Privacy Policy

1. Controller

The controller for data processing under the General Data Protection Regulation (GDPR) is Global Solutions Systems GmbH, Bessemerstraße 51, 1. OG, 12103 Berlin, Germany, e-mail: info@global-solutions-systems.com.

2. This website

This section concerns visiting avantido.app only. Processing inside the app is described from section 3 onwards.

When you open a page, your browser transmits technically necessary data to the web server, which stores it in access logs: IP address, date and time of the request, the address requested, the previously visited page (referrer) and the browser and operating system identification (user agent).

The purpose of this processing is delivering the page, analysing faults, detecting attacks and preventing abusive access. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in operating the website securely and without disruption.

The logs are deleted after 30 days. That period is necessary because patterns of attack and abuse - distributed access attempts or recurring anomalies, for instance - often only become visible over several weeks, and fault analysis has to remain possible when a problem is reported late. A shorter period would put those purposes at risk; a longer one would not be necessary for them.

The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; the data centre is located in Nuremberg, Germany. Hetzner processes the data as a processor under a contract pursuant to Art. 28 GDPR and solely on our instructions.

This website sets no cookies. There is no audience measurement, no analytics and no tracking. No external fonts, no content delivery networks and no third-party services are embedded; the typeface used is served from our own server. There are no contact or comment forms through which you would send us data.

3. Principle: your data stays with you

Avantido is a to-do app. It works without a user account and without a server of our own. We operate no database and never receive your tasks, notes, voice recordings or photos. The app contains no ads, no tracking and no third-party analytics.

Your data is stored on your device and - if you use iCloud - synced within your private iCloud. Individual features (speech recognition, AI analysis, reminders and calendar, purchases) involve external services; these are described individually below.

4. Data processed by the app in detail

4.1 Data stored locally

Tasks (title, note, priority, due date, recurrence, completion state), categories with their actions and any captured or selected photos are stored locally on your device (Apple SwiftData). They leave your device only in the cases listed below.

4.2 iCloud sync (Apple CloudKit)

If you are signed in to iCloud and iCloud is enabled for Avantido, your app data is backed up through Apple CloudKit in your private iCloud database and synced between your devices. This data resides in your Apple account; we have no access to it. Apple is the controller for iCloud. You can disable syncing at any time in iOS Settings. Legal basis: Art. 6(1)(b) GDPR.

4.3 Voice input (Avantido Pro, optional)

When you dictate a task, the app records audio through your device's microphone and converts it to text using Apple's speech recognition. Apple may transmit the audio to its servers for processing; whether recognition happens on device or server-side is decided by iOS depending on language, device and availability. Apple is the controller for that processing. Recording only runs while you actively start it; we receive neither audio nor transcript. Only the recognised text is used further; the audio recording is not stored. Legal basis: Art. 6(1)(a) GDPR (consent via the iOS permissions, revocable at any time).

4.4 Photo capture (Avantido Pro, optional)

You can take a photo with the camera or pick one from your photo library to derive tasks from it. The image stays on your device unless you use the AI analysis. Camera and photo access happen only after you grant the corresponding iOS permission.

4.5 AI analysis with your own key (Avantido Pro, optional)

For automatic analysis of text or photos you provide your own API key for an AI provider of your choice. Only if a key is configured and the feature is actively used does the app transmit the relevant task text or photo directly from your device to the chosen provider: Google Gemini, OpenAI or Anthropic Claude.

The transfer uses your own account; we are not involved and receive neither text nor images. The respective provider's privacy terms apply. Without a configured key no such transfer takes place. Your API key is stored exclusively in the iOS Keychain on your device and is never transmitted to us. Legal basis: Art. 6(1)(a) and (b) GDPR. These providers process data in the USA among other places (third-country transfer).

4.6 Reminders and Calendar (optional)

On request Avantido writes a task into Apple's Reminders app and/or as an event into your calendar. Title, note and due date are written into the respective Apple app, that is, into your local or iCloud data. Nothing is transmitted to us.

4.7 Notifications

Reminders for due tasks are scheduled as local notifications directly on your device. There is no push server on our side and no device token is transmitted to us.

4.8 Siri and Shortcuts (optional)

Avantido provides shortcuts. Siri's voice processing is handled by Apple; the app only receives the result and continues locally.

4.9 Widget

For the home and lock screen widget the app stores a reduced copy of today's due tasks in a shared on-device container. This data does not leave the device.

4.10 Purchases (Avantido Pro)

The Pro purchase is handled via the App Store. Apple processes payment and purchase data; we only receive aggregated sales information from Apple, no payment data.

5. Recipients and third-country transfer

Personal data may - only when you actively use the respective feature - reach the following recipients: Apple (iCloud, speech recognition, Siri, purchases) and the AI provider you choose (Google, OpenAI or Anthropic). When you visit the website, the host Hetzner Online GmbH is added as a processor, with its data centre in Germany. Some of the named providers process data in the USA; their respective transfer safeguards apply, such as EU Standard Contractual Clauses or the Data Privacy Framework.

6. Retention and deletion

Access logs of the website are deleted after 30 days. Local app data remains stored until you delete individual entries or the app. Deleting the app removes the local data; data backed up in iCloud is managed through your iCloud settings. You can remove a stored API key in the app's settings.

7. Your rights

Under the GDPR you have the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21); you may withdraw consent at any time. As we store no personal data of yours beyond the access logs, these rights primarily concern the data on your device and in your iCloud, which you manage yourself. You can reach us at the e-mail address above. You also have the right to lodge a complaint with a data protection supervisory authority.

8. Children

App and website are not directed at children and do not knowingly collect data from children.

9. Changes

We update this privacy policy when features or legal requirements change. The version published here is the one that applies.