Privacy Policy

This privacy policy explains how Highcovery processes personal data when you visit our website or use our mobile app. A separate privacy policy applies to the Partner and Affiliate Dashboard.

I. Data Controller

The controller within the meaning of the GDPR is:
Leonardo Antonio Carta
c/o Emperon Studio GmbH
Sachsenring 51a
50677 Cologne
Germany
Email: leonardo@highcovery.com
Phone: +49 221 27645575

We have not appointed a data protection officer, as there is no legal obligation to do so.

II. Your Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before withdrawal remains unaffected

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, simply send a message to the email address above. Since we do not collect names or email addresses in the app, we may only be able to identify data linked solely to a device identifier if you provide that identifier (Art. 11 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

III. Hosting and Server Log Files

We operate our website, the app interface (API), databases, search index, image storage, email server, backups and server log files on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Finland (Helsinki); backups are stored at Hetzner in the EU. Hetzner processes the data solely on our behalf; we have concluded a data processing agreement with Hetzner under Art. 28 GDPR.

Each time you access our website and each time the app sends a request to our servers, the following data is processed automatically and stored in log files:

• IP address of the requesting device
• Date and time of access
• Name and URL of the retrieved file or endpoint, including the parameters transmitted (for example search terms, filters and, if you have granted location access, coordinates)
• HTTP status code and response time
• Website from which access occurred (referrer URL)
• Browser or app version and operating system used (user agent)

Legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in establishing the connection, system security, error analysis and operational stability. Logs of the app interface are deleted automatically after 30 days. Our web server (Apache) logs requests without the IP address but with the address called, referrer and browser identifier. Our upstream proxy server logs requests with the IP address. Both logs are rotated by size and are usually overwritten after a few days, after 30 days at the latest. Passwords, access tokens, codes, email addresses, push tokens and device identifiers are masked before logging. From order notifications from shops we log the order number, click identifier, amounts, currency, voucher code used and refund identifier (30 days); names, contact, address and payment details of customers are not logged.

Error Monitoring with Sentry

To detect and fix technical errors, we use the Sentry service of Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, on our servers. When an error occurs or the performance of a request is measured, technical information about the request is transmitted to Sentry: the address called without parameters, time, browser or app identifier, technical request headers (Host, Content-Type, Accept), the referring page (referer) without parameters and the error message. Performance measurements cover only a sample of ten per cent of requests. We do not transmit your IP address, cookies or form input. The data is stored in a data centre in the EU (Frankfurt am Main).

Legal basis is Art. 6(1)(f) GDPR (legitimate interest in error-free operation). A data processing agreement under Art. 28 GDPR is in place with Sentry. For transfers to the US, see Section VII. Error data is deleted by Sentry after 30 days.

IV. Processing When Visiting Our Website

1. Cookies and Local Storage

On our website we only use cookies and storage entries that are strictly necessary:

• `hc_cookie-settings`: stores your choice in the cookie notice (lifetime 365 days)
• `hc_age-gate`: stores your confirmation that you are of legal age for age-restricted content (lifetime 30 days)
• `hc_lookbook`: access cookie for password-protected lookbook content, if you enter a password (lifetime 30 days)
• `NEXT_LOCALE`: stores your language choice (lifetime until the end of the session)
• Entries in your browser's local storage (localStorage and sessionStorage), for example that you have closed the app banner or have already seen the discovery wheel

This storage is strictly necessary to provide the functions you request (§ 25(2) no. 2 TDDDG). Legal basis for the subsequent processing is Art. 6(1)(f) GDPR.

2. Audience Measurement with Umami

We use the open-source software Umami to produce statistics on the use of our website. We host Umami ourselves on our own infrastructure at Hetzner (analytics.highcovery.com); no data is transmitted to third parties. Umami does not set cookies. To distinguish visits, a checksum is generated from the IP address, browser identifier and a regularly changing random value; the IP address itself is not stored. We record pages viewed, referrer, browser, operating system, device type, country, scroll depth and time spent on the page, as well as interactions with features of the page (for example clicks on app store links, use of the discovery wheel, the random strain and the growing guide, and clicks on suggested products). URL parameters (the part of the address after the "?") are not transmitted. Clicks on external links are recorded only with the target host and path. If you complete the growing guide on the website, we record this together with the profile you selected. No cross-device user profiles are created.

Legal basis is Art. 6(1)(f) GDPR (legitimate interest in designing our offering to meet demand). Statistics data is deleted after 25 months. For the counting of views and search terms, see Section V no. 5, which also applies to the website.

3. Forwarding to Partner Shops (Affiliate Links)

On our website and in the app we link to offers from businesses and online shops. Highcovery receives a commission for some links if an order is placed via the link. When you click such a link, we store:

• a randomly generated click identifier (click ID)
• time, business or product, platform (web, iOS, Android), country and language
• for clicks in the app: the app identifier (user agent) and a hashed version of your IP address (pseudonymised)
• for clicks on the website: only for links to a business (not for product links) the referring page (referrer); for this purpose the link is routed via our server

The click ID and our partner identifier are appended as parameters (for example hc_cid, hc_pid) to the partner shop's address. The partner shop may store the click ID in a cookie on its own domain (lifetime up to 30 days) and, when an order is placed, reports the order number, net value of goods, currency, country of the billing address and status changes to us; we also store the commission and the status (pending, confirmed, cancelled, invoiced). For orders in another currency, we additionally store the amount in the original currency and the conversion rate. We neither store nor log names, addresses, contact details or payment details of customers. The respective shop is responsible for setting this cookie and for obtaining any consent required; its own privacy policy applies.

For some partners the link first passes through the tracking of an affiliate network through which the partner runs its affiliate programme. The network processes data such as IP address and browser identifier independently; its privacy policy applies.

Legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the correct settlement of commissions and in detecting misuse. Click data is anonymised after 13 months. Data on settled commissions is retained for eight years from the end of the invoice year to comply with tax retention obligations (Art. 6(1)(c) GDPR); orders that were not settled or never paid are anonymised after 24 months. We store the IP address only as a checksum (hash); it is therefore pseudonymised but not anonymous.

4. Contacting Us

If you contact us by email, we process the data you provide (email address, where applicable name, phone number and content of the enquiry) in order to answer your enquiry. Legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. We delete the data once the enquiry has been dealt with and no statutory retention obligations apply. We operate our mailbox and outgoing email with our own mail server on our servers at Hetzner Online GmbH (see Section III); no other service providers are involved.

If you apply for a job with us (for example by email to jobs@highcovery.com), we process the data you submit (in particular contact details, CV, references and other application documents) in order to carry out the application process. Legal basis is § 26 BDSG in conjunction with Art. 88 GDPR or Art. 6(1)(b) GDPR. We delete your application data no later than six months after the application process has been completed, unless you are hired or have consented to longer retention.

5. Links to Social Networks and App Stores

On our website we link to our profiles on Instagram, LinkedIn and X and to the app stores. These are plain links; data is only transmitted once you click a link. The privacy policy of the respective provider then applies.

V. Use of Our Mobile App

Our app is for discovering businesses, products and strains and serves as a growing guide. No user account is required and none is offered in the app: we collect neither names nor email addresses in the app.

1. Distribution via the App Stores

The privacy policies of the respective store (Apple App Store or Google Play Store) apply to downloading the app. We have no influence over the processing that takes place there.

2. Device Identifier

New installations of the app do not receive a device identifier. Older installations from earlier app versions may still have a random identifier (UUID) that our server generated at the time and stored in our database together with the language, the country and the time. As the country we use the country of your device or of the location you have selected. Such an identifier is kept in protected storage on your device and is still checked against our server when the app starts; we record the time of last use when doing so. With every request, the app also transmits the language and country so we can serve content in the appropriate language and region. The identifier contains no information about you personally and is not combined with other data about you.

Legal basis is Art. 6(1)(f) GDPR (legitimate interest in technical operation and correct delivery of content). When you uninstall the app, any existing identifier is deleted from your device; the entry in our database is deleted once the identifier has not been used for twelve months. If you have allowed push notifications, the entry remains for as long as that permission applies. If you uninstall the app, the device is removed on the next delivery. If you only turn off notifications in the system settings, you will no longer receive notifications; the device entry then remains until it is deleted in accordance with Section VIII.

3. Push Notifications

If you consent to push notifications, we store a push token as well as the platform, the operating system version of the device, language, country and the version of the app interface. If your installation still has a device identifier (no. 2), we link this data to that identifier. We also store on our server, for each push device, which notifications have already been read so we can show you an overview. Whether you have already seen notices within the app is stored only locally on your device. Delivery is performed from our servers via the Apple Push Notification service (Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA) and Firebase Cloud Messaging (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); these services are technically necessary to deliver notifications to your device.

You can disable notifications at any time in your device's system settings. Legal basis is your consent under Art. 6(1)(a) GDPR. If Apple or Google reports a push token as invalid (for example after uninstalling), we delete it on the next delivery.

4. Location Data

If you grant location access, we determine your device's coordinates in order to show you businesses and products nearby and to calculate distances. The coordinates are transmitted to our server with the respective request for this purpose. They are not stored in association with your device or device identifier, but are contained in our server logs as part of the request for 30 days (see Section III). Access occurs only while the app is in use; no background location tracking takes place. Alternatively, you can enter an address manually; this address and your chosen search radius are stored only locally on your device.

To convert your coordinates into an address, we use your operating system's location services. This may transmit data to Apple or Google; we have no influence over that processing.

If you enter or search for an address manually, the app sends the text you enter directly to the Nominatim service of the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, in order to find matching addresses and their coordinates. Your IP address is also transmitted. An adequacy decision of the European Commission exists for the United Kingdom. The OpenStreetMap Foundation's privacy policy applies (https://osmfoundation.org/wiki/Privacy_Policy).

You can withdraw location access at any time in your device settings. Legal basis is Art. 6(1)(a) GDPR.

5. Search and Usage Statistics (Website and App)

To improve our offering and provide reach figures to our partners, we count on the website and in the app how often businesses and products and, in the app, strains are viewed. Only the content viewed, country, language, platform and time are stored, without IP address, without browser or app identifier (user agent) and without reference to your device identifier. We store search terms entered in aggregated form with their frequency, country, language and the time of first and last use, without platform and without reference to any person. Search terms that are searched frequently (more than ten searches) are shown to other users as search suggestions. Please do not enter personal information in the search. Section IV no. 3 applies accordingly to clicks on links to partner shops. Legal basis is Art. 6(1)(f) GDPR.

6. Saved Items and Growing Guide

Businesses and products you save, as well as your grow plan (your answers in the growing guide, start date, checklists), are stored exclusively on your device. To suggest suitable seed products, the website and the app transmit your answers in the growing guide without a device identifier as parameters of the request to our server (highcovery.com/web-api/grow-match); they are not stored there, except for up to 30 days in the logs described in Section III.

7. External Content and Links

If you request directions to a business, the app opens Google Maps (Google Ireland Limited) with the business's coordinates. Links to partner shops and articles open in your device's browser or in-app browser. From that point on, the privacy policy of the respective provider applies.

8. No Analysis of User Behaviour

We use no third-party analytics, tracking, crash-reporting or advertising services in the app. No cross-device profiling takes place.

VI. Recipients and Processors

We disclose data only where necessary to provide our services or where required by law. We have concluded data processing agreements under Art. 28 GDPR with service providers that process data on our behalf.

• **Hosting:** Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (servers in Helsinki, Finland; backups at Hetzner in the EU). On these servers we operate the website, app interface, databases, search index, image storage, audience measurement, email server, backups and server log files. Processor with an agreement under Art. 28 GDPR.
• **Error monitoring:** Functional Software, Inc. (Sentry), USA, data stored in the EU. Processor.
• **Delivery of push notifications:** Apple Inc. and Google Ireland Limited, provided you have enabled notifications.
• **Address search:** OpenStreetMap Foundation (Nominatim), United Kingdom, if you enter an address.
• **Partner shops and, where applicable, affiliate networks:** click ID when you open a partner link (see Section IV no. 3); the shops are independent controllers.

Beyond this, we use no external service providers for the website and app.

VII. Transfers to Third Countries

Transfers to countries outside the EU or EEA may occur in the following cases:

• **Push notifications:** when delivered via Apple or Google, data may be transmitted to servers in the United States.
• **Sentry:** data is stored in the EU; access by the US-based parent company cannot be ruled out.
• **Nominatim:** transfer to the United Kingdom on the basis of the European Commission's adequacy decision (Art. 45 GDPR).

For the United States, an adequacy decision of the European Commission exists (EU-US Data Privacy Framework, Art. 45 GDPR) insofar as the recipient is certified under it. Apple Inc., Google LLC and Functional Software, Inc. are certified under the Data Privacy Framework. In addition, transfers are based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

VIII. Retention

We store data only for as long as necessary for the purposes stated or as required by statutory retention periods. In detail:

• Logs of the app interface: 30 days
• Web server log files (without IP address) and logs of the upstream proxy server (with IP address): rotated by size, usually overwritten after a few days, after 30 days at the latest
• Sentry error data: 30 days
• Device identifier with language and country (older installations only; new installations do not receive an identifier): until the identifier has not been used for twelve months; if push notifications are allowed, for as long as that permission applies
• Push token: until withdrawal or until Apple or Google reports it as invalid
• Click data for partner links: anonymised after 13 months
• Audience measurement statistics (Umami): 25 months
• Counted views of businesses, products and strains and aggregated search terms: stored without reference to any person and not deleted separately
• Enquiries by email: until the enquiry has been dealt with and no statutory retention obligation applies
• Application documents: no later than six months after the application process has been completed, unless you are hired or have consented to longer retention
• Data on settled commissions: eight years from the end of the invoice year (§ 147 AO, § 257 HGB); orders not settled or never paid: anonymised after 24 months
• Backups: daily backups that are deleted after six months at the latest; they are stored on our servers and in storage at Hetzner in the EU

IX. Age Limit

Our offering relates to cannabis and is intended exclusively for adults aged 18 and over. Persons under 18 may not use the website or app. We do not knowingly collect data from minors. If we learn that data of a minor has been transmitted to us, we will delete it. The app is rated 18+ in the app stores and asks on first launch whether you are of age; the answer is stored only on your device.

X. Obligation to Provide Data

You are under no legal or contractual obligation to provide us with personal data. However, the website and app cannot be used without the technically necessary connection data (Section III). Without location access or notifications, only the respective functions are unavailable.

XI. Changes to This Privacy Policy

We update this privacy policy when the legal situation or our offering changes. The version available on this page applies.