Privacy
Privacy policy
Draft – to be reviewed legally before public sale.
This notice describes which data is processed when you visit this website, when you buy GrußPilot Pro and when you use the Thunderbird add-on.
The most important point first
The content of your emails is analysed locally in Thunderbird only. It is never transmitted to GrußPilot, to an AI service or to any third party. There is no product telemetry in version 1.
Controller
Faktor Mensch MEDIA UG (haftungsbeschränkt), Wilhelm-Holzamer-Straße 8, 55129 Mainz, Germany. Contact: support@grusspilot.gofxm.de
Data flows at a glance
| Data | Location | Purpose |
|---|---|---|
| Message content | locally in Thunderbird only | detect greeting and sign-off |
| Recipient profile | local Thunderbird storage | later suggestions |
| License key | locally; HMAC and encrypted on our license server | verify Pro status and resend the key on request |
| Random installation ID | locally and on our license server (HMAC only) | count activations |
| Add-on and Thunderbird version | license server | support and compatibility |
| Order and payment data | our server and Mollie | process the payment |
| Invoice data | our invoicing tool | create and archive the invoice |
When visiting the website
Technically necessary connection data is processed (IP address, time, requested resource, status code). The legal basis is Art. 6(1)(f) GDPR – the legitimate interest in secure operation.
No analytics, tracking or advertising services are used and no analytics cookies are set. Fonts are served from our own server; no content delivery network and no Google Fonts request is involved.
Counters are kept to limit abuse. For this the IP address is stored as a hash only and deleted automatically after a short time.
When buying
For a purchase we collect the email address, billing country and whether you buy as a private individual or a business; for businesses additionally name and billing address and optionally the VAT ID. The legal basis is Art. 6(1)(b) GDPR and, for invoicing and retention, Art. 6(1)(c) GDPR.
Payment is handled by Mollie B.V. Card details are entered directly at Mollie; we never see them. Amount, currency, description and our internal order reference are transmitted to Mollie.
The invoice is created and archived by our own invoicing tool. Invoices and accounting records are retained for the statutory periods (currently generally eight years under § 147 AO).
When checking the license
The add-on generates a random installation ID (UUIDv4) locally. No hardware fingerprinting takes place.
On activation, refresh and deactivation the license key and installation ID are transmitted to our license server. HMAC-SHA-256 values are stored for matching and activation counting. The license key is additionally stored encrypted so it can be resent on an explicit request; it is not stored in clear text. Voluntarily supplied version numbers are stored with the activation so support cases can be classified.
License API responses contain no name, email address, invoice or payment data. License keys are never written to server logs or URLs.
Recipients
- Mollie B.V. (payment processing)
- our hosting provider (operation of website and license server)
- our own SMTP access for outgoing mail
- tax advisors and tax authorities within statutory obligations
Retention
- Web server connection data: short term, per hosting configuration
- Abuse counters: deleted automatically once the window expires
- Order, license and activation data: for the duration of the license
- Invoices and records: for the statutory retention periods
- Payment webhook audit trail: 180 days
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority. An email to support@grusspilot.gofxm.de is enough.
You can delete the add-on’s local data yourself at any time – per contact or entirely in the add-on settings. Uninstalling the add-on removes the local data along with the add-on storage.