Privacy Policy for the pAIpe App

1. Who is responsible for your data

pAIpe is business software. The app is used by employees and partners of companies that use pAIpe (“your company”). Your account is set up by your company; you cannot register in the app itself.

Your company is the controller within the meaning of Art. 4(7) GDPR for the data you record or retrieve in the app – for example working hours, site diary entries or safety briefings. We process this data as a processor under Art. 28 GDPR, solely on your company’s instructions and on the basis of a data processing agreement. Please direct questions and requests about this data to your company; if they reach us, we forward them.

Where we process data for our own purposes – to operate the app and our servers securely – we are the controller:

Flexhub IT Solutions GmbH
Stubenwald-Allee 21a
64625 Bensheim, Germany
Email: [email protected]

2. Sign-in, device and server logs

You sign in with your email address and password or with your personnel number and PIN. After sign-in, the app stores a session token in the device’s protected storage (Android Keystore or iOS Keychain) so that you stay signed in.

If the device is registered with your company (device pairing), the app transmits a randomly generated device identifier, the device name, the operating system and its version, and the app version. This information is used to approve and manage the device. The app does not read hardware identifiers such as the IMEI.

With every request, our servers process technically necessary information such as IP address, time and requested address. We use it to provide the service and protect it against misuse (Art. 6(1)(f) GDPR) and keep it only as long as necessary for that purpose.

3. Data you record in the app

Your company decides which functions you see. Depending on what is enabled, the app processes in particular:

• Working hours, absences and timesheets
• Orders and assignments, including service reports
• Site diary entries with text, photos and voice recordings
• Photos and details of vehicles, equipment and installations
• Production, goods receipt, drawings and inspection records, for example on welds
• Safety briefings, work instructions and staff information with read confirmation and handwritten signature
• Accident and incident reports – these may contain information about injuries and thus health data (Art. 9 GDPR)
• Messages to colleagues (chat)

The legal basis is usually the performance of your employment or service relationship and compliance with your company’s legal obligations, for example in occupational safety (Art. 6(1)(b) and (c) GDPR, for health data Art. 9(2)(b) GDPR). Your company decides how long the data is kept. When its contract with us ends, we delete the data as instructed by your company.

4. Access to your device

The app asks for a permission only when you use a function that needs it. You can refuse any permission and revoke it at any time in the device settings; only the affected function is then unavailable.

• Camera: to scan QR codes and barcodes and to take photos. Codes are evaluated on the device; photos are only transmitted when you save them.
• Location (precise or approximate): only while you are using the app and only for specific actions – when you create a site diary entry or an inspection record, start navigation to an order (to estimate the travel time) or take over the site location of a new project. There is no background location tracking and no movement history.
• Microphone: for voice recordings in the site diary. Recording runs only while you have started it.
• Contacts: to take over a single contact that you select as customer details (name, phone number, email address, postal address). The address book as a whole is not transmitted.
• Photos and files: via the system picker; the app only receives what you select.
• Notifications: for push notifications (see section 5).

5. Push notifications

For push notifications we use Firebase Cloud Messaging by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). For this purpose the app receives a notification identifier, which we store with your account. The title and short text of a notification pass through Google’s servers. This may involve a transfer to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR).

We do not use other Firebase services such as Analytics or Crashlytics. You can turn off notifications in the device settings.

6. AI functions

Some functions use artificial intelligence: voice recordings in the site diary are transcribed and structured, service reports are drafted, documents and photos are analysed. For this we use Microsoft’s Azure OpenAI Service (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) in data centres within the EU. Microsoft does not use the content to train its models. Your company decides whether AI functions are available.

7. Transmission and storage location

The app transmits all data encrypted (TLS). The pAIpe servers are located in Germany. Traffic passes through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which protects our servers against attacks and forwards the connections; in doing so, Cloudflare processes the transmitted data. Cloudflare is certified under the EU-US Data Privacy Framework.

Emails, for example to reset your password, are sent via Brevo (Sendinblue GmbH, Cologne) within the EU.

8. Data on the device

Without a network connection, the app temporarily stores recorded working hours, site diary entries and photos on the device and transmits them as soon as a connection is available again. When you sign out, the app deletes the data stored on the device; if entries have not yet been transmitted, it warns you first. Uninstalling the app removes all of its data from the device.

9. No advertising, no tracking

The app shows no advertising, contains no advertising or analytics services and does not share data for advertising purposes. We do not sell data.

10. Deleting your account

Your account is managed by your company. If you want your account and the associated data deleted, please contact your company or write to us at [email protected] – we will then coordinate the deletion with your company. Data that your company must retain for legal reasons (for example records of working time or safety briefings) can only be deleted once these periods have expired.

11. Your rights

You have the right to:

• Access to your stored personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)

For data we process on behalf of your company, your company is your point of contact. You may also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

12. Changes

If the app’s functions or the service providers we use change, we will update this privacy policy. The version published here applies.