Privacy policy

Last updated: September 2026

The protection of your personal data matters to us. Below we inform you, in accordance with the General Data Protection Regulation (GDPR), which data we process when you visit our website and use the FlowBotCommander application.

1. Controller

Patrick Kairies
Hauptstraße 64
37671 Höxter-Ovenhausen, Deutschland
Email: service@flowbotcommander.com

2. Hosting

Our website and the licence service are operated at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers located in Germany. Hetzner processes the data arising from provision on our behalf (processing on behalf pursuant to Art. 28 GDPR). The legal basis is our legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR).

3. Server log data

When you access our website, information transmitted by your browser is processed automatically: IP address, date and time, the address requested, referrer as well as browser and system details. This data serves technical provision, security and abuse prevention. The legal basis is Art. 6 (1) (f) GDPR.

4. Cookies

We only use technically necessary cookies. In particular, we store your language choice in a cookie („lang") so that the website appears in the language you selected. A session cookie is set for logging in to the customer account. These cookies are required for operation (§ 25 (2) TDDDG); no tracking takes place and nothing is passed on for advertising purposes.

4a. Download of the free version (e-mail confirmation)

To provide the free version we ask for your e-mail address and send you a confirmation link (double opt-in); after confirmation you receive the download link by e-mail. We store the address, the times of request and confirmation and the IP addresses used at both moments as proof of the request. Legal basis: Art. 6(1)(b) GDPR (provision of the software at your request) and, for the proof, Art. 6(1)(f) GDPR. A customer record with your address is created in our licence system so that a later subscription can be assigned to it. Unconfirmed requests are deleted after 7 days; confirmed data is kept as long as the customer relationship exists. Only if you tick the separate box do we also use the address for occasional product news (Art. 6(1)(a) GDPR); you can withdraw this consent at any time by e-mail to the address in section 1 with effect for the future.

4b. Bug reports

If you report a bug via /bug-melden we store the report (title, description, steps, app version), the time and your IP address (to prevent abuse) and — only if you enter it — your e-mail address to reply and, if the bug is confirmed and the address belongs to a customer account, to send a thank-you gift. Legal basis: Art. 6(1)(f) GDPR (our interest in a working product), for the gift Art. 6(1)(b) GDPR. Closed reports are deleted after 180 days.

4c. Newsletter

If you subscribe to our news (via /newsletter or the optional checkbox on the download page) we store your e-mail address, your language, the time and IP address of the sign-up and of the confirmation click, and the wording of the consent as proof (double opt-in). Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time via the unsubscribe link in every e-mail or on /newsletter/abmelden — the withdrawal takes effect immediately; we then keep only the address with a block note so we do not write to you again. Newsletters are sent from our own mail server; no third-party newsletter provider is involved. Links in newsletters are counted per link only (how often a link was clicked) — no tracking pixel, no assignment to persons. Customers with a running subscription may additionally receive contractual information (price changes, maintenance, cancellation options) on the basis of the contract, Art. 6(1)(b) GDPR.

5. Customer account, licence and contact

To manage your licence and account we process your email address and the data belonging to your licence (licence status, run quota, activations). If you contact us by email, we process your details in order to handle your enquiry. The legal basis is performance of the contract or pre-contractual measures (Art. 6 (1) (b) GDPR) as well as our legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR). Recovery and account emails are sent via our email service provider (IONOS SE, Germany).

6. Data from the application (licence check)

For the licence check and to prevent abuse, the installed application transmits to our licence server: a pseudonymous device identifier (a SHA-256 hash of characteristics of your device from which no plain-text data can be reconstructed), the app version, basic operating system details as well as the number of started and completed runs. This data is required to provide the licensed service (Art. 6 (1) (b) GDPR) and serves abuse and fraud prevention (Art. 6 (1) (f) GDPR).

7. Payment processing (PayPal)

For payment processing we use PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. We transmit the data required for the payment. For subscriptions, PayPal carries out the recurring debits at the start of each billing period on the basis of the billing agreement you concluded with PayPal; we receive notifications about the payment status (e.g. paid, failed, refunded) and store the transaction reference to assign it to your licence. PayPal processes this data as an independent controller under its own privacy provisions and on the basis of its own legal obligations; we have no influence over that processing. The legal basis for our transmission is performance of the contract (Art. 6 (1) (b) GDPR). PayPal's privacy notice: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

8. Notices in the free mode

In the free mode the software shows notices about our own offers and projects. No third-party advertising networks are integrated. No identifiers of your device are used to deliver these notices, there is no measurement of your usage behaviour and no profiling. No consent is required for this.

8a. Reach measurement of our own notices

To recognise whether our notices attract interest, we count how often the respective redirect was called. We store only a total figure per notice and calendar day. Neither cookies nor other information are stored on or read from your device, no IP addresses are stored for this purpose and no individual calls are logged. Recognising individual persons or devices is therefore impossible. Orders record which notice they came from. The legal basis is our legitimate interest in assessing how we present our own offering, Art. 6 (1) (f) GDPR.

8b. Embedded YouTube videos (two-click solution)

Our website contains videos hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). By default only a locally hosted preview image is shown and no data is transmitted to Google. The video is loaded from YouTube (in the extended data-protection mode, youtube-nocookie.com) only when you actively click the play button; from that moment on YouTube may process your IP address and set cookies. Legal basis is your consent (Art. 6(1)(a) GDPR), given by clicking. Details: https://policies.google.com/privacy

9. Recipients and transfers to third countries

Your data is only passed on to the service providers named (hosting, email, payment) and only to the extent necessary to provide the service. A transfer to third countries outside the EU/EEA is not intended; should it occur in exceptional cases (e.g. through a payment service provider), it takes place on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR.

10. Storage periods

We store personal data only as long as necessary for the stated purposes or as long as statutory retention periods require. In detail: server log data 7 days, then automatic deletion; licence and account data for the duration of the licence, then a further 3 years (limitation periods); invoice and payment data 10 years (§ 147 German Fiscal Code, § 257 German Commercial Code); cancellation records 3 years after the end of the contract; reach figures for our own notices only as daily totals without any personal reference. Afterwards the data is deleted or anonymised.

11. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) as well as objection to processing based on a legitimate interest (Art. 21). You may withdraw any consent given at any time with effect for the future. To exercise your rights, an email to service@flowbotcommander.com is sufficient.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

13. Changes to this policy

We adapt this privacy policy when the service or the legal situation changes. The version published on this page applies.