Privacy notice

1 Who is responsible

The controller is Devyer Ventures GmbH, Germany, registered under HRB 249111 at Amtsgericht München. For every question about your data, write to dpo@aerosphere.pro.

2 What we collect, why, and on what legal basis

Your account

Your email address, your password, when you accepted the terms, and when you last logged in. We keep only a salted hash of the password, which logs you in but can't be turned back into the password.

Basis: the contract with you (article 6(1)(b) GDPR).

Your profile and what you do

What you type into your profile, your photo, the topics you choose, whom you follow, what you post, comment, save or report, the messages you write, and the companies you act for. Other members who are logged in see your profile and your posts; only the people in a conversation see its messages. If your profile names a company, logged-in members see you in the list of people on that company's page. We record when you were last active, and each day you used the site, which only goes into counts for the whole network. Other logged-in members see a green dot on your photo while you are online, unless you turn it off under Privacy on your profile.

Basis: the contract (article 6(1)(b)).

Emails we send you

Login and confirmation links, answers about your reports or your company, an email when a member writes to you (their name and the start of the message, 1 a conversation until you read it), an email when a member answers your question (their name and the start of the answer, 1 a question until you open it), a daily summary of what happened while you were away, a weekly email of what happened in the topics you follow (sent only when there are 3 things or more; the register form lets you turn it off), a Monday email to a company's recruiters about their adverts, a welcome email once, a day after you confirm your address, that lists what is still empty on your profile, and every 3 months a question whether your topics still fit. Every recurring email has a 1-click unsubscribe, and Settings has a switch for each.

Basis: the contract, and for the message email, the answer email, the summary and the weekly topic email our interest in keeping you informed (article 6(1)(f)); you may object at any time with that link.

People you invite

When you invite a colleague, we store their email address and your note and send the invitation, which you may send again at most twice. We keep the invitation for as long as your account exists. The person invited can refuse with 1 click: we then keep their address on a list of addresses we never write to again, for as long as the service runs, so the refusal holds. When you make an invitation link instead, we store the link, when it was made and, once somebody joins with it, who joined. We never ask for or store a phone number.

Basis: your interest and ours in growing the network, and for the list the respect of that refusal (article 6(1)(f)).

Feedback

The Feedback button sends us your words, the page you were on, your window size and your browser; a member's message is tied to their account. We keep the feedback visitors send, with the name and the email address they choose to give, for 12 months, to answer them and improve the product; only our team sees it, our answer goes out through our email provider, and we delete it on request. A member's feedback is deleted with their account.

Basis: our interest in a service that works for the people who use it (article 6(1)(f)).

Companies in the directory

The company listings come from public sources such as company websites and industry directories. A member who adds their company gives its website; we fetch that public homepage once, from our server, to fill the listing's name, short description, country and logo, and we send the site nothing about the member. The listing records which member added it, and Download your data includes it. A listing can hold a work contact: a name, a work email address or a telephone number.

Basis: our interest, and the company's, in a directory of the industry (article 6(1)(f)). Anybody named in a listing may object at dpo@aerosphere.pro, and we remove the name.

Server logs and security

The web server writes a line for every request: your IP address, the time, the address asked for, the answer and your browser. We keep the logs for 14 days, then they go. We count your recent actions to enforce the limits in the terms, and count failed logins to stop password guessing.

Basis: our interest in a safe, working service (article 6(1)(f)).

Reports and decisions

We keep a record of each report, the decision and its reasons, as the Digital Services Act asks.

Basis: a legal duty (article 6(1)(c)) and our interest in fair moderation (article 6(1)(f)).

Cookies and browser storage

Only what the service needs to work, so we ask for no consent: the session cookie that keeps you logged in (30 days), the security cookie that protects every form against forgery, and, if you close the reminder about your topics, a cookie that keeps it closed for 30 days. Your browser's own storage remembers the light or dark theme; it never leaves your browser. No tracking, no advertising cookies, no analytics.

Basis: section 25(2) TDDDG.

Videos

A post can show a YouTube video. Nothing loads from YouTube until you press play. When you do, your browser connects to Google, which receives your IP address and may set cookies.

Basis: your consent, given by pressing play (article 6(1)(a)).

Videos you upload

A post or a reply can carry a video file a member uploads. Your browser sends the file straight to api.video, which stores it privately for us; we send api.video no name and no email address with it. Only logged-in members who may see the post can play it, and nothing loads from api.video until they press play. When you press play, your browser connects to api.video, which receives your IP address to deliver the video. We keep the video's id, when it was uploaded, its length and the post it is on. A report withholds the video at once. Deleting the post or the reply deletes the video at api.video, and so does deleting your account, after the 30 days in section 4.

Basis: the contract (article 6(1)(b)).

3 Who else receives it

Only the services we use, on our instructions (article 28 GDPR):

The services we use, where each one is, and what it does for us

Service and where it is	What it does for us
Hetzner Online GmbH Germany	The server that runs Aerosphere and holds its data.
Lettermint B.V. the Netherlands	Delivers the emails we send you, from servers in the EU, under a signed data processing agreement. We share a copy on request: write to dpo@aerosphere.pro.
api.video SAS France	Stores the videos members upload and plays them to the members who press play. api.video (a French company) processes uploaded videos on servers in the European Union on our behalf.
Migadu Switzerland	Receives the emails you write to our addresses. Switzerland has an adequacy decision (article 45 GDPR).

To show a company's logo when its own website gives none, our server asks Logodev, Inc. (logo.dev, USA) for the logo by the company's web address. logo.dev receives that address and our server's IP address, never anything about a member.

We never sell, rent or share member data for anybody's marketing.

4 How long we keep it, and what deleting your account does

We keep your data as long as you have an account. You delete it from your settings, in 1 step.

At once

In the moment you delete it:

• Your profile, your photo and your name leave every page, in every industry you joined.
• Your posts and comments, with their pictures and videos, come off the site.
• Your follows, in both directions, your saved items, your marks on posts and comments, your event replies, your blocks, the days you used the site and the invitations nobody opened yet are deleted.
• You leave every company list, and the job adverts you ran close.
• Your conversations show "Deleted member" and take no new message.
• You are logged out everywhere, and your password stops working.

After 30 days

We erase for good: your posts with the comments under them, your comments, the messages you wrote (a conversation left with none goes too), your pictures, the videos you uploaded (deleted at api.video too) and your video links, your invitations, the emails we still hold for you, your login account and every personal detail of your profile. The 30 days let us deal with a report about something you posted before it is gone.

What stays

• The messages other members wrote to you, because they are theirs. They show "Deleted member" in your place.
• Reports and moderation decisions, for 3 years after the decision (the general limitation period), with your name taken out.
• Posts, events and jobs that belong to a company, not to you.
• Your email address on our do-not-write list, only if you asked us never to write to it again.

Our nightly backups hold a copy for 14 more days, and a copy taken before each update of the service lasts until 10 newer updates replace it. An account whose confirmation link was never opened goes after 24 hours, with the emails we sent to its address.

5 Your rights

You may ask us for a copy of your data (article 15), have it corrected (16), erased (17) or restricted (18), and receive it in a machine-readable file (20): your settings have a button for the file and one for deletion. You may withdraw a consent at any time (7(3)). Write to dpo@aerosphere.pro.

Your right to object (article 21)

Where we rely on our interest (article 6(1)(f)), you may object at any time, for reasons that come from your situation, and we stop unless we have compelling reasons. You may object to the message email, the answer email and the summary emails at any time without giving a reason: the 1-click unsubscribe in each one does it.

You may also complain to a data protection authority (article 77), in particular the one where you live or work.

6 What you must give us

An email address and a password, to have an account. Everything else in your profile is up to you. We make no automated decisions about you that have a legal or similar effect.