Privacy Policy

Last updated: 11 November 2026. The German version is authoritative.

Pyrovero is an application that companies use to document preventive fire safety: devices, inspection deadlines, inspections, walk-throughs, instruction sessions, drills, incidents, decommissionings and tickets. This policy applies to the Pyrovero app for iPhone and iPad, the web app at app.pyrovero.de and the website pyrovero.de.

1. Controller

2. Who is responsible for what

Pyrovero is used by companies: fire safety service companies, their subcontractors, and owners or managers of buildings. There are two roles.

3. Website pyrovero.de

The website is a static page without cookies, tracking or advertising. Fonts are not loaded from third-party servers; the page uses your device's system fonts. If you switch the language, your browser remembers this choice locally; nothing is sent to us.

The website is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; delivered from Cloudflare data centres in the EU). When you visit, server log data is processed automatically: IP address, time, requested page, amount of data transferred, and browser and operating system identifiers. The legal basis is our legitimate interest in operating the site securely and reliably (Art. 6(1)(f) GDPR). We do not store or analyse this log data ourselves; Cloudflare deletes it according to its own retention policy.

Cloudflare, Inc. is based in the USA and certified under the EU-U.S. Data Privacy Framework; in addition, the European Commission's Standard Contractual Clauses apply (Art. 46(2)(c) GDPR). Cloudflare's privacy policy: cloudflare.com/privacypolicy.

4. User account

You need an account to use the app and the web app. For this we process:

• first name, last name and email address, which is also your login name,
• your password, but only as an encrypted check value; we never see the password itself,
• the company you belong to and your role there (admin or member),
• optionally your qualification, for example "competent person", your further training, and, if your company sets it, the flag "fire safety officer".

You get an account through a company's invitation code or by creating a new company. The inviting person sends an invitation from their own email program or passes the code on in person; Pyrovero does not send invitation emails. If you forget your password, you receive a link by email; if you want to delete your account, a confirmation code. You can change your email address yourself, and so can an admin of your company, for example to fix a typo; every such change is recorded in the log. You can delete your account yourself at any time, in the app under Settings and in the web app under Profile.

To keep you signed in, the app stores your session in your iPhone's or iPad's keychain and the web app in your browser's local storage. This is technically necessary (Section 25(2) no. 2 TDDDG). We do not set cookies for tracking or advertising.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

5. What companies record in Pyrovero

We process this data on behalf of the respective company (see section 2):

• Customers, sites and buildings: name, address, contact person, phone and email, characteristics of the building and, on request, a customer logo. If a site is deactivated, only the person's own company, the customer's company and its property manager see the name of the person who did it; other companies see the company or its role.
• Devices: name, category and characteristics, inventory number, location, label code, inspection interval, photos and position on the plan of the building or on the site plan of the premises.
• Plans of the buildings (overview and floors) and site plans of the premises as images. If a PDF is uploaded for this, we also store the pages used as plans in PDF form; we do not store the other pages of the file. Like photos, images and PDFs are kept in non-public storage. Plans that an owner account suggests to its service provider are visible only to the owner account and the service providers who decide on them until they are accepted; withdrawn and deleted suggestions are removed together with their files.
• Inspections: date, type, checklist items with answers, result, defects with deadlines, photos, next due date, and the name and qualification of the inspector as a snapshot. Inspections are not deleted but cancelled, so the record stays complete.
• Activities: walk-throughs, decommissionings and recommissionings, incidents, instruction sessions and drills with their details, findings and photos, plus the name and qualification of the person recording them as a snapshot. Completed activities are likewise not deleted but cancelled.
• Participants in instruction sessions: name, optionally role or department, whether the person was present, their signature as an image or the reason why they are missing, for example "refused". The signature is drawn on the device of the person delivering the instruction; beforehand the app shows a brief privacy notice from the responsible company. Only the image of the signature is stored, not writing dynamics such as pressure or speed. Names and signatures are deleted after a retention period that depends on the setting of the customer's company (see section 11). Afterwards no names remain, only the counts, for example "12 participants, 11 signed", and for each person whether they were present, the reason for a missing signature and, of a signature, only its fingerprint, a checksum over the image. When accompanying a walk-through, the name and role of the accompanying person are recorded and deleted in the same way.
• Drills record times, counts and areas, but also names of persons: in lists the evacuation wardens, the observers and the participants in the briefing and the debriefing, each with area or role; as text, with either name or role, who led the drill, the briefing and the debriefing, who assessed the drill and, if the target time was exceeded, who is responsible for the measures. The names in the lists are deleted under the same rule as participants in instruction sessions (see section 11); the text entries remain like the drill's other details. For people who did not follow the drill, only the number, the area and the suspected reason are provided for, no names.
• Appointment of fire safety officers: For the appointment of fire safety officers we store the name, company and period of the appointed person and their deputy, the signing person and the uploaded letters. The site sees the further training status of an external person only after their company has linked them, and only while they work there and their company has access; certificates stay with their company.
• Tickets: type, text, photos, priority, deadline, responsible person, history, reporting person with company, time and resolution. Tickets marked "internal" are visible only to the company that wrote them.
• Duties and deadlines: recurring services per customer, for example an annual instruction session, with interval and next due date.
• Responsibilities such as account manager and deputy.
• Connections and shares between companies, for example between a service company and its subcontractor or an owner, including the scope of a share. Owner accounts and property managers see the names of all companies at their sites, including subcontractors.
• Logos of the company, shown on its reports.
• Check-outs for working offline: who has checked out which buildings, rooms or devices since when, with the deadline and a short random identifier of the iPhone or iPad, not its name. The company of the person who checked out, the customer's company and its property manager see this. Other companies see checked-out devices and rooms only within their own scope, without the person and the device identifier. Admins can lift a lock.
• Log: every change is recorded with the time, the name and company of the person making it, and the previous and new state, along with the fact that a report was generated. The log serves as proof and is not altered afterwards.

Third-party reports are reports by companies not on Pyrovero that an owner account, its property manager or its fire safety officer files as a file. They may contain names and signatures of people at these companies. We store the files as they were filed for as long as the site exists; they can be read by the owner account, its property manager and the companies the trade is shared with. Entries under “Who does what” name companies not on Pyrovero, people from the own team and roles.

Each company sees only its own data and what another company explicitly shares with it. The database itself enforces this through access rules. Photos are meant to show devices and defects; people should not be photographed.

Reports and documentation packets are generated by the app or your browser from this data on your device; they are not additionally stored with us.

Each device can carry a label with a QR code. Anyone who scans the code with an ordinary camera sees only a general note about Pyrovero, no device data, unless they are signed in.

Note about owner accounts. When a company creates a customer in Pyrovero or changes the address or email of one of its own customers, Pyrovero checks street, house number, postcode and email addresses in its database against the sites and the confirmed email domains and addresses of owner accounts that are findable. When a company scans the label of a device it is not allowed to see, Pyrovero likewise checks whether its site belongs to such an account. The company only learns that the owner already uses Pyrovero, nothing else about the owner or other companies. The entries are not stored for this check; to limit misuse, we only count how often a company checks. Owner accounts are findable unless someone switches this off: their admins are asked about it when they start the app and can change it at any time in the settings. Pyrovero suggests the domains from the sign-in addresses of the account's members. When an admin confirms a domain, or a person confirms their own address with a general provider such as gmx.de, we store this with the name and time of the confirmation; such an address only counts as long as the person belongs to the account. To check whether a domain belongs to one account only, we also look at the part after the @ of other companies' sign-in addresses.

Proof chain and time stamps. Every completed proof, such as an inspection or a record, receives a fingerprint: a checksum over its content. We link these fingerprints into a chain for each company. For every proof we keep its core data: issuing company, customer, location, device or title, service, result, date and the name of the person who completed it, no names of participants. Only users who may see the proof in Pyrovero anyway can read this core data. We combine the fingerprints of several proofs into a single value and have it time-stamped by an external time-stamping service (FreeTSA, or DigiCert as a fallback). Only this one value is sent to the service; it allows no conclusions about content or persons. Every night our server checks that the chain, the time stamps and the files of the proofs are unchanged.

Verification page. Every proof carries a QR code with its fingerprint and core data on every page. Anyone who scans it, drops a proof PDF onto app.pyrovero.de/pruefen or types in a fingerprint needs no account. Your browser evaluates the core data from the QR code and a dropped PDF; they are not transmitted to us. Only the fingerprint is sent to us. Our server replies only with the status of the proof, its number and type, the name of the issuing company and the timestamps, never with content or names of persons. To limit misuse, we count requests per internet address. For this we do not store the address but only an irreversible fingerprint formed with a secret value; it is deleted by the following day at the latest. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

6. Camera, photos, signatures and working offline

The app uses the camera only when you scan a label or take a photo, and only with your permission, which you can withdraw at any time in the iOS settings. If you choose an existing photo, the iOS picker hands over only that one image; the app does not get access to your photo library. Pyrovero does not use location services.

Signatures are drawn directly on the screen. During the signing round the rest of the app is locked; only the person delivering the instruction can end the round using Face ID, Touch ID or their device passcode. This check is performed by iOS; we do not receive any biometric data.

Working offline. So that you can keep working without a connection, the app stores the data of the customers and buildings you open or check out for working offline in the protected storage of your iPhone or iPad: devices with their status, inspection templates and catalogue, and when checking out also plans and draft records. Whatever you record offline, that is inspections, tickets and records including photos and signatures, stays there until it has been uploaded; this happens automatically as soon as a connection is available again. So that the time of entries recorded offline can be verified, our server gives the app a time receipt with every connection, a signature over the time and your user ID. The app sends it back with the entry, and the time of your device only as a hint. Storing data on the device is technically necessary for the app to work offline (Section 25(2) No. 2 TDDDG).

7. Where the data is stored

Accounts, recorded data, photos, plans, signatures and logos are stored with our processor Supabase, Inc. (USA) in a data centre in Frankfurt am Main, Germany. Supabase uses Amazon Web Services for this. Sign-in and the related emails, such as the link for a forgotten password or the code for deleting your account, also run through Supabase. These emails are sent via the email service Brevo. All data is transferred encrypted. Photos, plans, signatures and logos are kept in non-public storage; signatures and logos each in their own.

Access from the USA, for example for maintenance and support, cannot be ruled out. Supabase is not certified under the EU-U.S. Data Privacy Framework; transfers are based on the European Commission's Standard Contractual Clauses, which are part of the data processing agreement with Supabase (Art. 46(2)(c) GDPR). Supabase's privacy policy: supabase.com/privacy.

To send these emails we use Brevo (Sendinblue SAS, Paris, France) as a processor. Brevo processes your email address and the content of the email for this purpose. Brevo may have data processed outside the EU; the European Commission's Standard Contractual Clauses apply (Art. 46(2)(c) GDPR). Brevo's privacy policy: brevo.com/legal/privacypolicy.

8. App Store and Apple

You get the app through Apple's App Store or TestFlight (Apple Distribution International Ltd., Cork, Ireland). Apple processes data under its own responsibility according to its privacy policy (apple.com/legal/privacy). If you agree in the iOS settings to share analytics with app developers, we receive anonymised crash reports from Apple that help us fix errors.

9. No tracking

The app, web app and website contain no analytics, advertising or tracking services. We do not create user profiles and do not sell data.

10. Contact

If you email us, we process your details to handle your enquiry (Art. 6(1)(b) GDPR for questions about a contract, otherwise Art. 6(1)(f) GDPR). We delete them once they are no longer needed and no statutory retention obligations apply.

11. Retention

• Account: as long as you are a member of a company in Pyrovero. If your company removes you, the account remains until you delete it. You can do this yourself at any time in the app and in the web app; an email to us works as well.
• Your name and your account's internal identifier (a random string) remain in the records and entries of the companies you worked for in Pyrovero (among others inspections, activities, tickets, appointments, responsibilities, check-outs and the log) as part of the respective company's records, even after your account is deleted. Your sign-in, email address and all other details of your account are deleted.
• Participants in instruction sessions, lists in drills and accompanying persons on walk-throughs: names, roles or areas and signatures are deleted from a deletion date that is set when the activity is completed. It is the date of the activity plus the period set by the customer's company (without a company setting five years, adjustable between one and 30 years) or, if that is longer, plus the interval that Pyrovero provides for this type of activity and twelve months. With a period of one year, the annual instruction session (interval twelve months) therefore gives two years. Afterwards the counts remain, and for each person whether they were present, the reason for a missing signature and the fingerprint of a signature, but no names.
• Logos: until the company replaces or removes them or the company's data is deleted.
• A company's data: as long as the company exists in Pyrovero. If an admin dissolves the company, they first download an export as a ZIP file: the data of the company's own customers, the qualifications in the team and the log as lists (CSV), inspection reports per customer as PDF, the photos of devices and inspections, the plans with their original PDFs, the uploaded letters of fire safety officer appointments and the files of third-party reports. The export does not contain signature images, logos, photos of activities and from the history of tickets, or the proof PDFs of activities. After the dissolution the data is read-only and is deleted after 90 days unless an admin reverses the dissolution before then. An owner account cannot be dissolved in the app or the web app; we do this in person at the request of one of its admins.
• Core data in the proof chain: as long as the company's data exists. If the company is finally deleted, we delete the core data; the fingerprints remain so that a printout can still be verified. They reveal nothing about content or persons.
• Counters of the verification page: by the following day at the latest.
• On your device: when you sign out, the app deletes the customer data it stored for working offline. Entries not yet uploaded and an ongoing check-out remain so that nothing is lost, and are uploaded only under the same sign-in; uploaded entries are deleted by the app automatically. If you delete the app, everything still on the device is gone, including entries not yet uploaded.
• Technical access logs are kept by Supabase only briefly for troubleshooting and security. Backups are overwritten at regular intervals.

12. Your rights

Within the legal framework you have these rights: access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing (Art. 21 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority, for example the Independent Data Protection Centre of Saarland (Unabhängiges Datenschutzzentrum Saarland).

For data that a company has recorded about you, for example as a participant in an instruction session, that company is the right contact (see section 2). For everything else, an email to us is enough.

13. Changes

If Pyrovero or the legal requirements change, we will update this policy. The version published here applies.