Privacy
The German version of this text is binding.
Privacy policy for koeppen.app and airdentity.com
1. Controller
Jan Schenk, Klimatologische Beratung, Ehrenbergstr. 16a, Scanbox #16737, 10245 Berlin, Germany, e-mail hello@koeppen.app. No data protection officer has been appointed, because there is no obligation to do so (§ 38 BDSG).
2. What we process, for what purpose and on what legal basis
| Activity | Data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Visiting the website and the scenes | IP address, time, file requested, browser (server logs at Microsoft Azure) | Operation, security, troubleshooting | Art. 6(1)(f) GDPR (legitimate interest) | 30 days at most |
| User account, sign-in via link | E-mail address, language, time of sign-in, IP address when requesting the link, browser identifier of the session | Access to purchased services, protection against misuse | Art. 6(1)(b) GDPR (contract) | Account until you delete it; sign-in links 15 minutes, sessions 30 days |
| Purchase (membership, Airdentity, gift voucher) | E-mail, name, billing address, country, product, amount, Stripe customer and payment identifiers, time of consent to immediate start; no card data (held only at Stripe) | Contract processing, access rights, bookkeeping | Art. 6(1)(b) and (c) GDPR (retention obligation) | Order data 10 years (§ 147 AO); link to the account until the account is deleted |
| Cancellation | E-mail, name (optional), type of and reason for the cancellation, time, IP address | Proof and execution of the cancellation | Art. 6(1)(b) and (c) GDPR | 3 years after the end of the year of cancellation |
| Airdentity naming | Assigned first name, region or country, e-mail, buyer’s first name, time zone, language, naming history | Assignment and publication of the name, status e-mails, certificate | Art. 6(1)(b) GDPR | For the lifetime of the pressure system plus archive; deletion on request, unless this conflicts with fulfilment of the contract |
| Publication of names | Assigned first name (real name only with consent) | Display on maps, in rankings, weather videos, feeds and to the media | Art. 6(1)(b) GDPR; real name Art. 6(1)(a) (consent, revocable at any time) | As long as the name is published |
| Gift vouchers | E-mail and name of the recipient, the giver’s message, delivery date | Delivery of the voucher | Art. 6(1)(b) (contract with the giver) and (f) (the recipient’s interest in receiving it) | Until redeemed, 3 years at most |
| E-mails (sign-in link, confirmations, vouchers) | E-mail address, type of e-mail, delivery status | Provision of the service | Art. 6(1)(b) GDPR | Sending log 12 months |
| Audience measurement (own counting) | page or scene viewed, referring website, language, device type (phone or computer), event (scene opened, used, paywall seen, payment, image shared, arrived via a shared image, homepage highlight clicked); no IP address, no identifier, no cookie | Improving the service | Art. 6(1)(f) GDPR; nothing is stored on your device, so no consent is needed (§ 25 TDDDG) | daily totals only, 25 months |
| Region on airdentity.com | IP address sent to ipapi.co | Preselection of the region | Art. 6(1)(f) GDPR | Not stored |
For audience measurement we count ourselves and keep only daily totals; individual visits cannot be traced back from them. If your browser sends “Do Not Track” or Global Privacy Control, we do not count. We do not process special categories of personal data (Art. 9 GDPR), we make no automated decisions with legal effect and we do not create profiles.
3. Cookies and local storage
koeppen_session: a technically necessary session cookie after you sign in (for koeppen.app and api.koeppen.app, not readable by scripts, 30 days). No consent is required for this (§ 25 Abs. 2 TDDDG).koeppen-langin your browser’s local storage: the website language you last chose. It never leaves your browser.- When you pay, Stripe sets its own technically necessary cookies on stripe.com (fraud prevention); see Stripe’s privacy notice.
- airdentity.com stores the map position in your browser. There are no tracking cookies and therefore no cookie banner.
We serve fonts and scripts ourselves; no data is transferred to font or advertising services when you visit.
4. Recipients and processors
| Recipient | Purpose | Location | Basis |
|---|---|---|---|
| Microsoft Ireland Operations Ltd. (Azure: Static Web Apps, Functions, SQL database, Blob Storage, Key Vault, Communication Services) | Hosting, database, storage of scene data, sending e-mails | EU (West Europe) | Data processing agreement (Microsoft Products and Services DPA), standard contractual clauses for any access from third countries |
| Stripe Payments Europe, Ltd., Dublin | Payment processing, invoices, customer portal, fraud prevention | EU, transfer to Stripe, Inc. (USA) | Stripe is an independent controller for payment processing; EU-U.S. Data Privacy Framework or standard contractual clauses |
| Twilio SendGrid (Airdentity status e-mails only, for a transitional period) | Sending e-mails | USA/EU | Data processing agreement, standard contractual clauses |
| ipapi.co (airdentity.com only) | Determining the region from the IP address | USA | Standard contractual clauses |
| Press, broadcasters, media partners, social networks | Publication of assigned names (first name, real name only with consent) | Worldwide | Contract or consent |
Authorities receive data only if we are legally obliged to provide it.
5. Transfers to third countries
Hosting and database are located in the EU. Stripe, SendGrid and ipapi.co may transfer data to the USA; the basis for this is the EU-U.S. Data Privacy Framework or standard contractual clauses. Published Airdentity names can be accessed worldwide.
6. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), to object to processing based on legitimate interests (Art. 21) and to withdraw consent you have given with effect for the future (Art. 7(3)). You can lodge a complaint with a supervisory authority; the authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
Deleting your account: at any time in your account via “Delete account”. This deletes your account, sign-in links, sessions and access rights; order and invoice data are kept without any link to the account because of statutory retention obligations. Any running membership must be cancelled first. Assigned Airdentity names remain published to the extent required to fulfil the naming right; on request we will remove the real name.
7. Data security
Encrypted transmission (TLS), encrypted storage at Azure, access by our applications via managed identities without passwords, keys in Azure Key Vault, passwordless sign-in via single-use, short-lived links, sessions stored only as a hash.
8. Changes
We update this policy when our processing changes. The current version is always available at koeppen.app/en/privacy/.
As of 7 November 2026