Privacy Policy for our website RabbitCloud.com and web application RabbitCloud

When you access our website, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you. The legal basis for this processing is Art. 6(1), sentence 1, point (f) GDPR:

• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each case
• Website from which the request originated
• Browser
• Operating system and its user interface
• Language and version of the browser software

Hosting We use various hosting/cloud service providers for our website.

DigitalOcean, 251 Little Falls Drive, Wilmington, 19808, USA. Further information on data processing is available here: https://www.digitalocean.com/legal/data-processing-agreement

Vultr, 319 Clematis Street - Suite 900, West Palm Beach, FL 33401. Further information is available here: https://www.vultr.com/legal/international-privacy/

Raidboxes GmbH, Hafenstraße 32, 48153 Münster. Further information on data processing is available here: https://raidboxes.io/legal/privacy/

Scaleway, 8 rue de la Ville l’Evêque, 75008 Paris, France. Further information on data processing is available here: https://www.scaleway.com/en/privacy-policy/

Exoscale, Boulevard de Grancy 19A, 1006 – Lausanne, Switzerland. Further information on data processing is available here: https://www.exoscale.com/privacy/

These service providers act as processors on our behalf. The processing is based on our legitimate interest pursuant to Art. 6(1), point (f) GDPR in not having to maintain our own servers. The servers are located in Germany, France, and Switzerland.

Data may also be transferred to the USA. According to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. Data is therefore transferred to the USA on the basis of the Standard Contractual Clauses pursuant to Art. 46(2), point (c) GDPR. The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you can request these documents from us using the contact details provided in Section 1.

We also use fonts from Google Fonts on our website. We have installed the Google Web Fonts locally. As a result, no connection or data transmission to Google servers or to the USA takes place.

This website uses cookies in some areas. Cookies do not cause any damage to your computer and do not contain viruses. Cookies help make our services more user-friendly, effective, and secure. Cookies are small text files that are placed on your computer and stored by your browser.

A distinction is made between session cookies, which are deleted immediately after you close your browser, and persistent cookies, which are deleted only after a specific period of time.

In addition to cookies, we may also use similar technologies (tracking pixels, web beacons, etc.). Cookies and similar technologies may also involve additional processing activities, such as marketing, analytics/tracking, etc. The information provided regarding cookies therefore also applies to similar technologies and the associated processing activities.

Cookies allow us, for example, to measure the reach of our services and tailor them to users’ interests, thereby optimizing our services and marketing activities.

We use a consent management tool to manage the cookies used and the related consent choices. Details of the cookies used (purpose, storage period, any external service involved, etc.) and the consent management tool can be found in the consent management tool we use.

We use Cookieyes, CookieYes Limited
3 Warren Yard Warren Park, Wolverton Mill, Milton Keynes, United Kingdom, MK12 5NW.
Information on data processing by Cookieyes can be found here:
https://www.cookieyes.com/privacy-policy/

Under Section 25(1) TDDDG, storing information on your device and accessing information already stored there using cookies is generally permitted only with your prior consent. An exception applies under Section 25(2)(2) TDDDG where such storage and access are strictly necessary for us to provide a service that you have expressly requested. This includes, for example, keeping you logged in during your session or ensuring system security. Your consent is not required for cookies that are necessary to operate the website. There is also no right to withdraw consent in relation to these data processing activities.

Where individual cookies used by us also process personal data, such processing is carried out pursuant to Article 6(1)(b) GDPR for the performance of a contract, Article 6(1)(a) GDPR where consent has been given, or Article 6(1)(f) GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website and providing a user-friendly and effective website experience.

Any consent given to the use of cookies also applies to the use of similar technologies and the associated processing activities.

If you refuse to consent to the use of cookies or otherwise prevent cookies from being stored, the proper functioning of our online services may be impaired.

You can prevent cookies from being stored by changing the relevant settings in your browser. Depending on your browser, you can find more information here:

Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Chrome: https://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac

You can also find further opt-out options here: https://www.youronlinechoices.eu/, https://youradchoices.ca/en/tools, https://optout.aboutads.info/, https://optout.networkadvertising.org/?c=1

You can also enable the “Do Not Track” feature in your browser. Information on the “Do Not Track” setting can be found here:
Firefox: https://support.mozilla.org/de/kb/wie-verhindere-ich-dass-websites-mich-verfolgen
Chrome: https://support.google.com/chrome/answer/2790761?co=GENIE.Platform%3DDesktop&hl=de
You can prevent cross-site tracking in Safari using the following link: https://support.apple.com/de-de/guide/safari/sfri40732/12.0/mac

If you have consented to the use of cookies, you can manage your preferences in our consent management tool. (Cookie Settings)

Google Tag Manager, Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland. Tag Manager is a management tool that does not itself set or store cookies. Tag Manager manages the tags set by other tracking tools. These tags are forwarded via Tag Manager to the respective tool in anonymized form. The tool providers used therefore only access these anonymized tags from Tag Manager. Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR and Art. 6(1)(f) GDPR. Data is therefore transferred to the USA on the basis of the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you can request these documents from us using the contact details specified in Section 1. For detailed information on the use of cookies, please refer to our consent tool.

Facebook Pixel & Facebook Conversions API; Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA, or, if you are based in the EU, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). Website: https://www.facebook.com/business/help/744354708981227?id=2469097953376494 Further information on data processing by Meta: https://www.facebook.com/business/help/1474662202748341?id=2469097953376494&locale=de_DE, https://de-de.facebook.com/privacy/explanation, https://de-de.facebook.com/policies/cookies/ Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR and Art. 6(1)(f) GDPR. Data is transferred to the USA. Data is therefore transferred to the USA on the basis of the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you can request these documents from us using the contact details specified in Section 1.

ActiveCampaign, 1 North Dearborn St, 5th Floor, Chicago, IL 60602. Further information on data processing by ActiveCampaign: https://www.activecampaign.com/legal/privacy-policy Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR and Art. 6(1)(f) GDPR. Data is therefore transferred to the USA on the basis of the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you can request these documents from us using the contact details specified in Section 1.

Google Analytics & Google Ads, Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland. Further information on data processing by Google Analytics/Google Ads: https://support.google.com/analytics/answer/6004245?hl=de Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR and Art. 6(1)(f) GDPR. Data is therefore transferred to the USA on the basis of the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you can request these documents from us using the contact details specified in Section 1.

You can permanently opt out of cross-device remarketing/targeting by disabling personalized ads in your Google Account; to do so, follow this link: https://www.google.com/settings/ads/onweb/

We have enabled the "IP anonymization" function. This means that your IP address will be shortened by Google within member states of the European Union or in other states that are party to the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website and this app, Google will process this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.

If you contact us (by telephone, contact form, email, messenger services, or social media), we require your personal data (name and contact details, such as your telephone number or email address) to process your request or concern. Your personal data is processed on the basis of Art. 6(1)(b) GDPR. This personal data may be stored in a CRM system (“Customer Relationship Management System”) or comparable systems for managing enquiries. This enables us to efficiently organise incoming contacts. Your personal data is processed on the basis of Art. 6(1)(f) GDPR. We delete the data when it is no longer required or, where statutory retention obligations apply, restrict its processing. We review whether the data is still required every six months.

WhatsApp Business We use the WhatsApp instant messaging service to communicate with customers and third parties. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We use the WhatsApp Business version. Communications are protected by end-to-end encryption (peer-to-peer). This prevents third parties or WhatsApp itself from accessing the content of the respective communications. However, WhatsApp has access to the following data:

• Sender
• Recipient
• Time

According to WhatsApp, it shares its users’ personal data with its US-based parent company, Meta Platforms, Inc. Data is therefore transferred to the USA on the basis of the European Commission’s Standard Contractual Clauses, which WhatsApp has agreed to: https://www.whatsapp.com/legal/business-data-transfer-addendum. Further information about WhatsApp’s data processing is available at: https://www.whatsapp.com/legal/#privacy-policy. We use WhatsApp on the basis of our legitimate interest in straightforward and effective communication with customers and third parties pursuant to Art. 6(1)(f) GDPR and on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR. Where such consent has been requested, data is processed exclusively on the basis of that consent. You may withdraw your consent at any time with effect for the future. We have configured our WhatsApp accounts so that they do not automatically synchronise data with the address books on the smartphones being used.

We process your customer and contact data as well as your contract history to provide you with information about our company, services, and products. This is done to improve and develop our services and products and to provide you with personalized communications, offers, and products tailored to your needs. The legal basis for this processing is Art. 6(1)(f) GDPR.

This is an integrated software solution that enables us to cover various aspects of our online marketing. These include:

• Email marketing
• Chat features and messaging services
• Reporting (e.g., traffic sources, visits, etc.)
• Contact management (e.g., user segmentation and CRM)
• Contact forms
• Push notifications

The content of our website is stored on our service provider’s servers. We may use it to contact visitors to our website and determine which of our company’s services may be of interest to you. We use all collected information exclusively to optimize our marketing activities.

We use various service providers for our online marketing based on our legitimate interest in optimizing our marketing activities and improving the quality of our services on the website. The legal basis for using these services is therefore Art. 6(1)(f) GDPR.

Postmark is a service provided by ActiveCampaign, 1 North Dearborn St, 5th Floor, Chicago, IL 60602. Data is transferred to the USA. According to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. Data is therefore transferred to the USA on the basis of the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you may request these documents from us using the contact details specified in Section 1. Further information about data processing by ActiveCampaign: https://www.activecampaign.com/legal/privacy-policy Further information about data processing by Postmark: https://postmarkapp.com/eu-privacy#gdpr

Crisp IM, 2 boulevard de Launay, 44100 Nantes, France. Further information about data processing: https://crisp.chat/de/privacy/

On our website, you have the option of subscribing to our free newsletter. When you subscribe, we store your email address and name.

We use a double opt-in process to activate your newsletter subscription. This means that, after you subscribe, we send an email to the email address provided asking you to confirm that you wish to receive messages. We also store the IP addresses you used and the times of subscription and confirmation. The purpose of this process is to verify your subscription and, where applicable, investigate any potential misuse of your personal data.

Newsletters are sent on the basis of the recipients’ consent pursuant to Article 6(1), first sentence, point (a) GDPR or, where consent is not required, on the basis of our legitimate interests in direct marketing pursuant to Article 6(1), first sentence, point (f) GDPR, insofar as this is permitted by law, for example when advertising to existing customers.

We use ActiveCampaign, 1 North Dearborn St, 5th Floor, Chicago, IL 60602, to send our newsletters. This involves the transfer of data to the USA. According to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. Data is therefore transferred to the USA on the basis of the Standard Contractual Clauses pursuant to Article 46(2), point (c) GDPR. The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you may request these documents from us using the contact details provided in Section 1. Further information on data processing by ActiveCampaign is available at: https://www.activecampaign.com/legal/privacy-policy

Our use of the email service provider, the performance of statistical surveys and analyses, and the recording of the subscription process are based on our legitimate interests pursuant to Article 6(1), point (f) GDPR. As a general rule, personal data collected as part of the respective newsletter service is not disclosed to third parties.

We process your data in this context for as long as you are a user of our services or until you object to this data processing.

Withdrawal of consent

You may withdraw your consent to receive the newsletter and unsubscribe at any time. You can withdraw your consent by clicking the link provided in each newsletter email, by emailing info@rabbitcloud.com, or by sending a message using the contact details provided in Section 1.

In addition to our website, we are also active on various social media platforms. When you visit our social media profiles, certain information about you is processed. If you are logged into your own user account on the social network when visiting our profile, the data collected will be directly associated with your existing account.

Your personal data may also be collected if you are not logged in or do not have an account with the relevant social media platform. In this case, data may be collected, for example, through cookies stored on your device or by recording your IP address.

Social networks store the data collected about you in user profiles and may use it for analysis, advertising and market research purposes.

When you visit our social media profile, we process data about your actions and interactions with our social media profile, as well as your publicly accessible profile data (e.g. your name and profile picture). Which personal data from your profile is publicly accessible depends on the settings you have selected in your social media account.

The purpose of our data processing on our social media profiles is to inform customers about offers, products and company news, as well as to interact with visitors to our social media profiles, answer questions, etc. The legal basis is Art. 6(1), sentence 1, point (f) GDPR. Data processing is carried out in the interests of our public relations and communications activities.

When you visit one of our social media profiles (e.g. Facebook), we and the operator of the social media platform are jointly responsible for the data processing operations triggered by your visit. This means that you may generally exercise your rights (access, rectification, erasure, restriction of processing, data portability and the right to lodge a complaint) against both us and the operator of the relevant social media platform.

Please note that, despite our joint responsibility with the operators of the social media platforms, we do not have full control over the data processing operations carried out there. Our options are largely determined by the corporate policies of the respective provider.

We delete data collected directly by us through our social media profiles as soon as the purpose for which it was stored no longer applies, you request its deletion, you withdraw your consent to its storage, or the purpose for storing the data no longer applies, unless statutory retention obligations apply.

For information on how long your data is stored on social media platforms, please refer to the privacy policies of the operators of the respective platforms.

Facebook

We have a profile on Facebook. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”), a subsidiary of Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA.

We have entered into a joint processing agreement (Controller Addendum) with Meta pursuant to Art. 26 GDPR. This agreement specifies which data processing operations we and Meta are responsible for when you visit our Facebook profile.

You can view the agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

You can adjust your advertising settings in your user account. To do so, click the following link and log in: https://www.facebook.com/settings.

Data is transferred to the USA. According to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. Data is therefore transferred to the USA on the basis of the Standard Contractual Clauses pursuant to Art. 46(2), point (c) GDPR. The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you may request these documents from us using the contact details provided in Section 1. Further details about data processing can be found in Facebook’s Privacy Policy: https://www.facebook.com/about/privacy/

YouTube

We use the YouTube video platform, which is operated by YouTube, LLC, 901 Cherry Ave. San Bruno, CA 94066, USA (“YouTube”), a subsidiary of Google. YouTube is a platform that enables audio and video files to be played.

We have embedded YouTube videos on our pages.

When you access one of our pages containing such a video, the embedded YouTube player establishes a connection to YouTube so that the video or audio file can be transmitted and played. Personal data is also transferred to YouTube as the controller. We have no control over how YouTube processes this data.

The data is processed on the basis of your explicit consent pursuant to Art. 6(1), point (a) GDPR. If you do not provide your consent, the content of our pages cannot be displayed in full.

As YouTube is a subsidiary of Google, Google’s Privacy Policy applies: https://policies.google.com/privacy?hl=de.

Data is transferred to the USA. Data is therefore transferred to the USA on the basis of the Standard Contractual Clauses pursuant to Art. 46(2), point (c) GDPR: https://policies.google.com/privacy/frameworks?hl=de.

The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you may request these documents from us using the contact details provided in Section 1.

4.1 When downloading the app, the respective app store provider collects personal data, including:

• Username
• Email address
• Customer number
• Time of download
• Payment information (if applicable)
• Device-specific identifier

For information on the purposes and scope of data processing, please refer to the provider’s privacy policy: Google Play Store (Android): Google LLC., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA: https://policies.google.com/privacy?hl=en&gl=de

AppStore (iOS): Apple Inc., One Apple Park Way, Cupertino, California, USA, 95014: https://www.apple.com/legal/privacy/

AppGallery (Huawei): AppGallery is a service of Aspiegel SE, a subsidiary of Huawei based in Ireland; 40 Mespil Rd, Ballsbridge, Dublin, D04 C2N4, Ireland https://consumer.huawei.com/minisite/cloudservice/AppGallery-web/common/b0/latest/privacy-statement-de-de.htm

You can register directly in the app or via our website. In both cases, we store the following data:

• First name/last name
• Email address
• Password
• Club/association
• Language
• Postal code/city/address
• Phone number
• Signature

The personal data required here is mandatory. Without it, we cannot provide you with access to the app. The legal basis for this is Art. 6(1), first sentence, point (b) GDPR.

You may optionally add a profile picture to your profile. This is generally not required to use the app. As the data is collected voluntarily, the legal basis is Art. 6(1), first sentence, point (a) GDPR. You can remove your picture from your profile at any time.

Hosting

The data collected here is stored on the servers of various hosting providers.

DigitalOcean, 251 Little Falls Drive, Wilmington, 19808, USA. Further information on data processing is available here: https://www.digitalocean.com/legal/data-processing-agreement

Vultr, 319 Clematis Street - Suite 900, West Palm Beach, FL 33401. Further information is available here: https://www.vultr.com/legal/international-privacy/

Raidboxes GmbH, Hafenstraße 32, 48153 Münster. Further information on data processing is available here: https://raidboxes.io/legal/privacy/

Scaleway, 8 rue de la Ville l’Evêque, 75008 Paris, France. Further information on data processing is available here: https://www.scaleway.com/en/privacy-policy/

Exoscale, Boulevard de Grancy 19A, 1006 – Lausanne, Switzerland. Further information on data processing is available here: https://www.exoscale.com/privacy/

These service providers act as data processors on our behalf. The processing is based on our legitimate interest pursuant to Art. 6(1), point (f) GDPR in not having to maintain our own servers. The servers are located in Germany, France, and Switzerland.

Data may also be transferred to the USA. According to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. Data is therefore transferred to the USA on the basis of the Standard Contractual Clauses pursuant to Art. 46(2), point (c) GDPR. The Standard Contractual Clauses are available at: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you can request these documents from us using the contact details provided in Section 1.

When opening and using the app, we also store the following personal data:

• Device type
• Operating system
• IP address
• Language settings
• Device ID
• Cookie data
• Mobile application ID
• Location data

The app requires access to the camera. Photos and videos are only taken if you activate the camera function of the app. The processing of data related to this is carried out with your consent and is therefore based on Art. 6 para. 1 sentence 1 lit. a GDPR.

We send push notifications to our users to alert them to an expected birth and other breeding-related events, as well as to news, updates, features, and special offers.

The following data about your device is stored:

• Device type
• Operating system
• IP address
• Language settings
• Usage data
• Language
• Country

We use the provider OneSignal, 2850 S Delaware St # 201, San Mateo, CA 94403, to send push notifications. This involves the transfer of data to the USA. Data is therefore transferred to the USA on the basis of the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you may request these documents from us using the contact details provided in Section 1.

Further information on data processing by OneSignal: https://onesignal.com/privacy

Push notifications will only be sent to you with your consent. The legal basis is Art. 6(1)(a) GDPR. The legal basis for collecting data such as timestamps, push tokens, and device IDs is Art. 6(1)(b) GDPR.

For Android (version 5.1 and lower): https://support.google.com/googleplay/answer/6014972?p=app_permissions&rd=1&hl=en For Android (version 6.0 and higher): https://support.google.com/googleplay/answer/6270602?hl=en For iOS: https://www.apple.com/privacy/manage-your-privacy/ For Huawei: https://consumer.huawei.com/de/support/content/de-de15769098/

You have the option to share a rabbit profile with information about rabbit breeds/colors, weight, etc. with other users of the app on the marketplace via your app profile, or through our social media presences. This processing is carried out based on your explicit consent, Art. 6 para. 1 lit. a GDPR.

You can upload your own photos. The app requires permission to access photos you have already taken. This processing is based on your explicit consent pursuant to Art. 6(1)(a) GDPR.

The personal data collected in this context consists of the information shown in the photos and the photos’ metadata. You can delete the data collected here yourself at any time. This does not affect the lawfulness of the data processing carried out up to that point. Please bear in mind that although other users with whom you share your photos cannot create copies of these photos and we do not technically enable the photos to be shared with others, other forms of reproduction cannot be ruled out (e.g. screenshots).

In the app, you can have photos of judging scorecards and other breeding documents (e.g. pedigrees, studbooks or inventory lists) read automatically so that the information they contain can be imported without manual entry. This analysis is performed only when you initiate it for a specific photo or document; no automatic analysis takes place in the background. Depending on the function, the detected values are either displayed as suggestions and saved only when you choose to accept them, or imported directly into your data records during data import. You can view, edit and delete imported data at any time.

For this analysis, we use machine learning technologies (large language models, or “LLMs”) from external providers. The information shown in the photographed or uploaded documents is processed; in addition to animal and judging data, this may also include personal data relating to third parties, such as the names and signatures of judges or the names and contact details of other breeders. The legal basis for this processing is Art. 6(1), first sentence, lit. b GDPR.

We use OpenRouter, Inc., 169 Madison Avenue, New York, NY 10016, USA, as a processor to connect to the models. Further information on data processing is available here: https://openrouter.ai/privacy

OpenRouter forwards the request for processing to one of the following infrastructure providers:

Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (Amazon Bedrock). Further information on data processing is available here: https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html

Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (Vertex AI). Further information on data processing is available here: https://cloud.google.com/terms/data-processing-addendum

Microsoft Ireland Operations Limited, 70 Sir John Rogerson’s Quay, Dublin, D02 R296, Ireland (Microsoft Azure). Further information on data processing is available here: https://aka.ms/DPA

We exclusively use endpoints with no data retention (“Zero Data Retention”): The providers listed above do not retain the photos you submit or the analysis results beyond the duration of processing and do not use them to train their models. OpenRouter also does not store the content of requests; it only collects technical metadata relating to the request (e.g. time, volume of data and model used).

Data is transferred to the USA. Data transfers to the USA are carried out on the basis of the Standard Contractual Clauses pursuant to Art. 46(2), lit. c GDPR. The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you can request these documents from us using the contact details provided in Section 1.

We analyze the animal weight data entered by users in the app to calculate average growth curves for each breed and display them to all users in the app. Only the animals’ weight, breed, and age are included in the calculation; users’ names, contact details, or other profile data are not used. Only anonymous averages are generated, from which no conclusions can be drawn about individual users, livestock populations, or animals. A growth curve is calculated only if data from a sufficient number of different users is available.

The legal basis for this statistical analysis is our legitimate interest pursuant to Art. 6(1)(f) GDPR in providing and improving the features of our app; further processing for statistical purposes is compatible with the original purpose of collection pursuant to Art. 5(1)(b) GDPR. The calculation is performed on our servers; no data is transferred to third parties. You may object to this processing at any time (see the section “Rights of Withdrawal and Objection”).

If you choose payment by bank transfer and direct debit, we will store your name and your bank account details.

Electronic payment transactions, including the collection, processing and storage of payment data, are handled by our payment service provider, Stripe Payments Europe Ltd, Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland (“Stripe”). Stripe enables us to offer various payment methods, such as credit card payments and direct debits.

For each payment transaction, Stripe receives data required to process the electronic payment, such as the information you provide during the ordering process, together with information about your order (name, address, account number, bank code, credit card number, if applicable, invoice amount, currency and transaction number). The processing of your data by Stripe is necessary for payment processing and therefore for the performance of the contract. The legal basis for this is Art. 6(1), first sentence, point (b) GDPR. This data will be deleted once the statutory retention periods have expired. Stripe processes your personal data on our behalf and in accordance with our instructions as a processor pursuant to Art. 28 GDPR.

Stripe, the service provider we use in this context, processes personal data for us on our behalf and in accordance with our instructions as a processor pursuant to Art. 28 GDPR and transfers data to affiliated companies in the USA. The European Commission does not consider the level of data protection in the USA to be adequate. Data is therefore transferred to the USA on the basis of the Standard Contractual Clauses pursuant to Art. 46(2), point (c) GDPR. The Standard Contractual Clauses are available at https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX:32021D0914. Alternatively, you may request these documents from us using the contact details provided in Section 1.

Further information about data processing by Stripe is available here: https://stripe.com/at/privacy?tid=311853917

When paying via PayPal, electronic payment data is collected, processed and stored by our partner PayPal (PayPal (Europe) S.à r. l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449, Luxembourg).

To pay via PayPal, you must be registered with PayPal or first create an account and authenticate yourself using your login details. PayPal automatically processes the payment transaction immediately after you confirm the payment instruction. Further information will be provided during the ordering process.

For each payment transaction, PayPal receives data required to process the electronic payment, such as title, gender, first name, last name, company, address, postal code, city, country, customer number, email address, and payment method. PayPal collects this data directly from you and processes it for payment processing purposes. Your data is transferred to PayPal in accordance with Art. 6(1)(b) GDPR. For further information on data protection, please refer to PayPal’s Privacy Statement: https://www.paypal.com/de/legalhub/paypal/privacy-full.

You may object to this processing of your data at any time by contacting PayPal. However, PayPal may remain entitled to process your personal data where this is necessary to process payments in accordance with the contract or where statutory retention obligations apply.

We use the payment service provider GoCardless Ltd, Sutton Yard, 65 Goswell Road, London, EC1V 7EN, United Kingdom. Pursuant to Art. 45 GDPR, the European Commission has determined that the United Kingdom provides an adequate level of protection; this adequacy decision was extended in December 2025 until 27 December 2031. The data transfer is based on the adequacy decision: https://ec.europa.eu/commission/presscorner/detail/de/ip_25_3059

Data is collected via Google Firebase, which is integrated into the app. We use Google Analytics for Firebase for this purpose. Firebase is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on the basis of a data processing agreement. The data collected is stored in Google Cloud (BigQuery) on a server located in Frankfurt.

We use Google Analytics for Firebase to collect general data about how the app is used, analyze app usage, and optimize user navigation. We collect and store the following data: frequency of page views, search terms, use of website features, and duration of visits.

A detailed description of the information collected and processed can be found here: https://firebase.google.com/support/privacy#data_processing_information

The legal basis for using Google Analytics for Firebase is your consent pursuant to Art. 6(1)(a) GDPR and our legitimate interest pursuant to Art. 6(1)(f) GDPR.

It cannot be ruled out that data may also be transferred to the USA. Data is therefore transferred to the USA on the basis of the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you may request these documents from us using the contact details specified in Section 1.

You may withdraw your consent at any time in the app settings under “Settings -> Privacy.”

Our app also uses technology provided by Sentry, Functional Software Inc., 132 Hawthorne Street, San Francisco, California 94107, for crash analysis. Information about the device used and your use of our app is collected (e.g. timestamps indicating when the app was launched and when the crash occurred), enabling us to diagnose and resolve issues. This personal data is not combined with your other profile information. Chat messages are excluded and are not included in crash reports. We collect this data and transfer it to Sentry in the USA for analysis. On our behalf, Sentry analyzes the data relating to crashes of our app. Processing this data is necessary for us to further improve the app’s stability and security and is carried out on the basis of Art. 6(1), sentence 1, point (f) GDPR.

The European Commission does not consider the USA to provide an adequate level of data protection. Data is therefore transferred to the USA on the basis of the Standard Contractual Clauses pursuant to Art. 46(2), point (c) GDPR. The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you may request these documents from us using the contact details specified in Section 1. We have entered into a data processing agreement with Sentry. Further information is available here: https://sentry.io/legal/dpa/.

Our app uses the Facebook Software Development Kit (SDK). The provider is Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA, or, for users in the EU, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”).

The following data is used:

• App ID
• App version
• App launch time

The Facebook SDK enables us to improve the effectiveness of advertising campaigns for mobile apps run via Facebook and tailor them to users. Among other things, we can measure the success of advertising campaigns and analyze how users interact with our app.

Only pseudonymized data—specifically, the advertising ID provided by the device’s operating system—is transmitted to Meta. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in analyzing user behavior in order to conduct personalized advertising campaigns) or Art. 6(1)(a) GDPR (consent granted by you).

Data is transferred to the USA. Such transfers are therefore carried out on the basis of the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you may request these documents from us using the contact details provided in Section 1.

We use RevenueCat, 633 Tavara St. Suite 101, San Francisco, CA 94116, USA, to analyze in-app purchases. RevenueCat notifies us when a purchase has been made. This allows us to determine when to activate the app for a particular user. The legal basis is our legitimate interest in ensuring the smooth operation of the app pursuant to Art. 6(1)(f) GDPR. Data is transferred to the USA. Such transfers are therefore carried out on the basis of the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. The Standard Contractual Clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Alternatively, you may request these documents from us using the contact details provided in Section 1.

For more information about data processing, please visit: https://www.revenuecat.com/privacy/

To fulfill our contractual obligations, we rely on the services of carefully selected third parties who process the data on our behalf. These are processors with whom we have entered into an agreement in accordance with Art. 28 GDPR. Furthermore, we ensure in advance that our processors comply with all data protection regulations, so your data is always secure.

As a general rule, we process your personal data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) only where this is necessary to fulfil our (pre-)contractual obligations (pursuant to Art. 6(1)(b) GDPR), on the basis of your consent (pursuant to Art. 6(1)(a) GDPR), due to a legal obligation (pursuant to Art. 6(1)(c) GDPR), or on the basis of our legitimate interests (pursuant to Art. 6(1)(f) GDPR). The same applies to processing by third parties on our behalf, the disclosure of your personal data to third parties, and its transfer to third parties.

Subject to statutory or contractual authorisation, we process data in a third country, or have it processed there, only if the specific requirements of Art. 44 et seq. GDPR are met. This means that processing is carried out, for example, on the basis of specific safeguards, such as an officially recognised determination that the level of data protection is equivalent to that of the EU, or compliance with officially recognised specific contractual obligations (known as “standard contractual clauses”).

In addition to the system-side deletion of your data described above, your data may also be deleted if you actively delete your account. Furthermore, your account may be deactivated and subsequently deleted if you do not use it for an extended period of time and, based on our experience, we can no longer reasonably expect that you will use it again.

The data we collect here is used to provide you with a personalized and tailored offering. However, this does not constitute automated decision-making within the meaning of Art. 22 GDPR, as it does not produce any legal effects concerning you. Nevertheless, we want to be as transparent as possible about this.

The automatic extraction of data from evaluation cards and other breeding documents also does not involve automated decision-making: The values identified do not produce any legal effects concerning you. You can review, amend, or reject them before importing them, and you can edit or delete imported data at any time.

You have the right:

1. pursuant to Art. 15 GDPR, to request information about your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your data has been or will be disclosed, the intended storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your data where it was not collected from you, and the existence of automated decision-making, including profiling, as well as meaningful information about the details thereof, where applicable;
2. pursuant to Art. 16 GDPR, to request the immediate rectification of inaccurate personal data or the completion of incomplete personal data stored by us;
3. pursuant to Art. 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;
4. pursuant to Art. 18 GDPR, to request the restriction of the processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose its erasure, we no longer need the data but you require it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Art. 21 GDPR;
5. pursuant to Art. 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller;
6. pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority responsible for your habitual residence, place of work, or our registered office.

Revocation of Granted Consents

If we process your personal data based on consent you have given in accordance with Art. 6 (1) lit. a GDPR, you have the right to revoke any consent given to us in accordance with Art. 7 (3) GDPR with effect for the future. If you wish to exercise your right of revocation, you can notify us by email at info@rabbitcloud.com. Alternatively, you may also use the contact details listed above under section 1.

Objection to Processing Based on Legitimate Interest

If we process your personal data on the basis of our legitimate interests in accordance with Art. 6 (1) lit. f GDPR, you have the right, pursuant to Art. 21 GDPR, to object to the processing of your personal data, provided there are reasons arising from your particular situation or if the objection is directed against direct advertising. In the latter case, you have a general right to object, which will be implemented by us without the need to specify a particular situation. If you wish to exercise your right to object, you can notify us by email at info@rabbitcloud.com. Alternatively, you may also use the contact details listed above under section 1.

We take organizational, contractual, and technical security measures in accordance with the state of the art to ensure compliance with data protection laws and to protect the data we process against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. Security measures include, in particular, the encrypted transmission of data between your browser and our server.

We reserve the right to change our privacy policy if this becomes necessary due to new technologies or changes in our data processing procedures, or to adapt it to changes in the applicable legal requirements. However, this only applies to this privacy policy. If we process your personal data based on your consent or if parts of the privacy policy contain provisions regarding our contractual relationship with you, any such changes will only be made with your consent.

You can view the current version of our privacy policy at https://rabbitcloud.com/privacy.