Privacy Policy
Last updated: September 2026
1. Data Controller
ELFA UG (haftungsbeschraenkt) Pullach im Isartal Germany Managing Director: Elisabeth Fasbender Email: kontakt@getvq1.com
2. Hosting
This website is hosted on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The application and user data (account, horse profile and analysis data) is stored and processed exclusively in German data centers. Hetzner is ISO 27001 certified. For certain external services (e.g. payment processing and email delivery), a transfer to a third country — in particular the USA — may occur; such transfers are protected by appropriate safeguards (for details see the section “Data Transfers to Third Countries (USA)”).
3. Data Collected
We collect and process the following data: account data (name, email address and phone/WhatsApp number) during registration — the phone/WhatsApp number is mandatory; without it the questionnaire cannot be submitted, usage data (access times, pages visited) in anonymized form, horse profile data and blood values as part of the VQ1 service. Processing is based on Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(a) GDPR (consent). We measure anonymously how our pages are used in order to improve them — this data never leaves our infrastructure.
Horse profile, history and photos
The core of our service is the nutrient requirement analysis for your horse. For this we process the information from the horse profile and the history questionnaire (including breed, age, weight/body condition, husbandry, use, daily ration, hay and feed details and, where applicable, pre-existing conditions), uploaded photos (for example of the horse or of feed labels) and, where applicable, hay or blood values. The legal basis for the analysis you have commissioned is Art. 6(1)(b) GDPR (contract). Automatic evaluation of photos: currently NOT in operation. Your photos are stored and looked at by us, but they are not evaluated automatically and are not transferred to third parties. We ask for your consent to such an evaluation in advance at two points (as a separate option, not a combined tick box), so that the feature can later be used without asking you again. For as long as it is not in operation, nothing is derived from your consent: no automatic image evaluation takes place, and no photos are transferred to a third country. Should that change, this statement will be amended beforehand and you will be informed. Your consent can be withdrawn at any time with effect for the future. No automated decision within the meaning of Art. 22 GDPR producing legal effects concerning you takes place: the nutrient evaluation follows a fixed, rule-based procedure.
4. Retention Period
We store personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations. Incomplete questionnaire drafts (e.g. an abandoned requirement check or in-depth analysis) that are not yet linked to an account are automatically deleted after 30 days without further activity. After a contract is concluded, the retention period is governed by contractual and statutory requirements. Anonymised usage measurement data is deleted after 12 months.
5. Cookies
We use only technically necessary cookies and comparable storage mechanisms. No tracking, advertising or analytics cookies are used; a cookie consent banner is therefore not required. Cookies: • Login session — keeps you signed in during your visit. • CSRF protection — protects forms against cross-site requests. • “NEXT_LOCALE” — stores your choice of language. • “vq1_drossel” — a random identifier with no link to your person. We use it to count how often questionnaires are started or submitted from one device, and to slow down large-scale automated requests (protection against misuse and overload). In your browser’s local storage (localStorage): • Your display setting (light/dark). • A resume identifier for a questionnaire you have begun (requirement check or full analysis), so that you can continue later at the same point. Important: your answers themselves — in particular details of illnesses, symptoms or medication — are NOT stored in your browser, but exclusively on our server in Germany. Only the identifier of the draft is held in the browser. • Your choice in the privacy notice, so that the notice does not reappear on every visit. • A “do not show again” marker for individual prompts (such as the note about a matching product or the request for a review). The entries in local storage do not leave your device. You can delete them at any time via your browser’s settings; a questionnaire you have begun can then no longer be resumed automatically.
6. Third-Party Services
Fonts are self-hosted (via @fontsource) -- no requests are made to Google Fonts or other external font CDNs. No US-based analytics or tracking services (Google Analytics, Facebook Pixel, etc.) are used. Payment processing is handled by Stripe (EU-U.S. Data Privacy Framework certified). Transactional emails (e.g. confirmations, notifications) are delivered via Mailjet SAS (4 rue Jules Lefebvre, 75009 Paris, France; part of the Sinch group), which provides its services within the EU. A data processing agreement pursuant to Art. 28 GDPR is in place with Mailjet. Payment processing via Stripe may likewise involve a data transfer to the USA (protected via the EU-U.S. Data Privacy Framework). If you choose to sign in with a Google account, you are redirected to Google (Google Ireland Limited, Ireland) to sign in; in doing so Google learns that you are signing in to our service, and transmits your email address and your name to us so that the account can be created. This sign-in method is voluntary — you can register with an email address and password instead, in which case no connection to Google takes place. Google processes the sign-in data under its own responsibility; a transfer to the USA cannot be ruled out (EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses). Uploaded files (e.g. horse photos, lab PDFs) are stored in a self-operated object storage (MinIO) running on the same Hetzner server in Germany -- no transfer to external storage providers takes place.
Processors and Recipients
We use carefully selected service providers who process personal data on our behalf (data processing agreements under Art. 28 GDPR): • Hetzner Online GmbH — hosting/servers for all application data (Germany/EU; no third-country transfer). • MinIO on our own infrastructure at Hetzner — file storage (photos, PDF documents) (Germany/EU). • Stripe — payment processing (EU entity/USA; DPF and/or standard contractual clauses). • Mailjet (Sinch) — sending transactional and notification emails (EU, Paris). • Netlify (Netlify, Inc., USA) — delivery of the brand website geteq1.com. Anyone visiting that address transmits their IP address to the USA (DPF and/or standard contractual clauses). • Google Ireland Limited — signing in with a Google account, only if you choose that route (processing under Google’s own responsibility, see the section “Third-Party Services”). • WhatsApp (Meta) — planned from 08/2026, notifications not yet in use; the number is already collected as a mandatory field (USA/EU).
Data Transfers to Third Countries (USA)
Some of the recipients named above process data in the USA (Stripe, Netlify and, where applicable, Google when signing in with a Google account, and WhatsApp). The USA is regarded as a third country without a generally equivalent level of data protection. The transfer is based on the adequacy decision for the EU-US Data Privacy Framework (DPF), where the recipient is certified, and/or on the standard contractual clauses (SCC) under Art. 46 GDPR together with supplementary safeguards. Despite these guarantees, a residual risk of access by US authorities cannot be entirely ruled out. Photos are not currently transferred to a third country (see the section on horse profile, history and photos).
Use of data for research purposes
Purpose. We want to help improve the understanding of equine health. The work is carried out in two places: within VQ1 by our own team, and at universities and scientific research institutions, for example for doctoral theses and scientific studies. The legal basis is solely your separate, explicit consent (Art. 6(1)(a) GDPR). You give it independently of concluding the contract, as its own opt-in and not as a bundled checkbox. Without that consent, no research use takes place. Consent is not a condition for using our services (Art. 7(4) GDPR); your analysis and all other services run independently of it and at the same quality. Which data. The details about your horse and its care (such as breed, age, weight and body condition, housing, use, ration and analysis results). Your contact details — name, e-mail address, phone/WhatsApp number and postal address — are not included. Recipients. Two categories: (1) VQ1 itself and (2) universities and scientific research institutions to whom the data is made available for a specific project. Any disclosure is made exclusively in pseudonymised form and without your contact details. Pseudonymised, not anonymous. Before any research use, the data is separated from your contact details and held under an identifier instead of your name. Deliberately not fully anonymised: only this way can your data still be found if you withdraw your consent. Withdrawal. You may withdraw your consent at any time and without giving reasons, with effect for the future, most easily in your account under “My data & privacy”. This does not affect the lawfulness of use up to that point; scientific analyses already published cannot be retracted. For storage periods, the section “Retention Period” applies.
7. Your Rights
You have the right to: access your stored data (Art. 15 GDPR), rectification of inaccurate data (Art. 16 GDPR), deletion of your data (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), objection to processing (Art. 21 GDPR). To exercise your rights, please contact kontakt@getvq1.com.
8. Contact for Data Protection Inquiries
For questions about data protection, please reach us at kontakt@getvq1.com. You also have the right to lodge a complaint with a data protection supervisory authority.
Note: This privacy policy is a draft and must be reviewed by a lawyer before going live.