bewhereapp

Privacy policy

Last updated: October 2026

1. Controller

The controller responsible for data processing on bewhere.app is:

Postal address (image)

Email:

Email address (image)

2. Principles

bewhere.app uses no analytics or tracking services, shows no advertising, and does not load any content (such as fonts or scripts) from third-party servers. Personal data is only processed to the extent necessary to operate the application.

3. Hosting and server log files

The application runs on servers operated by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with the host.

When you visit the website, technically necessary data is processed: IP address, date and time, requested URL, HTTP status code, amount of data transferred, referrer, and browser identifier (user agent). This data is processed to deliver the website, to prevent abuse (e.g. by limiting login attempts), and to analyse errors. The legal basis is Art. 6(1)(f) GDPR. Log files are rotated automatically, overwritten after a short time, and not combined with other data.

4. User account

For an organizer account we store your email address, your password (only as a secure hash), and the times of registration and email confirmation. To confirm your email address and to reset your password, we send you emails via an email service provider. The legal basis is Art. 6(1)(b) GDPR (provision of the service). The data is stored for as long as your account exists.

5. Sign-in with Google or Apple

Where offered, you can sign in with a Google or Apple account. You are redirected to the respective provider, from which we receive your email address, an identifier for your account, and whether the email address is verified. The providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland. Data may be transferred to the USA in the process; both providers are certified under the EU-U.S. Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR. Using these providers is optional; signing in with email and password is always possible.

6. Event data and invited people

Organizers can plan events in bewhere.app and enter data about people, such as name, email address, phone number, notes, and their assigned times and locations. The respective organizer is the controller for this data; we process it solely on their behalf (Art. 28 GDPR; see section 6 of the terms of use). Data subjects should first direct any requests to the organizer.

People who are given access via an invitation link can see their own schedule as well as the names and contact details of coworkers at the same event. Changes to events are logged with the time and the person who made them, so they can be traced and undone.

7. AI import

Where this feature is enabled, organizers can have event data generated by AI from text, files, or web pages. Only if you actively use this feature are your inputs and uploaded files transmitted to OpenRouter, Inc. (USA) and processed there by a language model provider. We only use providers that do not use the data for training. The transfer to the USA is based on the EU Standard Contractual Clauses. The legal basis is Art. 6(1)(b) GDPR. Please do not upload personal data that is not needed for planning. The generated draft is only applied after you confirm it.

8. Cookies and local storage

We only use technically necessary cookies to keep you signed in (an access cookie valid for 15 minutes and a session cookie valid for up to 30 days). In addition, we store display preferences such as the schedule zoom level in your browser's local storage. The legal basis is § 25(2) no. 2 TDDDG; no consent is required for this.

9. Your rights

You have the right to

  • access the data stored about you (Art. 15 GDPR),
  • rectification (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR).

To exercise these rights, simply contact us by email at the address above. On request, we will delete your account and the data associated with it.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

10. Obligation to provide data; automated decision-making

An email address is required for an organizer account; without it, no account can be created. No automated decision-making within the meaning of Art. 22 GDPR takes place.