Privacy policy

Status: August 22, 2026

1. Responsible person

General contact and data protection inquiries: info@simadoo.com
Technical support: support@simadoo.com

2. Accessing the website and IONOS web hosting

This website is hosted by IONOS SE. When you access the website, the hosting service processes the technically necessary connection data so that the requested content can be transferred to your device and secure, stable operation can be guaranteed. According to IONOS, the referrer, requested website or file, browser type and browser version, operating system, device type, access time and an anonymized IP address are recorded.

The processing is carried out on the basis of Article 6 Paragraph 1 Letter f GDPR. Our legitimate interest lies in the secure, stable and error-free provision of this website. IONOS specifies a storage period of eight weeks for visitor data. According to IONOS, this visitor data will not be passed on to third parties and will not be transferred to countries outside the European Union.

Information from IONOS on data processing through web hosting products

3. IONOS WebAnalytics

IONOS WebAnalytics is taken into account for the IONOS web hosting used. IONOS states that tracking and logging are activated by default and the determination takes place either via a log file or a pixel. No client-side analytics script or external analytics pixel was detected during the technical review of this website; Server-side access logs are in place.

According to IONOS, WebAnalytics does not use cookies. The IP address transmitted when you access the page is immediately anonymized after transmission and then processed without any personal reference. The referrer, requested page or file, browser type and browser version, operating system, device type, access time and the anonymized IP address are recorded. The data is used exclusively for statistical evaluation and technical optimization of the website. IONOS states that it does not store any personal visitor data in WebAnalytics and does not pass on any data to third parties.

If the short-term processing of the IP address until anonymization is personal, it is carried out on the basis of Art. 6 Para. 1 Letter f GDPR. Our legitimate interest lies in the technical optimization and needs-based design of the website.

Information from IONOS about WebAnalytics

4. WordPress and IONOS system components

The website is powered by WordPress. IONOS components for hosting integration, security, performance, cache and administrative login as well as technically necessary must-use components are also active. They support the operation and security of the WordPress installation. When checking the publicly accessible pages, no additional requests to third-party providers, no publicly set cookies and no entries in local storage or session storage were triggered.

5. Cookies and storage in the browser

According to the current state of technology, the publicly accessible pages do not set cookies and do not store any information in local storage or session storage. No analysis, advertising, newsletter, shop or payment functions are used. Therefore, no consent banner is currently displayed.

WordPress can set technically necessary login and session cookies when you log in to the non-public administration area. These do not affect regular visitors to the public website.

6. Local media and external content

Logo, symbols and SiMaDoo screenshots are loaded locally from this web server. The screenshots contain only fictitious sample data. External fonts, embedded videos, maps, social media plugins or comparable third-party content are not integrated.

The data protection declaration contains normal links to IONOS information pages and to the responsible data protection supervisory authority. Only when you access such an external link does your browser establish a connection to the respective provider. The respective provider is responsible for the processing there.

7. Contact via email

If you contact us by email, we process the information you provide, in particular your email address, the content of the message and the associated communication data, in order to process and respond to your request.

If your request relates to a contract or pre-contractual measures, Art. 6 Paragraph 1 Letter b GDPR is the legal basis. For other inquiries, processing is carried out on the basis of Article 6 Paragraph 1 Letter f GDPR; Our legitimate interest lies in properly answering inquiries about SiMaDoo. Email service providers involved in email transmission can process the data to the extent this is technically necessary.

We delete the data when the request has been finally processed and there are no legal retention obligations or other legal reasons for further storage.

8. Encrypted transmission

The website is transmitted via HTTPS. This means that the content transmitted between your browser and the web server is encrypted during transport.

9. Your Privacy Rights

In accordance with the legal requirements, you have the right to information about your personal data (Article 15 GDPR), correction of incorrect data (Article 16 GDPR), deletion (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and objection (Article 21 GDPR). You can revoke your consent at any time with future effect. To exercise your rights, simply send a message to info@simadoo.com.

10. Objection to processing based on legitimate interests

You can object to processing based on Article 6 Paragraph 1 Letter f of the GDPR at any time for reasons relating to your particular situation. We will then no longer process the data concerned unless there are compelling legitimate reasons or the processing serves to assert, exercise or defend legal claims.

11. Right to complain

You have the right to complain to a data protection supervisory authority. The Hessian Commissioner for Data Protection and Freedom of Information is particularly responsible for the location of the person responsible. Information and the complaint form can be found at datenschutz.hessen.de/service/beschwerde-uebermittel.

12. Automated decisions

There is no automated decision-making or profiling on this website.

13. Changes to this Privacy Policy

This data protection declaration will be adjusted if the technology used, the website domain or the legal requirements change.

14. Voluntary SiMaDoo AI assistant

14.1 Purpose and deliberate activation

The assistant, clearly identified as AI, is an optional help feature for general questions about using SiMaDoo. Before a question is transmitted, the user must explicitly confirm in the chat window that it may be sent for processing by the AI service. No question is sent without this confirmation. Consent may be withheld or withdrawn for future questions by closing the assistant or clearing the confirmation; all other functions remain available.

14.2 Data, services and recipients

A request sends the entered question, selected language and internal name of the currently visible SiMaDoo area through a protected Firebase Cloud Function to the OpenAI Responses API. For authentication and protection, Firebase Authentication, App Check with reCAPTCHA Enterprise, Cloud Functions, Cloud Firestore, Secret Manager and Cloud Logging also process the signed-in session's user ID, App Check attestations, timestamps and usage counters, and technically necessary connection, status and error data. Recipients or processors are Google Ireland Limited and affiliated Google companies, and OpenAI Ireland Limited and their subprocessors.

Cashbox, event, member, booking, receipt, contact or other user data is not automatically read from SiMaDoo or sent to OpenAI. Previous chat history is not automatically attached again. Personal or confidential information may nevertheless be transmitted if the user writes it into the input field.

14.3 Legal basis and international transfers

The voluntary question is processed on the basis of consent under Article 6(1)(a) GDPR. Security, abuse-prevention and rate-limit data is also processed on the basis of our legitimate interest in a safe and stable service under Article 6(1)(f) GDPR. Google and OpenAI may process data outside the EEA, particularly in the United States. Depending on the processing, transfers rely on an adequacy decision including the EU-US Data Privacy Framework or appropriate safeguards such as the EU Standard Contractual Clauses.

14.4 Storage and deletion

SiMaDoo does not store the question or answer in cashbox, event or user data and does not log their content in server logs. The displayed chat remains only in the running browser page and is not stored as chat history in local storage. Cloud Firestore stores only user-linked counters and timestamps for rate limiting. There is currently no separate automatic deletion period for this counter; it is updated during later use and deleted when no longer required for protection and rate limiting or following a justified deletion request unless a retention duty applies. Technical Cloud logs contain request ID, model, token counts, status and error codes, but not the question or answer, and are deleted under the retention settings configured for the Google Cloud project.

The OpenAI request uses store: false. This means that the response is not stored as application state for later retrieval through the API. It does not exclude all technical processing or logging: under OpenAI's standard data controls, safety and abuse-monitoring logs may generally contain inputs, outputs and technical metadata for up to 30 days, with longer retention where legally required or necessary to prevent abuse. OpenAI does not use API data to train its models by default unless the account holder explicitly opts in.

14.5 Safeguards and sensitive information

Transmission is encrypted. The OpenAI key is held only server-side in Google Secret Manager. An active SiMaDoo session and a valid App Check attestation are required. Inputs are screened for typical email addresses, API keys, invitation codes, IBANs and payment-card numbers; current limits are five requests per minute and 30 per day. Filters cannot identify every sensitive item. Do not enter passwords, credentials, bank or card details, invitation codes, receipts, names or other confidential information.

For privacy matters concerning the AI assistant, contact info@simadoo.com. Further information is available in the OpenAI data controls, the OpenAI Data Processing Addendum and the Firebase privacy and security information.