Responsible for data processing on this website: Martin Stipsitz Burgenlandstraße 44A / 9 9500 Villach Austria Email: [email protected]
We process your personal data confidentially and in accordance with the applicable data protection laws and this privacy policy. This privacy policy supplements the terms of service of OpenFarmPlanner. For questions about the processing of personal data, this privacy policy is exclusively authoritative. You can use the OpenFarmPlanner landing page without providing any personal data. As soon as you create a user account and use the application, we process the data described in the following sections. For each processing activity, the legal basis stated there under Art. 6(1) GDPR is authoritative.
This application is hosted by the following provider, which acts as our processor: Uberspace GmbH Kaiserstraße 15 55116 Mainz Germany When the application is accessed, the web server processes technical access data:
The web server log files are deleted automatically after 7 days. In addition, we process technical application logs (for example Django or Gunicorn error logs). These primarily contain technical information such as error messages, timestamps, and affected requests; in individual error cases relating to account, login, or invitation management, they may also contain the affected email address, username, or an internal user ID. The logs are used exclusively for troubleshooting and secure, stable operation of the application. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation of the application).
We use the following provider for resolving our domain name (DNS), as a content delivery network (CDN), and for security features such as protection against DDoS attacks: Cloudflare, Inc. 101 Townsend St. San Francisco, CA 94107 USA Where Cloudflare is set up as a reverse proxy in front of our server at Uberspace, requests to the application first pass through Cloudflare's servers. In doing so, Cloudflare processes your IP address and technical connection data (for example the time of the request, the requested resource, and browser and device information) in order to ensure the availability, performance, and security of the website and to block malicious requests.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and available operation of the platform). Cloudflare, Inc. is headquartered in the USA; the transfer is based on the EU Standard Contractual Clauses (see the "Third-country transfers" section). For more information, see Cloudflare's privacy policy (https://www.cloudflare.com/privacypolicy/).
To use OpenFarmPlanner, you can create a user account, either with an email address and password or alternatively via your Google account (see the "Sign-in with Google" section). When registering with an email address and password, the following data may be processed:
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
To prevent abuse and automated mass registrations, we use Cloudflare Turnstile, a service provided by Cloudflare, Inc. (see the "Cloudflare" section), on the registration form. Turnstile uses a behavior-based check, usually invisible to you, to determine whether a registration is carried out by a person or by an automated program (bot); no traditional image puzzles are required. For this purpose, technical device and behavior signals from your browser are transmitted to Cloudflare and evaluated there during the registration process. Turnstile is used exclusively to protect against automated abuse and not for tracking, analytics, or marketing. As it is a technically necessary security measure, no separate consent is required.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the platform and its users against automated abuse). As Turnstile is also operated by Cloudflare, Inc., headquartered in the USA, the transfer is based on the EU Standard Contractual Clauses (see the "Third-country transfers" section). For more information, see Cloudflare's privacy policy (https://www.cloudflare.com/privacypolicy/). This legal basis covers the processing of the transmitted data as such; whether the associated technical storage access in your browser (e.g. a short-lived token set by Turnstile) requires separate consent is governed by section 165(3) of the Austrian Telecommunications Act (TKG), which implements the ePrivacy Directive. Turnstile falls under the exemption for technically necessary measures there, as it serves exclusively the security check you requested by submitting the form.
In addition to registering with an email address and password, you can register and sign in to OpenFarmPlanner with your Google account (Google Sign-In). When you click "Sign in with Google", you are redirected to Google; after signing in successfully with Google, you are redirected back to OpenFarmPlanner.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract by providing an alternative sign-in method). For the transfer to Google, see the "Third-country transfers" section.
Within your projects, we process the project-related data entered by you and other project members. This includes, in particular, master data of the project (e.g. project name, memberships and locations), operational planning and management data for the features in use (e.g. relating to fields, crops, cultivation planning or tasks), and supplementary information such as notes, uploaded files, and the change history, including the display name of the person who made the change. This data is generally visible only to you and the other members of the respective project.
Legal basis: Art. 6(1)(b) GDPR
You can publish individual crop records (for example growing information about a vegetable variety) from a private project into a public crop library yourself. This library is intended as a collaboratively built, permanently maintained knowledge base. Published entries can be viewed by other users, imported into their own projects, and in future reused through features such as version histories, collaborative editing, comments, ratings, public APIs or data exports. Publishing is voluntary and is not required in order to use OpenFarmPlanner. Which rights of use you grant to the general public and to OpenFarmPlanner by doing so is governed by the terms of service, in particular the section "Open licence for published crop data".
Legal basis: Art. 6(1)(b) GDPR, insofar as we make your contribution available in the public crop library on the basis of the terms of service and your explicit act of publication. Insofar as published contributions still contain personal references, for example through the public display name, and we retain them permanently for the integrity and traceability of the collaborative knowledge base, we additionally rely on Art. 6(1)(f) GDPR. Our legitimate interest lies in building and maintaining a reliable open crop database. Purely factual or anonymised crop data does not fall under the GDPR.
We use your email address for:
Legal basis: Art. 6(1)(b) GDPR
OpenFarmPlanner uses only technically necessary cookies. No analytics, tracking, or marketing cookies are used. The cookies are used only to enable logged-in use of the application and to protect requests technically. The specific storage period depends on the server's session and security configuration; session cookies are deleted at the latest when they expire or when you delete them in your browser.
In addition to cookies, the application stores individual technical settings in your browser's local storage (Local Storage/Session Storage). This includes, in particular, the last opened project, view options, sidebar and table states, sorting and filters, hints that have already been shown, and temporarily stored redirects or tokens for project invitations. This data does not leave your device, is not visible to us, and does not contain login credentials. Local Storage data remains in your browser until it is replaced by the application, reset by you in the application, or deleted via browser functions; Session Storage data is usually deleted when the browser tab is closed. Because we do not process this data on our systems, this is not processing of personal data by us within the meaning of Art. 4 No. 2 GDPR; a separate legal basis is therefore not applicable.
Apart from cooperation with our hosting provider as a processor (see the Hosting section), we share your personal data only if: - this is necessary for technical email delivery in connection with your account or project invitations; email delivery uses the mail infrastructure operated by Uberspace, - you sign in or register with your Google account; in that case, Google receives the technical data required for sign-in (see the "Sign-in with Google" and "Third-country transfers" sections), - you access the application or use the registration form; in that case, Cloudflare processes the technical data required for delivery, security, and bot protection (see the "Cloudflare", "Bot protection during registration", and "Third-country transfers" sections), - you actively publish a crop in the public crop library and thereby choose visibility for all logged-in users, including your public display name if you have set one (see the Public crop library section), or - we are legally required to do so, for example toward authorities.
If you sign in or register with your Google account (see the "Sign-in with Google" section), personal data is transferred to Google LLC, headquartered in the USA. To the best of our current knowledge, Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF). The European Commission has determined that an adequate level of data protection applies to data transferred to certified companies (adequacy decision under Art. 45 GDPR of July 10, 2023). You can check the current certification status yourself at any time via the official DPF participant list (https://www.dataprivacyframework.gov/list). When the application is accessed via Cloudflare and during the bot check with Cloudflare Turnstile at registration (see the "Cloudflare" and "Bot protection during registration" sections), personal data, in particular your IP address, is transferred to Cloudflare, Inc., headquartered in the USA. This transfer is based on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR). Beyond that, based on the current assessment, personal data is not transferred to recipients outside the European Union or the European Economic Area. Sign-in with a Microsoft account is prepared in the OpenFarmPlanner source code but not currently activated; it will only become part of this privacy policy once activated.
Providing personal data is neither legally nor contractually required if you only visit the public landing page. For registration and use of the application, your email address, password, and technically necessary cookies are required; without this data we cannot provide a user account or enable login. You provide project and application data voluntarily when you want to use the relevant features; without this information, the corresponding planning features cannot be used or can be used only in a limited way. Publishing to the public crop library is voluntary and is not required for using the rest of the application.
Your account data is stored as long as your user account exists. User accounts that are not activated are deleted after the activation period expires; activation links are currently valid for 7 days. Password reset links are currently valid for 3 days; email change links are currently valid for 24 hours. Project invitations are currently valid for 14 days; after that period, the invitation record still exists but can no longer be accepted. If you use the unauthenticated demo feature ("Try demo"), the data created during that session is automatically deleted no later than 8 hours after the session started. If you request account deletion, the account is first marked for deletion for 14 days; during this period, you can undo the deletion. After that period, we anonymize your account (email address and display name are removed, the account is deactivated, and a connected Google sign-in is removed) and remove your project memberships, unless legal obligations or other compelling reasons prevent this. Projects remain as long as at least one member exists. If a project has no members after account deletion, we delete the project including its project-specific data. Published entries in the public crop library are not affected and remain part of the public knowledge base (see the Project and application data and Public crop library sections). Server log files of the hosting provider are deleted after 7 days; IP addresses are stored in shortened form by Uberspace. We automatically delete our own scheduled-maintenance (cron job) logs no later than 14 days after they are created. Our application's own error output (Django/Gunicorn) is not stored in log files we manage ourselves; it is captured by our hosting provider's process management, whose own technical configuration determines how long it is retained. There are currently no further statutory retention obligations for the data we process because OpenFarmPlanner does not process billing- or tax-relevant data.
As a data subject, you have the following rights under the GDPR:
You can correct your account data, export your data, and request account deletion directly in the account settings. For exceptional cases that are not covered by these self-service functions, the controller remains reachable at [email protected].
In addition to the rights listed above, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR (Art. 77 GDPR). In particular, you may contact the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement. For OpenFarmPlanner, the Austrian Data Protection Authority is the competent supervisory authority in Austria: Austrian Data Protection Authority Barichgasse 40-42 1030 Vienna https://www.dsb.gv.at
We update this privacy policy when the processing of personal data changes due to new features or changed legal requirements. The version published in the application applies. The date of the last change is shown at the end of this privacy policy. We inform active users about material changes in an appropriate way, for example by email or through a notice within the application.
Status: September 29, 2026