Privacy policy

1. Controller

2. Scope

This policy applies to the public Vorrio project website. Vorrio itself is a self-hosted application. The operator of each third-party Vorrio installation is solely responsible for its data processing. Product-specific information is available in the product privacy documentation.

3. Provision and hosting

The project website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States. When the website is requested, Vercel processes technically necessary connection and log data. This may include the IP address, timestamp, requested resource, referrer, browser and device information. Processing serves the secure, stable and error-free provision of the website and relies on Article 6(1)(f) GDPR.

Vercel processes data on our behalf under the applicable contractual and data-protection terms. Processing in the United States cannot be excluded. Vercel identifies the EU-US Data Privacy Framework and, where required, the EU Standard Contractual Clauses as transfer mechanisms. Retention depends on the period required for delivery, security, troubleshooting and legal or contractual obligations. Further information is available in Vercel's Privacy Notice and Data Processing Addendum.

4. In-house consent management

We use a self-developed consent manager embedded locally in this website. It does not send data to an external consent provider. To remember your choice, the website stores only whether you allowed or rejected statistics, the applicable consent-request version and the time of your choice under the key vorrio-consent-v1 in your browser. The choice expires after six months and is then requested again.

This storage is necessary to implement your privacy choice and avoid repeated prompts. Where § 25 TDDDG applies, we rely on § 25(2) no. 2 TDDDG. The associated processing serves our documentation and accountability obligations under Articles 7(1) and 5(2) GDPR and relies on Article 6(1)(c) GDPR; additionally, our legitimate interest under Article 6(1)(f) GDPR is to respect your choice reliably. You can change the decision at any time through “Privacy settings” in the footer.

5. Google Analytics 4 and Consent Mode

With your consent, we use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to evaluate page views, scroll depth and clicks on external links. Data processed may include the requested page, referrer, time, browser and device information, session information and an approximate region derived from the IP address. Google states that IP addresses of users in the EU are used for geolocation during collection and discarded before being stored.

The legal basis is your consent under Article 6(1)(a) GDPR and, where information is stored on or read from your device, § 25(1) TDDDG. According to Google, the GA4 cookies _ga and _ga_<container-id> have a default lifetime of up to two years. User-level and event-level retention in our property is limited to two months and is not reset on new activity. Google signals, user-provided data collection, ads personalisation, User-ID and Google Ads are not enabled.

We use Basic Google Consent Mode v2. Before a decision, analytics and advertising consent start as “denied” and the Google tag is not loaded; no cookieless analytics pings are sent. Only consent to “Statistics” grants analytics_storage. Advertising consent values remain denied. Recipients may include Google Ireland Limited, Google LLC and other affiliated companies or processors. Processing in the United States is possible; Google refers in particular to the EU-US Data Privacy Framework and Standard Contractual Clauses.

You can change or withdraw consent at any time with future effect through “Privacy settings” in the footer. Without consent or after withdrawal, this website will not send new analytics data to Google Analytics. See the Google Privacy Policy.

6. Voluntary support through Stripe

Visitors who choose to support Vorrio financially are redirected to a Stripe-hosted payment page only after actively selecting a support button. The project website does not embed a Stripe script and does not transmit payment data to Stripe merely by being visited. On the Stripe page, Stripe processes contact, payment, transaction, device and fraud-prevention data in order to handle the requested one-time or monthly payment. The payment recipient is Amturo UG (haftungsbeschränkt).

Processing required to handle the requested payment relies on Article 6(1)(b) GDPR. Statutory retention and evidence obligations rely on Article 6(1)(c) GDPR, while abuse and fraud prevention rely on Article 6(1)(f) GDPR. Payment and accounting records are retained for the applicable commercial and tax-law periods. Stripe may also process data outside the European Economic Area and describes its transfer mechanisms in its Privacy Policy.

7. External links

The website links to external services, in particular GitHub. A connection to the relevant provider is only established after a visitor follows such a link. The external provider is responsible for its processing. See the GitHub General Privacy Statement for more information.

8. Contact by email or phone

When you contact us, we process the information you provide to handle and answer your request. Article 6(1)(b) GDPR applies where your request concerns a contract or pre-contractual measures. In other cases, processing relies on Article 6(1)(f) GDPR; our legitimate interest is the appropriate handling of your request.

We delete the information once the request has been resolved, unless legal retention obligations or legitimate reasons require further storage.

9. Your rights

Subject to the applicable legal requirements, you have rights including access, rectification, erasure, restriction of processing, data portability and objection. To exercise these rights, email info@amturo.de.

You may also lodge a complaint with a data protection authority. Our competent authority is generally the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

10. Security and updates

TLS encryption is used for the website. We update this policy when hosting, services, law or processing activities change.