Privacy policy

1. Controller

Patrick Damm
Aachener Straße 638
50226 Frechen
Email: info@terramio.app

2. Overview of processing

Terramio is a community platform for keepers of insects and reptiles. When you use it, the following personal data is processed:

• Account data (email address, username, login data)
• Animal profiles you create, including photos and entries
• Terrariums you create, including photos and care entries
• Access data generated technically when the website is visited
• Reports of illegal content (reason and description, address of the reported content, contact details of the reporting person, history of the handling)
• Suggestions you submit for species and genera of the species database, together with your user ID and the time of submission

3. User accounts and sign-in

We use the Clerk service to register, sign in and manage user accounts. The provider is Clerk, Inc., 660 King Street, Unit 345, San Francisco, CA 94107, USA. The representative in the European Union is VeraSafe Ireland Ltd., Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork T23AT2P, Ireland.

This involves processing the account data you provide (email address, username, login data) as well as technically generated data such as IP address, device identifiers and usage data (browser used, operating system, referrer URL). Clerk stores this data mainly in data centers operated by Google Cloud and Cloudflare.

Clerk sets cookies that are technically necessary for signing in and for maintaining your session. Under § 25 Abs. 2 TDDDG, no consent is required for this.

The legal basis for the processing is Art. 6(1)(b) GDPR (performance of the user agreement). A data processing agreement pursuant to Art. 28 GDPR is in place with Clerk. The transfer to the USA is based on the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Clerk, Inc. is self-certified under this framework; the entry can be viewed at dataprivacyframework.gov. In addition, and in case Clerk cannot rely on the Data Privacy Framework, the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914, Modules 1 to 3) are deemed agreed (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards via the contact address given in the legal notice.

4. Database

The platform’s content (animal profiles, terrariums, entries, image information) is stored in a PostgreSQL database provided by Neon. The server is located in Frankfurt am Main, Germany. The legal basis is Art. 6(1)(b) GDPR. A data processing agreement is in place.

If you suggest a species or genus that does not yet exist in the species database, the entry is stored together with your user ID and the time of submission. Until the operator decides, the entry is visible only to you and the operator. If the entry is accepted or assigned to an existing species, the user ID and time are deleted; the entry itself remains part of the species database without any link to you. If it is not accepted, the user ID and time remain stored until the entry is removed. If you delete your account, the user ID is removed from suggestions that are still open.

The same database also holds operational records: reports of illegal content together with our decision on them, and a log of the emails Terramio sends. The log records which type of message was sent when and with what result; it contains no email address.

5. Hosting and server log files

This website is operated on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in Falkenstein, Germany.

When the website is visited, access data is automatically recorded in server log files (including IP address, time of access, page visited, amount of data transferred, browser used). This processing is necessary for the technical operation and security of the website.

The legal basis is Art. 6(1)(f) GDPR. A data processing agreement is in place.

6. Email and domain management

The domain and email mailbox are operated by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. If you contact us by email, the information you provide is processed to handle your request.

The legal basis is Art. 6(1)(f) GDPR, and for contract-related requests Art. 6(1)(b) GDPR.

Reports of illegal content. If you consider content on Terramio to be illegal or a violation of our Terms of Use, you can report it to us – via the form on the “Report content” page or, as before, by email to info@terramio.app.

Through the form, we process: your statement of where the content is located; the reason for your report and your description; your confirmation that your information is accurate to the best of your knowledge; and your name and email address, if you provide them. We need your name and address to confirm receipt and to inform you of our decision – we delete both as soon as we have informed you of the decision. For reports concerning certain serious criminal offenses, you may omit this information; in that case, however, we cannot inform you of anything.

To prevent individuals from flooding the reporting channel with mass reports, we store an irreversible check value of your IP address with each report. We do not store the address itself, and it cannot be recalculated from the check value. The value is deleted together with your contact details.

In doing so, we process your information about the reported content, your reasoning and the contact details you give us. The purpose is to review and handle your report. The legal basis is Art. 6(1)(c) GDPR in conjunction with Articles 16 to 18 of Regulation (EU) 2022/2065 on digital services: we are obliged to accept reports, to handle them and to inform you of our decision.

We usually handle your report within seven days. After a case is closed, we retain it so that we can demonstrate how we decided – six months if we took no action, and three years if we did. The legal basis for this retention is Art. 6(1)(f) GDPR; our legitimate interest is providing evidence to affected persons and to authorities. You can object to this retention under Art. 21 GDPR.

7. Decisions on reports and measures

Every report is decided by a human, not by an automated procedure. In doing so, we assign the report to the content concerned. We make this assignment ourselves; the location given by the reporting person is a pointer for us, not a determination. With the report, we store our decision, the time of the decision and a statement of reasons written by us. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 16 to 18 of Regulation (EU) 2022/2065 (Digital Services Act), and for retention after closure Art. 6(1)(f) GDPR.

If we consider a report to be justified, we may make the content concerned invisible to others, block a username or suspend an account temporarily or permanently. For a temporary account suspension, we additionally store the end date; for a block of content or a username, we store the time of the measure.

We inform the reporting person of the outcome, provided they have given contact details, as well as the person affected by a measure. We retrieve the affected person’s email address from our sign-in service at the moment of sending; we do not store it. For every message sent and every message suppressed, we keep a log line with the account ID, time, type of message and result. This log does not contain an email address in any form, not even shortened, encrypted or as a check value. We retain it for three years.

If a measure turns out to be unfounded, we reverse it and inform the affected person. The reversal restores the visibility state that the affected person had previously chosen themselves and is not a new intervention.

We retain our decisions, statements of reasons and times of measures for three years after the case is closed, in line with the retention period for reports on which a measure was taken. The legal basis is Art. 6(1)(f) GDPR.

8. Audience measurement

We use the open-source software Umami for the statistical analysis of usage. We operate Umami ourselves on our own server; no data is transferred to third parties.

Umami does not set cookies and does not create cross-device user profiles. It records page views, referring page, approximate region of origin, device type, screen resolution, browser and operating system. The IP address is not stored but is used only in the form of a non-reversible hash value to distinguish sessions; this value is generated anew every day.

The legal basis is our legitimate interest in a data-minimizing analysis of the reach of our service, Art. 6(1)(f) GDPR.

9. Publicly visible content

Animal profiles are publicly visible by default. You can set the visibility of each individual animal to private at any time in its settings. Terrariums, by contrast, are private by default. They only become publicly visible when you set the respective terrarium to public in its settings.

Please note: Animal profiles that have been made public are not only visible to signed-in members. They are freely accessible on the internet, listed in our sitemap for search engines and can therefore be captured by search engines such as Google and displayed in search results. This concerns the photos you have uploaded, the name of the animal, your username and the entries you have shared. The same applies to terrariums that have been made public: they can be reached via the Discover page, are listed in our sitemap and can appear in search results. This concerns the name of the tank, the photos of the tank including the photos from care entries, your username and the publicly visible animals in the tank.

If you set a previously public animal profile or terrarium to private, the corresponding page and its image files immediately stop being accessible. Access to an image file is tied to the visibility of the content it belongs to: a photo is never more visible to others than the animal profile or the terrarium itself, and you can also hide individual photos. Even someone who knows the direct address of an image file will then no longer receive it. However, content that has already been captured may remain in search engine caches for some time, which is beyond our control.

From the photos you upload, we automatically remove all embedded additional information, in particular GPS location data.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw any consent you have given at any time.

Deleting your account: You can delete your user account yourself at any time. After signing in, you can find this function via your profile picture at the top right under “Manage account” in the “Security” tab. This deletes your user account and all animal profiles, terrariums, entries and photos you have posted, including the stored image files. The deletion is triggered immediately and cannot be undone. A weekly backup of the image files may still contain deleted photos until the next backup; it cannot be accessed and is replaced with the next backup. Independently of this, you can delete individual animal profiles and terrariums one by one at any time. Alternatively, you can still contact info@terramio.app.

If you delete your account, reports of illegal content remain as evidence. We immediately remove the information in them that refers to you. For a report you submitted, this is your name, your contact details, your description and your location information. For a report directed against you, it is the reference to your account, as soon as we have assigned the report to a piece of content. What remains is the case number, time, reason, our decision and the delivery log.

You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.

11. Changes to this privacy policy

This privacy policy is updated as the platform evolves (e.g. new services, new features). The version published on this page applies in each case.

As of: 17 Sep 2026