PRIVACY POLICY

Last updated October 8, 2026

This Privacy Notice for Dumke Ventures UG (haftungsbeschränkt) ("we," "us," or "our") describes how and why we process your personal information when you use our services ("Services"), including when you:

  • Download and use our mobile application (HeartNotes) ("App")
  • Visit our website heartnotesapp.com
  • Contact us by email

We are the controller responsible for your personal information. Our full legal notice (Impressum) is available at /impressum.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you have any questions or concerns, please contact us at [email protected].

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? We process the information you enter in the App (such as notes, facts and dates about your partner, an optional partner photo, reminders and AI chats), an anonymous account ID, your settings, technical crash data, and your email if you write to us. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Your notes are free text and you decide what to write. Some of the App's suggested note topics touch on health, such as allergies, so your notes may include details you or your partner consider sensitive. We process them only to provide the App features to you. We do not process biometric data. Learn more.

Do we collect any information from third parties? We receive limited information from the app stores and our subscription provider RevenueCat, for example your subscription status. Learn more.

How do we process your information? We process your information to provide and administer the App, run the AI features you use, manage subscriptions, fix crashes and errors, answer your messages, keep our Services secure, and comply with law. Learn more about how we process your information.

In what situations and with which parties do we share personal information? We share information with the service providers named in Section 4, who process it on our behalf. We do not sell your personal information. Learn more about when and with whom we share your personal information.

Do we offer AI-based products? Yes. HeartNotes includes AI features powered by OpenAI (the AI coach, compliments, date ideas and note suggestions) that use your requests and saved notes. Learn more.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information, including the right to object and the right to lodge a complaint with a supervisory authority. Learn more about your privacy rights.

How do you exercise your rights? You can edit or delete your data in the App, or contact us at [email protected]. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

TABLE OF CONTENTS

  1. WHAT INFORMATION DO WE COLLECT?
  2. HOW DO WE PROCESS YOUR INFORMATION?
  3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
  4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
  5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?
  6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
  7. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
  8. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
  9. HOW LONG DO WE KEEP YOUR INFORMATION?
  10. HOW DO WE KEEP YOUR INFORMATION SAFE?
  11. WHAT ARE YOUR PRIVACY RIGHTS?
  12. DO WE COLLECT INFORMATION FROM CHILDREN?
  13. CONTROLS FOR DO-NOT-TRACK FEATURES
  14. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
  15. DO WE MAKE UPDATES TO THIS NOTICE?
  16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
  17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect the personal information you enter in the App or send to us.

When you use the App or contact us, we process:

  • Account data: an anonymous account ID that is created automatically when you first open the App. We do not ask for your name, email address or a password.
  • Content you enter: facts and notes about your partner, your partner's name, nickname, birthday and anniversary, an optional partner photo, reminders, answers to daily questions, saved compliments, love actions, custom categories and your AI chat history.
  • Settings: your goals from onboarding, preferred tone, reminder times, language and time zone, and the date you accepted our terms.
  • Contact data: your email address and message if you write to us.

Information about your partner and other people

HeartNotes is designed for saving notes about someone close to you. Your notes, facts, reminders and dates, and the name, nickname, birthday, anniversary and any photo you enter, are therefore information about your partner as well as about you. We process this information on your instructions only to provide the App to you: for your own data on the basis of our contract with you (Art. 6(1)(b) GDPR), and for your partner's data on the basis of our legitimate interest, and yours, in offering and using the personal memory aid you asked for (Art. 6(1)(f) GDPR). We use it only inside your account: to show it to you, for reminders and, when you use AI features, as context for the AI provider (Section 7). We never contact your partner and never share the information with other users. We cannot inform your partner directly because we do not have their contact details (Art. 14(5)(b) GDPR). Please only save information you would be comfortable for your partner to know you keep. Your partner can exercise their rights under this notice, including asking us to delete information about them, by writing to [email protected].

Health-related notes. Some of the App's suggested note topics touch on health, for example blood type, medical allergies, dietary restrictions, sick day essentials, or what helps with stress or anxiety. Filling them in is always optional. If you record such details, we store them in your account and use them only to provide the App to you, including as context for the AI features when you use them (Section 7). Please only record health details about your partner if your partner agrees.

Partner photo. If you choose to add a photo of your partner, we access your camera or photo library only with your device permission and only for the photo you select. We resize the photo to a small size and store it in our cloud storage (Google Firebase), linked to your account, so it can be shown in the App. Adding a new photo replaces the previous one. We do not use the photo for facial recognition, biometric analysis or AI processing, and we do not process biometric data. Please only add a photo if the person in it agrees.

Payment data. Purchases are processed by Apple (App Store) or Google (Google Play). We and RevenueCat receive only the purchase receipt, product, price, country and subscription status, never your card details.

Usage and device data. When the App or our server functions run, our service providers automatically process technical information such as your IP address, device type and operating system, app version, language settings, and crash, error and performance data (see Sections 4 and 6). We also store usage counters for the AI features, linked to your account ID, to prevent misuse.

Information from third parties. We receive limited information from the app stores (Apple and Google) and our subscription provider RevenueCat, for example your subscription or purchase status.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide and administer the App, run the AI features you use, manage subscriptions, fix errors, keep our Services secure, and comply with law.

We process your personal information for the following purposes:

  • To create and manage your anonymous account.
  • To deliver the App, including storing and syncing your partner profile, notes, photo and reminders.
  • To provide the AI features you use (see Section 7).
  • To process your purchases and manage your subscriptions.
  • To answer your messages when you contact us.
  • To protect our Services, including preventing misuse of the AI features and keeping the App and website secure.
  • To fix crashes and errors through crash, error and performance reports.
  • To comply with legal obligations and to establish, exercise, or defend legal claims.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

In Short: We process your personal information only when we have a valid legal reason (i.e., legal basis) to do so under applicable law.

If you are located in the EU or EEA, the General Data Protection Regulation (GDPR) requires us to explain the legal bases we rely on. We rely on these legal bases:

  • Providing the App (account ID, your notes, partner details and photo, reminders, AI features, subscription status): performance of our contract with you, Art. 6(1)(b) GDPR.
  • Information about your partner that you enter: our legitimate interest, and yours, in providing the App you asked for, Art. 6(1)(f) GDPR.
  • Crash, error and performance reports (Sentry), server logs, usage counters against misuse, and website delivery and security (Cloudflare): our legitimate interest in a stable and secure App and website, Art. 6(1)(f) GDPR.
  • Answering your emails: Art. 6(1)(b) GDPR where it concerns your use of the App, otherwise our legitimate interest in answering you, Art. 6(1)(f) GDPR.
  • Keeping purchase and tax records: legal obligation, Art. 6(1)(c) GDPR together with § 147 AO and § 257 HGB.
  • Establishing, exercising or defending legal claims: legitimate interest, Art. 6(1)(f) GDPR.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share information with the service providers listed below to operate the Services. We do not sell your personal information.

We use the following service providers. They process personal information on our behalf under a data processing agreement (Art. 28 GDPR), unless stated otherwise:

  • Google Firebase (Google Ireland Limited and Google LLC, USA): sign-in (an automatic anonymous account when you first open the App), database (Cloud Firestore) for your partner profile, notes, reminders, AI chats and settings, storage of partner photos (Cloud Storage), server functions (Cloud Functions, region USA, us-central1) and server logs. Data: an account ID, everything you enter in the App, your partner photo, technical logs.
  • OpenAI (OpenAI, USA; processing in the USA): generates AI chat answers, compliments, date ideas and note suggestions from the text you enter and the notes you have saved about your partner (see Section 7).
  • Sentry (Functional Software, Inc., USA): crash and error reports and App performance data, such as device model, operating system, app version, error details and the screens and steps in the App before an error. We do not send your notes to Sentry on purpose.
  • RevenueCat (RevenueCat, Inc., USA): manages your subscription status. RevenueCat receives your anonymous App user ID, purchase receipts and purchase information from Apple or Google, device type and country.
  • Apple and Google (app stores and payment processors): distribute the App and process your purchases as independent controllers under their own privacy policies.
  • Cloudflare (Cloudflare, Inc., USA): hosting, delivery and protection of our website (see Section 6), and routing of emails sent to our @heartnotesapp.com address.
  • Apple iCloud Mail (Apple Distribution International Ltd., Ireland / Apple Inc., USA): emails you send us are forwarded to and stored in our iCloud mailbox.
  • Professional advisers and authorities: where required by law, or to establish, exercise or defend legal claims.
  • Business transfers: in the event of a merger, sale of company assets, financing or acquisition, to buyers or investors, subject to confidentiality safeguards and only to the extent permitted by law.

We do not sell your personal information and we do not share it with advertising networks.

5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?

In Short: We are not responsible for the safety of any information that you share with third parties that we may link to, but are not affiliated with, our Services.

The Services may link to third-party websites, online services, or mobile applications. We cannot guarantee the safety and privacy of data you provide to any third parties. Any data collected by third parties is not covered by this Privacy Notice. We are not responsible for the content or privacy and security practices and policies of any third parties. You should review the policies of such third parties and contact them directly with any questions.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: Our website sets only one cookie, which stores your cookie choice. We do not use analytics, advertising or tracking tools on the website or in the App.

Website. Our website (heartnotesapp.com) does not use analytics, advertising or tracking cookies. It is hosted and delivered by Cloudflare, Inc. (USA). When you open a page, Cloudflare processes your IP address, the date and time, the requested page, browser and operating system, to deliver the page and protect it against attacks (legitimate interest, Art. 6(1)(f) GDPR). Cloudflare may also collect network error reports, and it deletes these logs after a short period. We set only one cookie, "heartnotes_cookie_consent", which stores your choice in the cookie banner for 12 months; it is strictly necessary (§ 25(2) No. 2 TDDDG). If you delete this cookie in your browser, the banner appears again. Fonts are loaded from our own server; no connection to third-party font providers is made.

App. In the App we use Sentry to detect crashes and errors. When the App crashes or an error occurs, Sentry receives technical data such as device model, operating system, app version, error details and the screens and steps in the App before the error. For about one in five App sessions, Sentry also receives performance data, such as how long screens and network requests take. We do this to provide a working App (§ 25(2) No. 2 TDDDG) and based on our legitimate interest in finding and fixing errors (Art. 6(1)(f) GDPR). The App contains no analytics or advertising SDK. We do not use advertising identifiers and do not track you across other apps or websites.

7. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: Yes. HeartNotes includes AI features powered by OpenAI that use your requests and saved notes.

HeartNotes includes AI features: the AI coach chat, compliment suggestions, date ideas and automatic note suggestions that turn what you type into a saved fact. These features are powered by OpenAI (model GPT-4o mini). When you use these features, we send your request together with your partner's name and the notes you have saved about your partner (for the AI coach, all saved notes; for compliments and date ideas, the relevant ones; for note suggestions, your existing notes) through our server functions in the USA to OpenAI (processing in the USA), which generates the answer. OpenAI processes this data on our behalf and, under its API terms, does not use it to train its models. OpenAI may keep API data for up to 30 days to detect abuse, then deletes it. We do not send photos to AI providers. We store your AI chat history in your account so you can continue the conversation (see Section 9). Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

AI answers are generated automatically, may be inaccurate, and are not relationship, medical or psychological advice. If you do not want your notes sent to OpenAI, do not use the AI features; all other features work without them.

8. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: Some of our providers process your information in the USA, under recognized safeguards.

Some of our providers are based in the USA or process data there: Google (Firebase, including our server functions, which run in the USA, region us-central1), OpenAI, Sentry, RevenueCat, Cloudflare and Apple. For providers certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). For any provider not certified, we use the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards at [email protected].

9. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as your account exists or as stated below, unless the law requires us to keep it longer.

We keep your account data, partner profile, notes, facts, photo, reminders and AI chats for as long as your account exists. When you choose "Delete all data" in the App's Settings, the App clears your data on your device straight away and marks your data as deleted in our database. The marked data, and your partner photo in our cloud storage, stay in our systems until you ask us to erase them permanently. To have them erased, email us at [email protected] and we will erase them.

  • Account, partner profile, notes, photo, reminders and AI chats: until you delete them in the App or ask us to erase them (see above).
  • Server logs (Google Cloud Logging): 30 days. These logs can contain the text of your compliment request and the AI answer.
  • Crash, error and performance reports (Sentry): at most 90 days.
  • AI requests at OpenAI: up to 30 days (see Section 7).
  • Support emails: for as long as needed to answer your request and handle follow-up questions; emails that are business records are kept for the statutory periods below.
  • Cookie choice on our website: 12 months.
  • Purchase records: kept by Apple, Google and RevenueCat under their own policies. Where we hold our own invoice, transaction or payout records, we keep them for the statutory periods under German tax and commercial law (6 or 10 years, § 147 AO, § 257 HGB); these records do not contain your notes.

10. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. You should only access the Services within a secure environment.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your location, you have rights that allow you greater access to and control over your personal information.

If you are located in the EEA or UK, you have the following rights under applicable data protection law: the right to request access to and a copy of your personal information (Art. 15 GDPR); to request rectification (Art. 16) or erasure (Art. 17); to restrict processing (Art. 18); to data portability (Art. 20); and to object to processing (Art. 21). Where we process your information based on consent, you have the right to withdraw your consent at any time (Art. 7(3)); withdrawal does not affect the lawfulness of processing before the withdrawal.

Right to object (Art. 21 GDPR). Where we process your information based on our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We will then stop the processing unless we can show compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims. To object, email [email protected].

No automated decisions. We do not make decisions about you that are based solely on automated processing and have legal or similarly significant effects (Art. 22 GDPR). AI features in the App only produce suggestions for you.

Required data. You are not required by law to provide any personal information. The data described in this notice is needed to use the App; without it, the App or some features, such as saving notes, syncing or a subscription, will not work.

Right to complain. You also have the right to lodge a complaint with a data protection supervisory authority. Our competent authority is Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg) (website: lda.brandenburg.de). You may also contact the supervisory authority in your country of habitual residence.

To exercise any of these rights, use the options in the App or contact us at [email protected]. We may need to verify your identity before responding to a request.

12. DO WE COLLECT INFORMATION FROM CHILDREN?

HeartNotes is not directed at children. You must be at least 16 years old to use the App. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has given us personal information, please contact us at [email protected] and we will delete it.

13. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") or Global Privacy Control ("GPC") setting you can activate to signal that you do not want your online activity tracked. Our website and App do not track you for advertising and do not sell or share your personal information, so there is no such tracking for these signals to switch off. We treat a GPC signal as a valid request to opt out of the sale or sharing of your personal information.

14. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of certain US states, you may have additional rights regarding your personal information.

If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia, Texas or Oregon), you may have the right to know what personal information we collect, to access and receive a copy of it, to correct it, to delete it, and to opt out of its sale, sharing for cross-context behavioral advertising, targeted advertising, or profiling. We do not sell your personal information and we do not share it for cross-context behavioral advertising or targeted advertising. In the past 12 months we collected these categories: identifiers (an anonymous user ID; your email address only if you write to us); customer records (subscription status); internet or device activity (crash and performance data); audio, visual or similar information (a partner photo, if you add one); and other information you enter (notes, AI chats). Sensitive personal information we may hold (any health details you choose to write) is used only to provide the App, not to infer characteristics about you. We do not engage in profiling that has legal or similarly significant effects. We keep each category for the periods in Section 9. To make a request, email [email protected]. We will verify your request by asking you for details that link you to your App data, such as information shown in the App. You may use an authorized agent. If we decline your request, you may appeal by replying to our decision with the subject "Appeal"; we will answer within 45 days, and in any case within the time your state's law requires. We will not discriminate against you for exercising your rights. We do not knowingly sell or share personal information of consumers under 16.

15. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we update this notice when our processing or the law changes.

We may update this Privacy Notice from time to time. The updated version is indicated by an updated "Last updated" date and is effective as soon as it is published on this page.

16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at [email protected] or contact us by post at:

Dumke Ventures UG (haftungsbeschränkt)
Ebersprung 2
16321 Bernau
Germany

Managing Director (Geschäftsführer): Tom Dumke. Our full legal notice is available in our Impressum.

17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. These rights may be limited in some circumstances by applicable law. You can view and edit your notes and partner details in the App at any time. "Delete all data" in the App's Settings removes your data from the App and marks it as deleted in our database (see Section 9). To review your data, or to have it permanently erased from our systems, email us at [email protected].