Privacy policy

Last updated: November 2026

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Detailed information on data protection can be found in the sections below.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator, HarvestAi GmbH. The contact details can be found in section 3 under "Controller" and in our legal notice.

How do we collect your data?

Some data is collected when you provide it to us, for example when you send us an email. Other data, mainly technical data such as your browser, operating system or the time of your visit, is collected automatically by the IT systems of our hosting service provider when you visit this website.

What do we use your data for?

We use your data to provide this website without errors and to respond to your inquiries. We do not use analytics or tracking tools on this website.

What rights do you have?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data and, under certain circumstances, the restriction of its processing. If you have given your consent to data processing, you can revoke it at any time with effect for the future. You also have the right to lodge a complaint with the competent supervisory authority. For these and any other questions about data protection, you can contact us at any time.

2. Hosting and content delivery

External hosting

This website is hosted and operated on our behalf by an external service provider:

Cascade AI Solutions Ltd.

402 - 2266 West 2nd Avenue
Vancouver, BC V6K 1H9
Canada

The personal data collected on this website is stored on the servers used by our service provider. This may include IP addresses, metadata and communication data, website access data and other data generated through a website. We use the service provider to fulfill contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in our legitimate interest in a secure, fast and efficient provision of our website by a professional provider (Art. 6(1)(f) GDPR). Our service provider processes your data only to the extent necessary to fulfill its service obligations and follows our instructions regarding this data.

Subprocessors

Our service provider uses the following subprocessors to host and deliver this website:

• Lovable (website platform and hosting): Lovable Labs Incorporated, a Delaware corporation, USA, with its operating entity in the European Union, Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. Data protection officer: dpo@lovable.dev
• Cloudflare (content delivery network): Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA

A content delivery network (CDN) is a network of distributed servers that delivers website content quickly and protects the website against attacks. Visitors from the European Union are generally served from data centers in Europe. When you access this website, your IP address and technical connection data are processed by Cloudflare. The processing is based on our legitimate interest in a secure and reliable provision of our website (Art. 6(1)(f) GDPR).

Data transfer to Canada and the USA

Our service provider is based in Canada. The European Commission has recognized that Canada ensures an adequate level of data protection for commercial organizations (adequacy decision 2002/2/EC). Lovable Labs Incorporated and Cloudflare, Inc. are based in the USA. Where personal data is transferred to the USA, this is based on the EU-US Data Privacy Framework or on the EU standard contractual clauses.

Data processing agreements

We have concluded a data processing agreement with Cascade AI Solutions Ltd. in accordance with Art. 28 GDPR. Cascade AI Solutions Ltd. has in turn concluded a data processing agreement with Lovable. These agreements ensure that your personal data is processed only on our instructions and in compliance with the GDPR.

3. General information and mandatory information

Data protection

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. This privacy policy explains what data we collect, what we use it for, and how and for what purpose this is done. Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.

Controller

The controller responsible for data processing on this website is:
HarvestAi GmbH
Am Kanal 16-18
14467 Potsdam
Germany
Email: info@harvest-ai.com

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g. names, email addresses).

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for which it was processed no longer applies. If you make a justified request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law). In the latter case, the data will be deleted once these reasons no longer apply.

Data transfer to third countries

Some of the service providers we use may be based in, or process data in, countries outside the European Union or the European Economic Area, in particular the USA. Where this is the case, we only transfer personal data if an adequate level of data protection is ensured, for example on the basis of an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or on the basis of the EU standard contractual clauses. Information on the specific providers can be found in the respective sections of this privacy policy.

Revocation of your consent to data processing

Some data processing operations are only possible with your express consent. You can revoke your consent at any time. An informal message by email to us is sufficient. The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.

Right to object to data processing (Art. 21 GDPR)

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged violation. This right is without prejudice to other administrative or judicial remedies. The supervisory authority responsible for us is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg

Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Information, correction and deletion

Within the scope of the applicable legal provisions, you have the right at any time to receive information free of charge about your stored personal data, its origin and recipients and the purpose of the data processing, and, if applicable, the right to have this data corrected or deleted. For this and any other questions about personal data, you can contact us at any time.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing exists in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data was or is unlawful, you can request the restriction of processing instead of deletion.
• If we no longer need your personal data, but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of processing instead of deletion.
• If you have lodged an objection under Art. 21(1) GDPR, your interests and ours must be weighed against each other. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may, apart from being stored, only be processed with your consent or for the establishment, exercise or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as inquiries that you send to us as the site operator, this website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of your browser starts with "https://" instead of "http://" and by the lock symbol in your browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Objection to advertising emails

We hereby object to the use of contact data published as part of the legal notice obligation for sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising, for example through spam emails.

4. Data collection on this website

Cookies and similar technologies

This website does not use cookies or similar technologies for analytics, marketing or tracking purposes. Only two technically necessary cookies are set:

“__cf_bm” from our content delivery network Cloudflare. It distinguishes legitimate visitors from automated bot traffic and protects the website against attacks. It expires after 30 minutes at the latest.

“__dpl” from our hosting infrastructure. It ensures that your browser loads a consistent version of the website while we publish updates, so that pages do not break during your visit. It contains only a technical version identifier, no personal data, and expires after 24 hours at the latest.

Both cookies are set on the basis of § 25(2) TDDDG, as they are strictly necessary to provide the website, and our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). If we use services in the future that require your consent, we will ask for your consent beforehand and update this privacy policy.

Fonts

This website uses system fonts installed on your device and fonts hosted locally on the servers used for this website. When fonts are loaded, no connection is established to servers of third-party providers such as Google.

Server log files

Our hosting service provider and its subprocessors automatically collect and store information in so-called server log files, which your browser automatically transmits. These are:

• browser type and browser version
• operating system used
• referrer URL
• host name of the accessing computer
• time of the server request
• IP address

This data is not merged with other data sources. The data is collected on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the technically error-free presentation and optimization of our website; for this purpose, the server log files must be recorded.

Enquiries by email or telephone

If you contact us by email or telephone, your inquiry, including all personal data resulting from it (name, inquiry), will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent. This data is processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the performance of a contract or is necessary to carry out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries sent to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this has been requested. The data you send to us will remain with us until you ask us to delete it, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g. after your inquiry has been processed). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

We use Microsoft 365 for our email communication. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes data on our behalf on the basis of a data processing agreement. Data may also be transferred to the USA; this transfer is based on the EU-US Data Privacy Framework and the EU standard contractual clauses.

5. Social media

Links to our social media profiles

Our website contains links to our profiles on LinkedIn and YouTube. These are simple links: no data is transferred to the respective provider when you visit our website. Only when you click on a link are you redirected to the respective platform, where the provider's privacy policy applies.

Based on a template by eRecht24.