Privacy Policy

1. Controller

Pranarei n.e.V.
Schönbrunnerhäuser 756
94545 Hohenau
Germany
Email: simon@pranarei.de

2. Overview

This Permaculture Garden Planner collects personal data only to the extent technically necessary. No tracking cookies are set and no individual user profiles are created. Optional services for statistics (reach/performance measurement) and marketing/affiliate are loaded only after your explicit consent (§ 25 TDDDG); without consent, only the functions required for the service run. You can change or withdraw your consent at any time via "Privacy Settings" (footer) (see Section 11).

2.1 Planning data (stored locally)

Your entries (infrastructure, household size, preferences, location notes) are stored exclusively in your browser's local storage (localStorage). This data does not leave your device unless you use the optional functions location lookup, AI enhancement, or purchase of a premium plan.

2.2 No registration required

Using the garden planner requires no registration and no personal information. Basic operation works without cookies or third-party services.

3. Hosting

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When the website is accessed, standard connection data (IP address, timestamp, browser type) is processed by the hosting provider. Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in secure website operation). Vercel processes data on the basis of EU Standard Contractual Clauses (SCCs).

4. Map view (optional)

If you use the interactive map (property function), your browser loads map tiles directly from the following services:

• Esri / ArcGIS Online (Esri, Redlands, CA, USA): satellite tiles. When loading the map, your browser sends your IP address to Esri. Privacy: esri.com/privacy.
• OpenStreetMap (OpenStreetMap Foundation, UK): street tiles. When loading the map, your browser sends your IP address to OSM servers. Privacy: OSM Foundation Privacy Policy.
• OpenTopoMap: topographic tiles (open-source community project).

Legal basis: Art. 6 Abs. 1 lit. f DSGVO. The map is an optional feature; without map use, no data is transmitted to map services.

5. Location lookup (optional)

If you use the "Search postal code or place" function, the following happens exclusively server-side — your browser does not contact any third-party services directly:

• Nominatim / OpenStreetMap (OpenStreetMap Foundation, UK): the address you enter is sent from our server to the geocoding API to determine geographic coordinates. No personal data other than the address text is transmitted.
• Open-Meteo (Open-Meteo GmbH, Switzerland): geographic coordinates are sent from our server to the weather API to retrieve climate data (temperature, precipitation, wind speed, sunshine hours). No personal data is transmitted — only coordinates. Privacy: open-meteo.com/terms.
• Elevation services (for the site analysis / slope & water-harvesting feature): geographic coordinates are sent from our server to an elevation service to determine the terrain profile (elevation, slope) — depending on location hoehendaten.de (Germany; hosted in Germany, coordinates are not stored there), USGS EPQS (US agency, US locations only), swisstopo / geo.admin.ch (Switzerland, CH locations only) or OpenTopoData (SRTM, fallback). No personal data is transmitted other than the coordinates.

Legal basis: Art. 6 Abs. 1 lit. b DSGVO (performance of a contract / provision of services). Third parties see our server's IP address, not yours.

6. AI recommendations (optional)

When the optional AI enhancement is active, your garden notes, climate zone and infrastructure descriptions are transmitted from our server to the Anthropic API (Anthropic PBC, San Francisco, USA) to generate personalized recommendations. This only happens when you create a plan and the feature is unlocked.

Legal basis: Art. 6 Abs. 1 lit. a DSGVO (consent) / Art. 6 Abs. 1 lit. b DSGVO. Anthropic does not use API inputs for model training and deletes them by default within 30 days at the latest. Processing on the basis of EU SCCs.

Transparency under the EU AI Act (Regulation (EU) 2024/1689, Art. 50): AI-generated content is marked with ◈ (or labelled as AI notes) in the plan and in all exports. The provider of the AI system used is Pranarei n.e.V.; the underlying language model is Claude (Anthropic). This content is created with AI support and is not individually editorially reviewed.

7. Purchase of a premium plan

When purchasing a premium garden plan, the following services are used:

7.1 Payment processing (Digistore24)

Payments are processed by Digistore24 GmbH, Nordring 52–54, 99084 Erfurt, Germany. Digistore24 is the "Merchant of Record" — we do not receive any payment data (credit card numbers, bank details, etc.). Processed data:

• Email address (for purchase confirmation and plan access)
• Name (for the invoice)
• Payment data (exclusively at Digistore24)
• Purchase history and order data

Privacy Digistore24: digistore24.com/info/privacy. Legal basis: Art. 6 Abs. 1 lit. b DSGVO (performance of a contract).

7.2 Plan storage (Vercel Blob)

After completing the purchase, your garden plan is stored in Vercel Blob (Vercel Inc., USA) so you can access it through your plan link. Access uses a cryptographically signed token that expires after 90 days (renewable via email recovery). The plan data itself remains stored until you remove it via the self-service deletion (section 12) or request deletion. Processing on the basis of EU SCCs.

7.3 Email delivery (Resend)

The download link is delivered by email via Resend (Resend Inc., San Francisco, USA). For this, your email address and your name (if provided) are transmitted to Resend. Delivery is exclusively transactional (purchase confirmation + download link) — no marketing email without your explicit consent. Privacy Resend: resend.com/privacy. Legal basis: Art. 6 Abs. 1 lit. b DSGVO.

7.4 Monthly reminder (part of the purchased plan)

The monthly email reminder with the top tasks from your plan is part of the paid plan ("Monthly to-dos by email"). After your purchase we enrol you automatically using the email address you provided to the payment provider; alternatively you can also sign up yourself on the plan page. In both cases we store the following data in Vercel Blob (see 7.2):

• Your email address
• Your plan ID (internal identifier of the stored garden plan)
• Time of sign-up
• A randomly generated token for the unsubscribe link

The email address is used exclusively to send the monthly reminders — no sharing with third parties, no marketing, no sales offers. Delivery is via Resend (see 7.3) on the 1st of each month. Every email — including the purchase confirmation — contains an unsubscribe link.

Legal basis: Art. 6 (1) (b) DSGVO (performance of the contract — the reminder is a promised feature of the purchased plan), or Art. 6 (1) (a) DSGVO where you sign up yourself via the form. Self-service sign-ups use a double-opt-in process: reminders only start once you click the confirmation link in the email we send you; we store the time of confirmation as proof of consent. You can stop delivery at any time via the unsubscribe link in every email. After you unsubscribe, your record remains stored with status "unsubscribed" so that the token link cannot be misused again by third parties and so you are not re-enrolled unintentionally on a later edit — but delivery no longer takes place. Complete deletion on request to simon@pranarei.de.

7.5 Forecast waitlist (weather/climate forecast feature)

Via the "Join the waitlist" form you can sign up to be notified once the planned weather/climate forecast feature launches. The feature is not available yet — this is purely a collection of interested users. Separately from the monthly reminder (Blob storage forecast-waitlist/, see 7.2) we store the following data:

• Your email address
• Your plan ID (internal identifier of the stored garden plan)
• Market (EU/US) and language — for the right approach
• Time of sign-up, confirmation and any unsubscribe, plus random tokens for the confirmation and unsubscribe links

Legal basis: Art. 6 (1) (a) DSGVO (consent). Sign-up uses a double-opt-in process (§ 7 UWG): we only add you once you click the confirmation link in the email we send you; we store the time of confirmation as proof of consent. The address is used solely to inform you about this feature (launch and important updates about it) — no sharing with third parties, no other marketing. You can unsubscribe at any time via the link in every email. After you unsubscribe, your record remains stored with status "unsubscribed" (token misuse protection); delivery no longer takes place. Complete deletion on request to simon@pranarei.de.

7.6 Climate region waitlist

If your location is in a climate region the planner does not support yet (e.g. Southern Hemisphere or tropics), we deliberately do not create a plan and instead offer to notify you once your region is supported. If you sign up via the form, we store — separately from the reminder and the forecast waitlist (Blob storage climate-waitlist/) — the following data:

• Your email address
• The detected climate region class (e.g. "Southern Hemisphere" or "tropics") — no address, no coordinates
• Market (EU/US) and language — for the right approach
• Time of sign-up, confirmation and any unsubscribe, plus random tokens for the confirmation and unsubscribe links

Legal basis: Art. 6 (1) (a) DSGVO (consent). Sign-up uses a double-opt-in process (§ 7 UWG) with its own, purpose-bound consent — it covers solely the notification that the planner supports your climate region; no sharing with third parties, no other marketing. You can unsubscribe at any time via the link in every email. After you unsubscribe, your record remains stored with status "unsubscribed" (token misuse protection); delivery no longer takes place. Complete deletion on request to simon@pranarei.de.

Tester feedback (testing phase)

On the feedback page (/feedback) you can, during the testing phase, voluntarily give feedback on the planner or apply for free tester access. We store only what you enter yourself:

• the form fields you fill in (ratings and free text) — anonymously by default, without an account and without storing your IP address; exception: if you arrive via a personal invitation link carrying a reference tag (e.g. /feedback?ref=…), your submission is linked to that tag so we can attribute invited testers' feedback;
• your email address only if you provide it voluntarily (for follow-up questions) or when you apply for an access code (then it is required in order to send you the code);
• storage is at our hosting/blob provider (Vercel), kept separate from plan data;
• we use the data solely to improve the product during the testing phase and — for applications — to send the code; no sharing with third parties, no marketing.

Legal basis: Art. 6 (1) (a) DSGVO (consent by submitting the form) or (b) (sending the requested code). Please do not enter sensitive personal data of third parties in the free-text fields. We delete the feedback data after the testing-phase evaluation is complete; deletion/access at any time on request to simon@pranarei.de.

8. Fonts

This website does not load any fonts from third parties. All fonts used are either system-installed (Georgia) or bundled locally from the npm package @fontsource (Lora, Raleway). No external font services (e.g. Google Fonts CDN) are used — your browser does not contact any external servers to load fonts.

9. Web analytics (Vercel Analytics & Speed Insights) — only with consent

This website may use Vercel Analytics and Vercel Speed Insights (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA) for anonymous reach and performance measurement. These services are loaded only after your consent (category „Statistik" in the consent dialog) — without consent they are not integrated. They:

• Set no cookies and create no individual user profiles
• Record anonymized page views, device category, country of origin and performance values (Web Vitals)
• Custom events (e.g. „Plan erstellt", „Plan freigeschaltet") for usage analysis of the core functions — without any personal reference

Purpose: optimization of the offering. Legal basis: Art. 6 Abs. 1 lit. a DSGVO (consent) in conjunction with § 25 Abs. 1 TDDDG. You can declare withdrawal at any time via "Privacy Settings" (footer). Data transfer to the USA — see Section 11 (third-country transfer). Privacy Vercel: vercel.com/legal/privacy-policy.

10. Affiliate links & referral tracking

This website and generated garden plans may contain affiliate links to external seed and tool providers. Affiliate links are marked accordingly. When you click an affiliate link and subsequently make a purchase, we receive a commission — at no extra cost to you.

When you click external affiliate links, your browser technically necessarily transmits your IP address to the respective provider. We do not identify individual persons. Legal basis: Art. 6 Abs. 1 lit. f DSGVO. Further information: Partnerships & affiliate transparency.

If you visit this website via a referral link from one of our affiliate partners (recognizable by an ?aff= or ?ref= parameter in the URL), we store the partner code for up to 90 days in your browser localStorage (aff_ref) — but only if you have consented to the category „Marketing & Affiliate" in the consent dialog. Also only with this consent is the Digistore promo code script (digistore24-scripts.com) loaded, which forwards discount/partner codes to the checkout. The stored code serves exclusively for correct partner compensation upon purchase — it is not linked to your person. You can delete it at any time (browser → developer tools → Application → Local Storage → aff_ref) or withdraw consent via "Privacy Settings". Legal basis: Art. 6 Abs. 1 lit. a DSGVO (consent) in conjunction with § 25 Abs. 1 TDDDG.

11. Cookies, consent (§ 25 TDDDG) and third-country transfer

This website uses no tracking cookies to identify individual users. The core functions use exclusively your browser localStorage, which is technically required for the service you actively use and does not require consent (§ 25 Abs. 2 Nr. 2 TDDDG). This also includes the map view for drawing your property (Section 4).

Consent banner

On your first visit we ask for your consent for two optional, non-essential categories:

• Statistics: Vercel Analytics & Speed Insights (Section 9).
• Marketing & Affiliate: Digistore promo code script and partner code storage (Section 10).

Without consent, these services are not loaded. „Alle akzeptieren" and „Nur essenziell" are equivalent. Your selection is stored locally (gardenConsent) and can be changed and withdrawn at any time via "Privacy Settings" in the footer (Art. 7 Abs. 3 DSGVO). Legal basis for consent-dependent services: Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 25 Abs. 1 TDDDG.

Data transfer to third countries (USA)

Some services used process data in the USA: Vercel (hosting, Blob, Analytics), Resend (email) and Anthropic (AI). Insofar as these providers are certified under the EU-US Data Privacy Framework, the transfer takes place on this basis; additionally or otherwise on the basis of the EU Standard Contractual Clauses (Art. 46 Abs. 2 lit. c DSGVO). The statistics- and marketing-related transfers also only take place after your consent (Art. 49 Abs. 1 lit. a DSGVO).

12. Your rights (GDPR)

Regarding your personal data, you have the following rights:

• Access (Art. 15): the right to learn what data we store about you
• Rectification (Art. 16): the right to correction of inaccurate data
• Erasure (Art. 17): the right to deletion of your data
• Restriction (Art. 18): the right to restriction of processing
• Data portability (Art. 20): the right to receive your data in a machine-readable format
• Objection (Art. 21): the right to object to processing
• Withdrawal: granted consents can be withdrawn at any time

To exercise your rights, contact: simon@pranarei.de.

Self-service deletion (Art. 17)

If you want to completely remove your plan from our storage, you can do so directly here. You need the plan ID and the token from your confirmation email (in the plan link ?token=...). Deleted are: plan data (address, climate zone, notes), detail planner placements, monthly email subscription if any, order binding. The browser cache is cleared in parallel. The process is irreversible.

If you have lost the token: request again via email recovery, or with proof of purchase directly to simon@pranarei.de.

13. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.

14. Service providers & recipients (overview)

Last updated: July 2026. This privacy policy is updated when data processing changes.