Privacy Policy

Protecting your personal data is important to us. This Privacy Policy explains what personal data we collect and process when you use my-notvorrat.ch, the purposes for which we use it, which service providers may receive your data, and what rights you have.

my-notvorrat.ch is a web application for planning, calculating and managing emergency supplies for private households.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and the associated Data Protection Ordinance (DPO). Where applicable in individual cases, we also comply with the European General Data Protection Regulation (GDPR).

The entity responsible for processing your personal data is:

Müller WebApps

Sole proprietorship

Florian Müller

Siteweg 2

5024 Küttigen

Switzerland

Email: info@my-notvorrat.ch

Website: www.mueller-webapps.ch

If you have any questions about the processing of your personal data or wish to exercise your data protection rights, you can contact us using the email address provided above.

To create and use a user account, we collect the following information:

• Full name
• Gender
• Date of birth
• Email address
• Password

Passwords are not stored in plain text but are processed using secure password hashing methods.

We require this information to set up and manage your account, authenticate you and provide the features of our application.

We use your gender and date of birth exclusively to estimate your individual calorie and water requirements for emergency supply planning.

We do not use this information to create advertising profiles.

For paid subscriptions, we also process the information required to manage the contractual relationship, particularly the selected subscription plan and subscription status.

my-notvorrat.ch allows you to create and manage households.

The following information may be stored in particular:

• Household name or designation
• Optional household address
• Information about household residents
• Age or dates of birth and gender of residents
• Associated user accounts and household memberships
• Calculated emergency supply requirements
• Recorded supplies and product information

This information is used to calculate recommended emergency supplies and enable the management of households and inventories.

Providing a household address is optional.

If you enter information about other individuals, such as family members or housemates, you are responsible for ensuring that you are authorised to provide this information and that the individuals concerned are appropriately informed.

When entering information about minors, their rights and interests must be given particular consideration.

You can invite other registered users to manage a household together.

Invited users are granted access to the information stored for the respective household, particularly resident data, supplies, products and checklists.

They can use the corresponding management features.

Management of household memberships, particularly adding or removing users, remains the responsibility of the household owner.

Please note that invited users can view and modify shared household information.

We therefore recommend inviting only people you trust.

When you manage your emergency supplies, we process the information you enter.

This may include:

• Product names and categories
• Quantities and units
• Best-before and expiry dates
• Storage locations
• Consumption and inventory information
• Shopping lists and checklists
• Barcode and nutritional information

You decide which products to record.

Voluntarily recording certain products, such as medication, may allow conclusions to be drawn about personal circumstances or health information.

We do not require medical information and do not create health profiles.

The data you enter is used to manage your emergency supplies, calculate your requirements and provide the corresponding application features.

Our application is hosted by METANET AG on server infrastructure located in Switzerland.

User, household and inventory data is stored centrally on this infrastructure.

For technical operations, we primarily use Laravel, PHP and MySQL.

The databases and files associated with the application are hosted in Swiss data centres.

External backups provided by our hosting provider are also stored within Switzerland.

We use additional service providers for certain features. As a result, data may also be processed outside Switzerland. These services are explained in the following sections.

Further information: https://www.metanet.ch

When you visit our website or use the application, technical access data may be collected automatically.

This may include:

• IP address
• Date and time of access
• Pages and interfaces accessed
• Browser type and operating system
• HTTP status codes
• Technical error messages
• Security-related events

This information is required to provide our website and application, ensure system security, identify technical problems and prevent misuse.

Technical server logs are processed on the hosting infrastructure.

The specific retention period for these logs depends on the configuration and operational policies of the hosting provider.

Our application uses technically necessary cookies and local storage technologies.

These include, in particular:

Session cookies: These enable authentication and maintain your session.

Remember-me cookies: When this feature is used, your login session may be maintained beyond a single browser session.

Service workers: These enable certain application components to be made available locally and support offline functionality.

Local data storage: Information may be temporarily stored on your device as part of the offline functionality.

These technologies support the functionality, security and usability of our application.

We currently do not use advertising cookies, marketing pixels or separate web analytics services to create visitor profiles.

You can manage or delete cookies and locally stored website data through your browser settings. Doing so may limit certain features.

Offline functionality is available with the Professional subscription.

This allows data displayed to you during online use to be stored additionally on your device.

This includes, in particular:

• Household and resident information
• Inventory and product data
• Checklists
• Other application information required for offline use

Local storage allows you to use the application to a limited extent even without an active internet connection.

Certain actions can be performed in offline mode, particularly marking stored products as consumed.

Locally stored data is automatically removed from your device when the relevant logout or deletion procedures are performed.

Please note that individuals who have access to your device or browser profile may also be able to access locally stored information while it remains available.

We therefore recommend protecting your device with appropriate security measures.

my-notvorrat.ch offers AI-powered image recognition to simplify the process of recording emergency supply products.

For this purpose, we use Google's paid Gemini API.

When you actively use this feature, you can take a photograph of a product with your camera or upload an existing image.

The image is transmitted through our backend to Google Gemini together with a technical processing instruction (prompt).

The prompt contains instructions for recognising and analysing the product shown, particularly for extracting product information and nutritional values.

When using this feature, we do not transmit additional information from your user profile, such as your name, email address or household memberships.

Since images themselves may contain personal or confidential information, we recommend photographing only the relevant product packaging and product details.

We do not permanently store the submitted product images after the analysis has been completed.

However, product information recognised by Gemini and subsequently accepted by you may be stored as part of your emergency supplies inventory.

We use a paid Gemini API subscription. Under the applicable terms, Google does not use submitted prompts, images or generated responses for the general improvement or training of its AI models.

Google may retain certain API inputs, contextual information and generated responses for up to 55 days for abuse detection, security purposes and compliance with legal obligations.

Under certain circumstances, appropriately authorised Google personnel may review flagged content.

Google may also process data outside Switzerland.

Further information:

https://ai.google.dev/gemini-api/terms

https://ai.google.dev/gemini-api/docs/usage-policies

We use the Open Food Facts product database to retrieve product information based on barcodes.

Barcode recognition is performed using a locally integrated software library.

For product searches, only the recognised or entered barcode number is transmitted to Open Food Facts through our backend.

We do not transmit additional user information such as your name, email address or household data.

The barcode number is used to identify the corresponding product.

Open Food Facts may process technically necessary connection information from our servers.

Further information:

https://world.openfoodfacts.org

https://world.openfoodfacts.org/privacy

For the optional entry and display of household addresses, we use services provided by the Google Maps Platform, particularly the Geocoding API and Google Maps.

If you provide an address for a household, this address may be transmitted to Google for geographical identification.

The address is submitted to the Geocoding API to determine the corresponding geographical coordinates.

We do not store the results as a separate permanent dataset. Temporary storage in the Laravel cache may occur.

The household address you provide remains stored in our regular application database.

When you view a household with a stored address, an embedded Google Map is loaded automatically.

Your browser establishes a direct connection to Google. As a result, Google may receive your IP address, technical browser information and information related to the displayed map.

The mapping services are used exclusively to geographically identify and display the households you manage.

Google may process the information received outside Switzerland in accordance with its applicable privacy policies and contractual terms.

Further information:

https://policies.google.com/privacy

https://developers.google.com/maps

We use Sentry to detect, analyse and resolve technical errors.

We use Sentry's free subscription with the data region set to the European Union (EU).

Our Laravel application transmits technical error events through the Sentry integration.

The following information may be processed in particular:

• Error messages
• Technical error details
• Time and context of an error
• Affected application components
• Information about executed requests

We use the default configuration of the Sentry integration. The automatic transmission of additional personally identifiable information (send_default_pii) is disabled.

Nevertheless, it cannot be completely ruled out that individual error events may contain personal data, for example within error messages or accessed URLs.

Error events are stored in the selected EU data region and automatically deleted after a retention period of 30 days.

Sentry is used exclusively for technical error analysis and to improve the stability and security of our application.

We do not use Sentry to create advertising profiles or conduct marketing analyses.

Depending on the contractual and organisational arrangements of the service, additional cross-border data processing may occur as part of service delivery.

Further information:

https://sentry.io/privacy/

We send functional emails as part of operating the application.

These may include:

• Registration and account confirmation
• Password resets
• Security and account notifications
• Household invitations
• Expiry date reminders
• Subscription and payment information

Emails are sent using the SMTP infrastructure of our hosting provider, METANET.

For this purpose, we process your email address, message content and the necessary technical delivery information.

We currently do not send regular advertising newsletters.

If we introduce additional marketing communications in the future, we will comply with applicable legal requirements and obtain your prior consent where required.

We use the payment service provider Stripe to process paid subscriptions.

When you purchase a paid subscription, the information required for payment processing is collected by Stripe or transmitted to Stripe.

This may include, in particular:

• Information about the payment transaction
• Payment amount and currency
• Information about the selected subscription
• Email address
• Billing information, where required
• Payment information you enter directly with Stripe

We do not store full credit card numbers or card verification codes in our application database.

We process only the information necessary to manage subscriptions, particularly subscription status and technical payment references.

Stripe processes additional information for payment processing, fraud prevention and compliance with legal obligations.

Data may also be processed outside Switzerland.

Further information:

https://stripe.com/privacy

If you contact us by email or through the contact methods provided in our legal notice, we process the information you provide.

This may include:

• Name
• Email address
• Content of your enquiry
• Other information voluntarily provided

We use this data to process and respond to your enquiry and for related administrative purposes.

Our website also contains a link to mueller-webapps.ch, where a contact form is available.

When using that contact form, the privacy information published on the corresponding website also applies.

We process personal data particularly for the following purposes:

• Providing and operating our web application
• Managing user accounts and access rights
• Managing households and resident data
• Calculating recommended emergency supply requirements
• Managing inventories, products and checklists
• Providing offline functionality
• Sending functional email notifications
• Processing paid subscriptions
• AI-powered product recognition
• Retrieving product information using barcodes
• Displaying household addresses on maps
• Ensuring system security
• Error analysis and technical maintenance
• Handling support enquiries
• Complying with legal obligations

We process personal data in accordance with Swiss data protection law.

Where the GDPR applies in individual cases, we rely in particular on the following legal bases:

Performance of a contract (Art. 6(1)(b) GDPR): Providing the agreed features and managing user accounts and subscriptions.

Legal obligations (Art. 6(1)(c) GDPR): Complying with statutory retention, documentation and disclosure obligations.

Legitimate interests (Art. 6(1)(f) GDPR): Ensuring secure and reliable operation, analysing technical errors and preventing misuse, provided the applicable legal requirements are met.

Consent (Art. 6(1)(a) GDPR): Where data processing is based on consent that has been freely given and is legally required.

Consent may be withdrawn at any time with effect for the future.

We work with selected technical service providers to deliver our services.

These include, in particular:

• METANET: Hosting, database operations, backups and email delivery in Switzerland
• Google: AI-powered product recognition, mapping and geocoding services
• Stripe: Payment processing and subscription management
• Sentry: Technical error monitoring with the EU data region
• Open Food Facts: Retrieving product information based on barcodes

Our central application data is stored in Switzerland.

However, when external services are used, certain information may be processed abroad or transferred to other countries. This particularly concerns the EU or EEA, the United States and, depending on the respective service, other processing locations.

We comply with the requirements of applicable data protection law when transferring data internationally.

Where a recipient country does not have a recognised adequate level of data protection, the legally required safeguards or permissible exceptions must be in place.

We do not sell personal data to third parties.

As a general rule, we retain personal data for as long as necessary to provide our services, fulfil contractual obligations or pursue purposes that are legally permitted or required.

20.1 User Accounts

You can request deletion of your user account yourself.

After a deletion request is submitted, your account is initially deactivated.

You have seven days to request cancellation of the deletion.

After this period, application data associated with your account is deleted from the active data storage systems, unless statutory retention obligations require otherwise.

20.2 Owned Households and Inventories

Households that you own are also deleted as part of the final account deletion process.

This includes, in particular:

• Household information
• Recorded inventories and products
• Household-related checklists
• Resident data created exclusively for calculating emergency supply requirements

Members who have their own user accounts and were invited to such a household lose access to that household once it has been deleted.

Their own user accounts and independently managed households or content remain unaffected.

20.3 Local Offline Data

Locally stored application data is automatically removed from the respective device when the relevant deletion procedures are performed.

On devices that are not connected to the application during account deletion, a local copy may remain until the corresponding deletion procedure is carried out on the device or the browser data is removed.

20.4 Backups

Our hosting provider creates backups that are also stored outside the primary data centre on infrastructure located in Switzerland.

These backups are retained for up to three months.

Data that has already been deleted from the active application database may still be contained in backups during this period.

Backups are deleted or overwritten as part of the regular backup rotation process.

20.5 Technical Error Data

Technical error events in Sentry are retained for 30 days under the free subscription currently in use.

Other technical log data is subject to the respective retention and deletion procedures of the systems and service providers used.

20.6 Statutory Retention Obligations

Certain information, particularly documents relevant to accounting and tax law, may be retained even after account deletion where we are legally required to do so.

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, misuse and unauthorised modification.

These measures include, in particular:

• Encrypted data transmission via HTTPS/TLS
• Secure password hashing methods
• Encryption mechanisms for appropriate data and system components
• Access and permission controls
• Security measures at server and application level
• Regular data backups
• Technical error monitoring

We review and adapt our security measures as part of ongoing technical development.

Despite these measures, absolute security cannot be guaranteed when transmitting or storing data electronically.

Our application currently does not have a general technical age restriction.

When processing personal data relating to minors, we comply with applicable legal requirements.

Where a minor is not legally capable of providing valid consent to the required data processing or making the relevant decisions independently, the involvement or consent of an authorised legal representative is necessary.

We recommend that parents and other legal guardians appropriately supervise children's use of the application.

Our application uses certain personal information, particularly age and gender, to estimate calorie and water requirements.

These calculations are intended solely to support your personal emergency supply planning.

We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the individuals concerned.

We do not create personal advertising profiles.

Under applicable data protection law, you have the following rights in particular:

Right of access: You may request information about the processing of your personal data.

Right to rectification: You may request the correction of inaccurate personal data.

Right to erasure: You may request the deletion of your personal data where the legal requirements are met.

Right to data disclosure or portability: You may request the disclosure or transfer of certain personal data where the legal requirements are met.

Right to object: You may object to certain processing of your personal data in accordance with applicable law.

Withdrawal of consent: Where processing is based on your consent, you may withdraw that consent with effect for the future.

You can view, correct or delete much of your information directly in the settings of my-notvorrat.ch.

For further requests, you can contact us at:

info@my-notvorrat.ch

To prevent unauthorised access, we may request appropriate proof of identity.

You may also contact the competent data protection supervisory authority where you have the right to lodge a complaint.

In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC):

https://www.edoeb.admin.ch

Our website may contain links to external websites and services.

The privacy policies of the respective providers apply to the processing of personal data on those websites.

We recommend reviewing these policies before using external services.

We may update this Privacy Policy if our services, the technologies we use, our processing of personal data or the applicable legal framework change.

The version published on my-notvorrat.ch at any given time shall apply.

In the event of significant changes, we will inform affected users in an appropriate manner where required.

Last updated: 20 October 2026