terms apply, where applicable with transfer to the USA. The legal basis for the transfer is Art. 6(1)(b) GDPR. You can disconnect at any time in the settings.

17. Sensors, hive scales and manufacturers

If you connect a sensor or a hive scale, we receive its readings via a device-specific address and assign them to your colony (Art. 6(1)(b) GDPR). We do not retrieve any data from manufacturers for this and do not pass your readings on to manufacturers. Manufacturers who use our manufacturer portal manage their device types there. They do not see the data of individual beekeepers, only aggregated figures for their device type (number of active devices and users, time of the last measurement, number of readings of the day).

18. Recipients and transfers to third countries

Processors (acting on our instructions, contract under Art. 28 GDPR):

• OVH GmbH, Cologne, Germany: servers, database, object storage and backups (data centres in Germany), email sending and mailbox (OVHcloud E-Mail Pro, France), AI services (OVHcloud AI Endpoints, Gravelines, France). For this, OVH uses companies of the OVHcloud group as sub-processors, for support and maintenance also OVH Hébergement Inc., Canada, and OVH Limited, United Kingdom.
• Anthropic Ireland, Limited, Dublin, Ireland, with Anthropic PBC, USA: only plant photos for the beekeeping knowledge base and public platform texts (section 11; USA: standard contractual clauses).

Independent controllers:

• Mollie B.V., Amsterdam, the Netherlands: payment processing.
• Apple Distribution International Ltd., Ireland, and Apple Inc., USA: App Store, in-app purchases, “Sign in with Apple”, push notifications on Apple devices (USA: standard contractual clauses).
• Google Ireland Ltd., Ireland, and Google LLC, USA: push notifications on Android devices, Google Play (USA: EU-US Data Privacy Framework).
• OpenStreetMap Foundation, United Kingdom: map images and place search.
• Providers of an AI assistant that you connect yourself (section 16).
• Tax advisers and authorities, insofar as we are legally obliged to do so.

Transfers to countries outside the EU and the EEA are made only to the USA, the United Kingdom and Canada. They are based on adequacy decisions of the EU Commission (United Kingdom, Canada for companies within the scope of the data protection law there, USA for recipients certified under the EU-US Data Privacy Framework) or on standard contractual clauses under Art. 46(2)(c) GDPR. You can obtain a copy of the safeguards on request.

19. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and withdrawal of consent given with effect for the future (Art. 7(3)). You can exercise many rights yourself in the application: view, change and export data and delete your account. Otherwise, a message to service@ibeekeeper.de is sufficient. On request, you will receive information with a copy of all data we have stored about you, even if you do not have an account with us.

Right to lodge a complaint (Art. 77 GDPR): You can lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence or place of work. The authority responsible for us is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (Brandenburg State Commissioner for Data Protection and Access to Files), Stahnsdorfer Damm 77, 14532 Kleinmachnow, https://www.lda.brandenburg.de. In Austria, the Datenschutzbehörde (Data Protection Authority), Barichgasse 40-42, 1030 Wien (https://www.dsb.gv.at), and in Switzerland the Eidgenössische Datenschutz- und Öffentlichkeitsbeauftragte (Federal Data Protection and Information Commissioner), Feldeggweg 1, 3003 Bern (https://www.edoeb.admin.ch) are responsible.

20. Obligation to provide data, security

Providing an email address and password is required for the contract; without them we cannot create an account. For paid packages we also need the billing details. All other information is optional.

All connections to our services are encrypted with TLS. We back up the data daily to separate storage in the EU. Daily backups are deleted after 30 days, with one copy per calendar month kept for 12 months. Backups are encrypted and used only for restoration; after a restoration, data deleted in the meantime is deleted again.

21. Information for users in Switzerland

For users in Switzerland, the Swiss Federal Act on Data Protection (DSG) also applies. The information in this notice also fulfils the duty to inform under Art. 19 DSG. We disclose personal data to the following countries: Germany, France, Ireland, the Netherlands, the United Kingdom and Canada (adequate protection under Annex 1 of the Data Protection Ordinance) as well as the USA (Google: Swiss-US Data Privacy Framework; Apple and Anthropic: standard contractual clauses of the EU Commission, for Anthropic with the Swiss addendum).

22. Changes to this notice

We adapt this notice when features or the legal situation change. The current version with its date is available on our website and in the application. We inform you about material changes in the application.

Version 18 of Nov. 2, 2026