Privacy

Last updated: 31 October 2026

1. Controller

StayNature GmbH, Schürrstraße 1, 91074 Herzogenaurach, Germany, represented by Managing Director Josia Emmering. For privacy questions and requests to exercise your rights: staynature@gmx.de, phone +49 175 7991526.

2. Hosting and technical access data

This website is hosted with ChatGPT Sites. Under the hosting terms, OpenAI acts as a processor for personal data hosted on our behalf; for customers in the European Economic Area, the contracting party is OpenAI Ireland Ltd. Cloudflare infrastructure is used for technical delivery. IP address, time, requested URL, device, browser and connection information may be processed to deliver the site, resolve errors and protect against abuse. The legal basis is our legitimate interest in a reliable and secure website (Article 6(1)(f) GDPR).

Hosting is governed by the ChatGPT Sites Terms and the applicable data processing agreements, including the ChatGPT Sites Data Processing Addendum. Other sub-processors are described in the OpenAI Sub-Processor List. Where data is processed outside the EEA, the agreements provide for adequacy decisions or appropriate safeguards, including EU Standard Contractual Clauses, as applicable. Storage exclusively in Germany is not promised.

Access and security data are processed for as long as necessary for delivery, security and legal obligations. The hosting agreements cover processing during the contract and the time needed to fulfil obligations after its end, including deletion. They do not specify one fixed retention period in days for all technical logs. Our application does not maintain its own visitor database.

3. Enquiries and email contact

Your name, email, project choice and message are initially processed in your open browser. The enquiry button passes the information to your email app. We receive it only when you send the message yourself. There is no server-side form submission or form database. The receiving mailbox staynature@gmx.de is provided by GMX. Email service providers process data needed to send and receive messages.

We process incoming messages to reply and, where applicable, take pre-contractual steps at your request (Article 6(1)(b) GDPR), or in our legitimate interest in handling other correspondence (Article 6(1)(f) GDPR). Correspondence is deleted when no longer needed unless statutory retention duties or overriding legitimate interests apply. Business and tax records are subject to the relevant legal retention requirements. Providing information is voluntary; without a reachable address, we cannot reply personally.

4. Website import and design preview

When you start the preview with your domain, the public domain is sent to our server. It retrieves the home page and up to two public stylesheets to identify names, text, logos, image addresses, colours and a suggested site category. No logins are used and no scripts from the other site are executed. Enter only public website addresses, never access credentials. Processing serves your requested preview or pre-contractual steps (Article 6(1)(b) GDPR).

Images initially load through a server request limited to image content; login cookies are not forwarded. If that request fails, your browser may load the validated public original URL without a referrer. The image provider then receives the connection data needed for that request.

The detected profile, including your corrections, remains in this browser tab’s sessionStorage for up to two hours to support language changes and project steps. Once expired, it is discarded on the next access, and closing the tab removes it. Complete HTML pages are not saved to a database. When moving between preview, pricing, enquiry and brief, the public domain, project name and design/package selection may be included in the URL fragment. Fragments are not sent to the web server as part of the HTTP request but are visible in the browser address. Storage supports the preview function you expressly requested (Section 25(2)(2) TDDDG).

5. Favourites, project brief and local storage

Only when you choose “Save favourite on this device” does the application store the design direction, project type, package level, scope and number of languages in your browser’s localStorage. Names, domains, contact details and briefing text are not stored there. This requested remember function persists until you delete it using “Delete favourite” or your browser settings (Section 25(2)(2) TDDDG).

Briefing answers initially remain in the open browser and are lost on reload. You can download the brief as text and as a structured file. Only uploading these files yourself through a separately provided Dropbox file request sends them to us. Merely opening the link does not upload files. Dropbox transfer and storage are also subject to the Dropbox privacy notice. Processing a commissioned project brief serves contract performance (Article 6(1)(b) GDPR). Do not enter passwords, access codes or personal guest data. You manage and delete downloaded files yourself. The copy function writes to your clipboard only on your click.

6. Analytics, advertising and external content

The application code uses neither Google Analytics nor Google Ads tracking or other analytics and advertising trackers. No external fonts, maps or videos are embedded automatically. Technically necessary hosting and access functions are separate. No additional marketing consent is requested while no such optional services are used.

External information and upload pages open only when you follow their links. Their providers receive connection data required for the request. The respective providers’ privacy notices apply.

7. Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests under Article 21 GDPR. Any consent given may be withdrawn at any time for the future.

You may complain to a data protection supervisory authority, in particular the Bavarian State Office for Data Protection Supervision.

8. Automated decisions

This website does not use automated decision-making with legal or similarly significant effects. The design and package preview is non-binding guidance; commissioning takes place separately.