Privacy Policy

Last updated: 13 September 2026. The German version is authoritative.

Pyrovero is an application that companies use to document fire safety equipment: devices, inspection deadlines, inspections, defects and reports. This policy applies to the Pyrovero iPhone app, the web app at app.pyrovero.de and the website pyrovero.de.

1. Controller

2. Who is responsible for what

Pyrovero is used by companies: fire safety service companies, their subcontractors, and owners or managers of buildings. There are two roles.

3. Website pyrovero.de

The website is a static page without cookies, tracking or advertising. Fonts are not loaded from third-party servers; the page uses your device's system fonts. If you switch the language, your browser remembers this choice locally; nothing is sent to us.

The website is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; delivered from Cloudflare data centres in the EU). When you visit, server log data is processed automatically: IP address, time, requested page, amount of data transferred, and browser and operating system identifiers. The legal basis is our legitimate interest in operating the site securely and reliably (Art. 6(1)(f) GDPR). We do not store or analyse this log data ourselves; Cloudflare deletes it according to its own retention policy.

Cloudflare, Inc. is based in the USA and certified under the EU-U.S. Data Privacy Framework; in addition, the European Commission's Standard Contractual Clauses apply (Art. 46(2)(c) GDPR). Cloudflare's privacy policy: cloudflare.com/privacypolicy.

4. User account

You need an account to use the app and the web app. For this we process:

• first name, last name and email address, which is also your login name,
• your password, but only as an encrypted check value; we never see the password itself,
• the company you belong to and your role there (admin or member),
• optionally your qualification, for example "competent person".

You get an account through a company's invitation code or by creating a new company. The inviting person sends an invitation from their own email program or passes the code on in person; Pyrovero does not send invitation emails. If you forget your password, you receive a link by email. You can change your email address yourself, and so can an admin of your company, for example to fix a typo; every such change is recorded in the log.

To keep you signed in, the app stores your session in your iPhone's keychain and the web app in your browser's local storage. This is technically necessary (Section 25(2) no. 2 TDDDG). We do not set cookies for tracking or advertising.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

5. What companies record in Pyrovero

We process this data on behalf of the respective company (see section 2):

• Customers and properties: name, address, contact person, phone and email.
• Devices: name, type, inventory number, location, label code, inspection interval, additional fields, photos and position on the floor plan.
• Floor plans as images.
• Inspections: date, type, result, defects with deadlines, photos, next due date, and the name and qualification of the inspector as a snapshot. Inspections are not deleted but cancelled, so the record stays complete.
• Reports: type, text, photo, reporting person with company, time and resolution. Reports marked "internal" are visible only to the company that wrote them.
• Responsibilities such as account manager and deputy.
• Connections and shares between companies, for example between a service company and its subcontractor or an owner.
• Log: every change is recorded with the time, the name and company of the person making it, and the previous and new state. The log serves as proof and is not altered afterwards.

Each company sees only its own data and what another company explicitly shares with it. The database itself enforces this through access rules. Photos are meant to show devices and defects; people should not be photographed.

Each device can carry a label with a QR code. Anyone who scans the code with an ordinary camera sees only a general note about Pyrovero, no device data, unless they are signed in.

6. Camera and photos

The app uses the camera only when you scan a label or take a photo, and only with your permission, which you can withdraw at any time in the iOS settings. If you choose an existing photo, the iOS picker hands over only that one image; the app does not get access to your photo library. Pyrovero does not use location services.

7. Where the data is stored

Accounts, recorded data, photos and plans are stored with our processor Supabase, Inc. (USA) in a data centre in Frankfurt am Main, Germany. Supabase uses Amazon Web Services for this. Sign-in and sign-in emails, such as the link for a forgotten password, also run through Supabase. All data is transferred encrypted; photos and plans are kept in non-public storage.

Access from the USA, for example for maintenance and support, cannot be ruled out. Supabase is not certified under the EU-U.S. Data Privacy Framework; transfers are based on the European Commission's Standard Contractual Clauses, which are part of the data processing agreement with Supabase (Art. 46(2)(c) GDPR). Supabase's privacy policy: supabase.com/privacy.

8. App Store and Apple

You get the app through Apple's App Store or TestFlight (Apple Distribution International Ltd., Cork, Ireland). Apple processes data under its own responsibility according to its privacy policy (apple.com/legal/privacy). If you agree in the iOS settings to share analytics with app developers, we receive anonymised crash reports from Apple that help us fix errors.

9. No tracking

The app, web app and website contain no analytics, advertising or tracking services. We do not create user profiles and do not sell data.

10. Contact

If you email us, we process your details to handle your enquiry (Art. 6(1)(b) GDPR for questions about a contract, otherwise Art. 6(1)(f) GDPR). We delete them once they are no longer needed and no statutory retention obligations apply.

11. Retention

• Account: as long as you are a member of a company in Pyrovero. If your company removes you, the account remains until you ask us to delete it. Until the app has its own function for this, an email to us is enough.
• In inspections, reports and the log, your name remains as part of the respective company's records even after your account is deleted.
• A company's data: as long as the company uses Pyrovero. After use ends, we delete it on the company's instruction, at the latest 90 days after the end of the contract, unless statutory retention obligations apply.
• Technical access logs are kept by Supabase only briefly for troubleshooting and security. Backups are overwritten at regular intervals.

12. Your rights

Within the legal framework you have these rights: access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing (Art. 21 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority, for example the Independent Data Protection Centre of Saarland (Unabhängiges Datenschutzzentrum Saarland).

For data that a company has recorded about you, that company is the right contact (see section 2). For everything else, an email to us is enough.

13. Changes

If Pyrovero or the legal requirements change, we will update this policy. The version published here applies.