Privacy notice

Last updated: 3 November 2026

This is a translation. The German version is legally binding.

This notice explains which personal data we process when you use our platform or our websites, why, on what legal basis, who receives it and how long we keep it.

1. Controller

Silvio Altmann
c/o MDC#2159
Welserstraße 3
87463 Dietmannsried
Germany
E-mail: [email protected] · Contact form

We are not required to appoint a data protection officer. For any data protection question, write to the address above.

2. What this notice covers

It covers the OmSuati platform at omsuati.com, app.omsuati.com, marut.app, app.yachtplaner.de and dituri.app, and our websites yachtplaner.de, saltsweatsilence.com and taxelicious.com.

Groups and clubs. When a club or other organisation uses the platform for its members, it is responsible for its group's data. We then process that data on its behalf (Art. 28 GDPR). Questions about that data are best sent to the group itself; we forward requests to it.

3. Where the data is stored

All servers are in data centres of Hetzner Online GmbH (Gunzenhausen) in Nuremberg and Falkenstein, Germany. Development and error data is at Hetzner in Helsinki, Finland.

Encrypted backup copies are also kept on the controller's own hardware in Naunhof, Germany.

Photos, documents and speech recognition run on our own servers: photos (Immich), documents (Paperless), video calls (LiveKit) and speech-to-text (Whisper). This data does not leave our servers for these purposes.

4. What we process and why

4.1 Visiting the websites

When you open one of our pages, we process technical data: IP address, date and time, the address requested, browser and operating system. This is needed to deliver the page and protect it against attacks.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service).
• All traffic passes through Cloudflare (see section 6).

4.2 Account and sign-in

For an account, we store your e-mail address, your password (only as an encrypted hash), your name, your language and time zone, and the settings you choose. When you sign in, we store the session with IP address and browser identifier to protect your account.

• Legal basis: Art. 6(1)(b) GDPR (the user agreement).

4.3 Your content and groups

We store what you and your groups create on the platform: plans, tasks, notes, messages, appointments, places, photos, documents, expenses and participations. You and your group's administrators decide who may see what.

We keep older versions of an entry as history (up to 100 versions per entry), so changes can be traced and undone.

• Legal basis: Art. 6(1)(b) GDPR.

4.4 Public pages

You can create your own public page (for example marut.app/@yourname) with your name, text, trips, stories, photos and places. You decide whether it is off, reachable only by link, or visible to everyone, and whether search engines may find it.

• Legal basis: Art. 6(1)(a) and (b) GDPR. You can switch the page off at any time.
• Only show photos of other people if they agree.

4.5 Location

We only ask for your location when you tap a feature for it, for example "Use my location". Your browser asks for your permission first. We use the location in the browser or look up the place name (see Maps); we only store it if you enter it as a place yourself.

• Legal basis: Art. 6(1)(a) and (b) GDPR.

4.6 Maps and routes

To show a map, your browser loads map images directly from these services. They receive your IP address and the map area shown:

• OpenFreeMap (tiles.openfreemap.org)
• OpenTopoMap (tile.opentopomap.org)
• Mapterhorn (tiles.mapterhorn.com), for elevation data
• CARTO (basemaps.cartocdn.com), only in the route planner
• Open-Elevation (api.open-elevation.com), only when you choose "fill elevation" for a track

Place search and routes are requested by our servers on your behalf: Photon by komoot (Germany) and openrouteservice by HeiGIT (Heidelberg). They receive only the search term or the coordinates, not your IP address.

• Legal basis: Art. 6(1)(b) and (f) GDPR (a map cannot be shown without these requests).

4.7 Photos

We store photos with their metadata, for example where and when they were taken. Our photo manager (Immich) detects faces on our own servers to group photos of the same person. This data does not leave our servers.

• Legal basis: Art. 6(1)(b) GDPR.

4.8 AI features

Some features use AI models from Anthropic (Claude):

• AI assistants in chats: your message, the conversation so far (up to 20 messages) and the group's entries the assistant reads for its answer.
• Reading a receipt photo: the photo of a receipt, to recognise its items.
• Suggestions from a chat message: the text of the message.
• Greeting in a voice call: your next plans and open items.
• Translations: titles and texts of entries.

Messages from an AI assistant are labelled as such. Anthropic processes the data on our behalf and does not use it to train its models.

In voice calls and coaching sessions, Mistral AI (France) produces the spoken replies and notes from the conversation.

• Legal basis: Art. 6(1)(b) GDPR.

Claude connector. You can connect your account to your own Claude account at Anthropic. Claude then reads, on your behalf, what you yourself are allowed to see. Anthropic's privacy terms for your Claude account apply to that.

4.9 Video and voice calls

Video calls run on our own server (meet.omsuati.com, Germany). We process picture, sound, your name and your IP address. Calls are recorded only with the consent of everyone taking part.

In coaching sessions, our own server turns speech into text and stores the transcript as a note of the session.

• Legal basis: Art. 6(1)(b) GDPR; recordings Art. 6(1)(a) GDPR.

4.10 E-mails and notifications

For sign-in e-mails, invitations, reminders and notifications we use the e-mail service Resend (Resend, Inc., USA; sent through Amazon Web Services in Ireland). It receives your e-mail address, your name and the content of the message. Replies to our e-mails also arrive through Resend.

Links in e-mails go through a short address (suati.link). We count whether a link was opened.

If you connect a Zoho mailbox to write from a group in your name, we store the access key encrypted. The e-mails then go through Zoho Mail (EU data centre).

• Legal basis: Art. 6(1)(b) GDPR.

4.11 Push notifications

If you allow notifications on your device, they travel encrypted through your browser's push service: Google (Chrome, Android), Apple (Safari), Mozilla (Firefox) or Microsoft (Edge). A notification contains, for example, the title of a plan or the start of a message.

• Legal basis: Art. 6(1)(a) GDPR. You can withdraw the permission at any time in your browser or in the settings.

4.12 Calendar subscription

If you subscribe to your plans in a calendar (Google, Apple, Outlook), that service fetches them from us regularly through a secret address. The calendar service's own terms apply to the data it holds.

4.13 Forms

For each consent, we store the time, the wording and its version. We do not store your IP address with it. To prevent abuse, we briefly count requests per IP address in memory.

4.14 Audience measurement

We count page views with Umami, which runs on our own server. Umami sets no cookies and stores no IP address. It records the page viewed, country, browser, operating system, device type, screen size and language. If your browser sends "Do Not Track", we don't count you.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving our service). You can object at any time, for example with "Do Not Track".

4.15 Error reports

If an error occurs in the browser or on the server, we receive an error report: the error message, the address opened, browser, operating system and the last steps before it. The report does not say who you are. GlitchTip processes the reports on our own server.

• Legal basis: Art. 6(1)(f) GDPR.

4.16 Embedded content

If an entry contains a YouTube video or Spotify content, your browser loads it directly from Google (YouTube) or Spotify. These providers receive your IP address and can set cookies.

• Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG.

5. Cookies and browser storage

We only use cookies and browser storage that the platform needs (§ 25(2) no. 2 TDDDG):

• Sign-in cookie: keeps you signed in.
• Language cookie (om-lang): remembers your language, 1 year.
• Browser storage (local storage, IndexedDB): a cache of your groups and entries, so the platform loads fast and shows something offline, plus view settings.

When you sign out, we delete the sign-in cookie, the language cookie and the cache of your data. We set no advertising or tracking cookies. Fonts are delivered from our own servers.

6. Recipients

We only pass data on where the purposes above require it. All service providers process it on our behalf under Art. 28 GDPR:

Map services, push services, calendar services and embedded content receive data as described in section 4.

7. Transfers to the USA

Cloudflare, Anthropic and Resend are based in the USA. We base these transfers on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can get a copy on request.

8. How long we keep data

• Account and content: until you delete them or have your account deleted. Group content until the group deletes it.
• History of older versions: up to 100 versions per entry, deleted with the entry.
• Requests through forms: until the request is dealt with, at most 2 years, unless a contract results.
• Technical logs of the platform: 7 to 60 days.
• Error reports: 90 days.
• Backup copies: 14 to 30 days.
• Booking and billing data: as long as tax and commercial law require (up to 10 years).

9. Your rights

You have the right to

• access your data (Art. 15 GDPR),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• withdraw consent with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR). Where we process data on the basis of a legitimate interest (Art. 6(1)(f)), you can object at any time on grounds relating to your particular situation.

Write to us at [email protected] or through the contact form.

Complaints. You can complain to any data protection supervisory authority. The authority responsible for us is:

Die Sächsische Datenschutz- und Transparenzbeauftragte
Maternistraße 17, 01067 Dresden, Germany
Postal address: Postfach 11 01 32, 01330 Dresden
E-mail: [email protected]

10. Required information

For an account we need your e-mail address and your name. Without them you cannot use the platform. Everything else is voluntary.

11. No automated decisions

We make no decisions based solely on automated processing that affect you legally (Art. 22 GDPR).

12. Changes

If our services or the law change, we update this notice. We tell you about significant changes by e-mail.