Privacy

Cookie settings

Choose what we may store in your browser. Necessary cookies cannot be switched off — without them, sign-in and forms do not work.

  • Necessary Always on

    sp_session (sign-in, 30 days) · sp_pending and sp_signup_email (waiting for the e-mail confirmation, 24 hours each) · sp_active_org (selected organisation, one year) · sp_transfer_token (only during an ownership transfer, 15 minutes) · sp_consent (your decision here, 12 months). If the Cloudflare Turnstile bot protection is switched on for the registration page, it protects the form against automated sign-ups.

  • Remember the language (sp_lang, one year — without consent only until you close the browser), expanded and collapsed sections in your account (sp_klapp, one year), light or dark display (sp_theme) and a dismissed install hint (sp_install_hint_dismissed), both in your browser’s local storage — without consent only for the current session.

We set no statistics or advertising cookies. Should one ever be added, we will ask you again first.

Privacy policy
DEENFRES
EN
Back to website

Legal

Privacy policy

The German version is legally authoritative.

Controller

Schnur Solutions S.à r.l.-S
288, Route de Thionville
L-5884 Howald , Luxembourg
Email: support@schnursolutions.com

What data we process

Account: Email address, first and last name, company (mandatory — SchnurPlan is aimed at businesses), the VAT identification number if you provide it, postal address (street, house number, postal code, city, country), phone number, password (stored only as an Argon2id hash), sign-in timestamps. Legal basis: performance of contract (Art. 6(1)(b) GDPR).

Sessions: Eight cookies, nothing more — six of them technically necessary, two kept beyond the session only with your consent. Your login is held by the session cookie (sp_session, HttpOnly, 30 days). Also necessary are sp_pending and sp_signup_email (waiting for the confirmation of your e-mail address, 24 hours each, HttpOnly), sp_active_org (the organisation chosen last, one year, HttpOnly), sp_transfer_token (only during an ownership transfer, 15 minutes, HttpOnly) and sp_consent (your cookie decision, 12 months). Convenience storage is only kept beyond the session with your consent: sp_lang (the chosen page language, one year — without consent only until you close the browser), sp_klapp (which sections you have expanded or collapsed, one year — without consent not at all) and, in your browser’s local storage, sp_theme (light or dark appearance) and sp_install_hint_dismissed (you dismissed the install hint); these two never leave your device and, without consent, only apply to the current session. For the duration of a session the site also keeps short technical values in the browser’s session storage (for example a message after a page change). You can change your decision at any time via “Cookie settings”. If the Cloudflare Turnstile bot protection is switched on for the registration page, it protects the form against automated sign-ups; for this, Cloudflare processes technical characteristics of your browser (technically necessary). The sample card on /schnurcard only stores something in your browser if you switch its language, appearance or motion, and beyond the session only with your consent under “Convenience” (see “Digital business card” below). Someone who merely reads the site gets nothing stored — with one exception: if you open a page in a specific language (an English, French or Spanish address, including via the automatic redirect based on your browser language, or a link with a language choice), sp_lang keeps that language as a session cookie so the following pages stay in the same language; it ends when you close the browser. Everything else is only set once you act. No tracking, no advertising cookies, no analytics services.

Payment: Processing via Stripe Payments Europe Ltd. We do not store card data; Stripe receives the details required for the payment. Legal basis: performance of contract. Details: stripe.com/de/privacy.

License check: When signing in and checking the license, the desktop app transmits the account identifier, a device identifier and the app version. This is required to unlock the license automatically and to enforce the device limit (Art. 6(1)(b) and (f) GDPR).

Project synchronization (optional): If the customer uses server-based synchronization, project data is stored on servers operated by us and synchronized between the organization’s devices. Transmission is over TLS only; on the server a per-organization access control protects the data, and a checksum per file exposes unnoticed modification. Processing takes place as data processing on behalf of the controller under Art. 28 GDPR; without this feature, project data remains exclusively local with the customer. Legal basis: performance of contract (Art. 6(1)(b) GDPR).

Server logs & security: IP addresses in audit logs (sign-in attempts, downloads) to prevent abuse, retained for not provided yet. Delivery via Cloudflare (proxy/CDN and a tunnel to our servers); for technical reasons Cloudflare processes IP addresses in doing so.

Data from the app at work

If a company uses the app to record the attendance of its staff, the company as the employer decides on the purpose and the scope of that processing; it is the controller for it. We process this data on its behalf (processing on behalf of the controller, Art. 28 GDPR). Questions about purpose, scope and retention are answered by the company.

Attendance and working time: Time of clocking in and out, recorded breaks, the assigned site or project, the working times derived from them (target, actual, difference), absences, and correction requests with their reason.

Location: If the company uses location, the device transmits latitude and longitude when clocking, the accuracy of the location, the distance to the assigned site and the resulting verdict (inside or outside the area). Without the location permission on the device no location is transmitted; the company can additionally tie location to a consent.

Device and sign-in: A device id, device and browser details, the app version and the raw message sent by the device. Signing in additionally creates audit entries with IP address, country and city, device and browser identification.

Photos and documents: Files uploaded to a project — site photos, plans and attachments, for example — are stored on our servers and are only delivered to authorized members of the organization; every retrieval is checked against the organization’s permissions. A photo can show a place, a time and people.

Messages, calendar, notices: Chat messages including attachments and read state, calendar entries with participants and reminders, and notices to the members of the organization.

Notifications: If someone turns on push notifications in the app, we store the address of the notification service of their browser or device, two associated keys, the platform and the device identifier. The notification itself is delivered through the service of the browser or device manufacturer. It can be switched off in the app at any time.

Consent and signature: If the company requires a consent, the signature as an image, the signed text, the time, the IP address and the browser identification are stored. The consent can be withdrawn in the app; the record of the earlier signature remains as evidence.

In the app, the self-disclosure shows the stored attendance data — clock entries, working times, corrections, consent status and retention period — and exports them as a file. For messages, calendar entries, uploaded files and sign-in logs, please contact the company. The company decides on the deletion of this data — not least because working times can be subject to statutory retention obligations. Employees therefore address deletion requests to their company; we carry them out on its behalf.

Digital business card (card.schnursolutions.com)

Our digital business cards live at card.schnursolutions.com. Opening one needs no account, and no cookie is set.

View counting: When a card is opened, and when its actions are used (such as save contact, share, QR code, print), the card reports an event to our server. Stored are: the time, which card, which action, the language the card is currently shown in, how it was opened (such as QR code, NFC or link), and a two-letter country code that Cloudflare derives from the IP address. NOT stored are the IP address, any browser or device identifier, cookie or fingerprint. The IP address is evaluated only momentarily to limit the request rate and is not kept. Events older than 400 days are deleted.

On your device: In your browser’s local storage the card only keeps what you choose yourself or what it needs to resend: the chosen language (karte_lang), light or dark (karte_theme) and reduced motion (karte_motion), once you switch them; that you dismissed the “Add to Home Screen” hint (karte_hs_hinweis); and only if a report does not get through for lack of a connection, the events not yet sent (karte_queue, at most 50), which are reported as described above the next time you are online and then removed. The other entries never leave the device. The card does not remember whether your device has opened it before. The same applies to the sample card on our website, except that without your consent under “Convenience” its entries last only for the current session; it reports no events. Published cards also keep a copy of the card’s files in your browser’s cache via their service worker, so that they open even without a connection.

AI assistant (MCP connector)

If you connect an AI app (such as ChatGPT or Claude) to SchnurPlan through our MCP connector, you sign in via OAuth with your organisation login — organisation ID, username and password, the same as in the app — and choose the scope: read only, or read and write. The assistant never has more rights than you do. We store access tokens only as hashes; they expire and can be revoked. Every authorisation and every write call is recorded in your organisation’s audit log. Your data stays on our server: the AI provider you connected yourself (such as OpenAI or Anthropic) only receives what the assistant retrieves for the specific request and is itself responsible for its processing there; its terms apply. You can disconnect at any time from within the AI app. Legal basis: performance of contract (Art. 6(1)(b) GDPR).

Recipients

Stripe (payments), Cloudflare (DNS/proxy, R2 download storage, sending our e-mails via Cloudflare Email Service and — if switched on — the Turnstile bot protection), the notification service of the respective browser or device manufacturer (only if push notifications are switched on), the provider of an AI app that you connect yourself through our connector (only what the assistant retrieves for a request), and the provider that operates the servers (name and location): not provided yet.

Retention

Account data until the account is deleted; invoice data according to statutory retention obligations (10 years); audit logs not provided yet.

Your rights

Access, rectification, erasure, restriction, data portability, objection (Art. 15 to 21 GDPR) and complaint to a supervisory authority. Requests to: support@schnursolutions.com. An export of your account data is available on request at any time.