Privacy Policy

Review status: Provider details have been aligned with the current AGNO implementation. A qualified data protection professional should review this policy before public launch.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Jonathan Sternberg, trading as Sternberg Consulting
Hohe Str. 3
08491 Netzschkau, Germany
Email: privacy@agnocheck.com
Data Protection Officer: no data protection officer has been appointed

2. What AGNO does — and why that matters for data

AGNO is a platform that documents cleaning work: cleaning plans, who executed them, photo evidence, approvals, customer reviews and complaints. This means personal data of three groups is processed:

Business customers (account holders, administrators, approvers),
their employees and field staff (field identities executing cleaning work), and
their customers’ contacts (reviewers who approve or complain via secure links).

3. Roles: controller and processor

3.1 For account and billing data of our direct customers, we are the controller.

3.2 For content data — cleaning plans, evidence records, photos, employee names and PINs, customer reviewer inputs — the respective customer (typically the cleaning company) is the controller and we act as processor under Art. 28 GDPR. We conclude a Data Processing Agreement (DPA/AVV) with business customers on request.

3.3 If you are an employee or customer of a company using AGNO, please contact that company first to exercise your data subject rights; we support them in fulfilling your request.

4. Data categories, purposes and legal bases

4.1 Website visitors (marketing site)

Server logs (IP address, timestamp, requested page, browser): delivery and security of the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). Logs are retained only as long as necessary for delivery, security investigation and applicable legal obligations.
Cookies: the marketing site uses only strictly necessary cookies. No advertising, tracking or analytics cookies are set.

4.2 Account and contract data (business customers)

Name, business email, company, role, password (hashed), plan, billing address, VAT ID.
Purpose: contract performance, account administration, support, billing. Legal basis: Art. 6(1)(b) GDPR; tax retention: Art. 6(1)(c) GDPR.

4.3 Content data processed on behalf of customers

Field identity data: name/identifier of field staff, personal PIN (stored hashed), team and object assignments.
Execution and evidence data: plan revision, start/end times, checklist answers, photos (which may incidentally show persons), notes, approval decisions and history.
Customer reviewer data: name or label of the reviewer, review decision, notes, complaint text and complaint photos, access tokens.
Purpose: providing the contracted documentation service. Legal basis for our processing: Art. 6(1)(b) GDPR with the customer; toward data subjects, the customer is responsible (see Section 3).

4.4 Payment data

Payments are processed by Paddle.com Market Ltd. (merchant of record). Paddle processes payment data (card details, billing address, transaction data) under its own privacy policy; we receive only transaction confirmations and invoice-relevant data. Legal basis: Art. 6(1)(b) GDPR. See Paddle’s privacy policy.

4.5 Support and communication

If you contact us (email, support), we process your message and contact details to handle the request. Legal basis: Art. 6(1)(b) or (f) GDPR. We retain support communications only as long as necessary to resolve the request, document the business relationship, or meet legal obligations.

5. Hosting, recipients and subprocessors

We use the following recipients and service providers to operate AGNO:

Application delivery and storage: Cloudflare (Workers, D1 and R2)
Account authentication: WorkOS AuthKit
Payment processing: Paddle.com Market Ltd. (UK; transfers based on adequacy decision / SCCs as applicable)

Where a subprocessor is located outside the EU/EEA, we ensure an adequate level of protection via adequacy decisions or standard contractual clauses (Art. 44 et seq. GDPR).

6. Retention

Workspace and evidence data: for the duration of the contract; export possible at any time on paid plans.
After termination: deletion after 30 days, unless statutory retention applies (e.g. tax-relevant billing data: 6–10 years under §§ 147 AO, 257 HGB).
Audit trail records are retained for the lifetime of the associated evidence record to preserve proof integrity.

7. Security

We apply technical and organizational measures under Art. 32 GDPR, including: encrypted transport (TLS), encryption at rest, hashed credentials and PINs, tenant isolation, role-based access, audit logging of workspace actions, and regular backups. Temporary customer-authorized support access is itself recorded in the audit trail.

8. Your rights

Under the GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and withdrawal of consent where processing is based on consent (Art. 7(3)). To exercise your rights, contact privacy@agnocheck.com.

You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence or place of work. The authority responsible for us is the Sächsische Datenschutz- und Transparenzbeauftragte, Maternistraße 17, 01067 Dresden, Germany.

9. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Alerts (e.g. overdue tasks) are rule-based notifications, not decisions about persons.

10. Changes to this policy

We may update this policy to reflect legal or functional changes. The current version is always available on this page; material changes are communicated to registered customers by email.