herp

Privacy policy

Controller

Johannes Hoffmann
Zur Schönhalde 1
89352 Ellzee
Germany
Email: hello@herp.app

A data protection officer is not required and not appointed.

In short

  • The website has no tracking, no analytics tools and no advertising.
  • Fonts and icons come from our own server; nothing is loaded from third parties.
  • The company name you type at the top of the start page is handled only by your browser. It is not sent anywhere and not stored.
  • We only set cookies in the customer area, and only those the login technically needs.

Hosting and server logs

The website and herp Cloud run on a server at Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany, in its data centre in Nuremberg. A data processing agreement under Art. 28 GDPR is in place with the host.

When you open a page, the server processes the technically necessary data: IP address, time, requested address, status code, amount of data and browser identifier. The web server in front (Traefik) stores this access data in log files to detect errors and attacks, and deletes them automatically after 7 days. Our own services do not write IP addresses into their logs. The legal basis is our legitimate interest in a secure and stable operation (Art. 6 (1) (f) GDPR).

Contact

When you write to us through the contact form, our server sends your name, your company, your email address, your message and the language of the page as an email to our mailbox hello@herp.app; it is sent through IONOS (see Sending emails). The server itself does not store the message. So that the form cannot be misused, the server briefly counts in memory how many messages come from one IP address and one email address. If you write to us by email directly, the message lands in the same mailbox. We process your details to answer your request (Art. 6 (1) (b) GDPR for requests about a contract, otherwise (f)) and delete them when they are no longer needed for that and no retention duty applies.

Customer area and herp Cloud

For the customer area we process the data that the account and the service need (Art. 6 (1) (b) GDPR):

  • Login: your email address, your language and the time of your last login. You log in with a link and a code in an email; an open login expires after 15 minutes.
  • Account and team: the account name, the members with their roles, and invitations with the invited email address. An invitation expires after 7 days.
  • Instances: address, name, herp version, time of the last connection and the number of active users of an instance, which billing needs.
  • API clients: name and key ID. We store the secret part of a key only as a hash that cannot be reversed.
  • Usage: requests and amounts of data per instance and day as the basis for billing.
  • Log of changes: changes to the account, its instances and its team with the time and the person who made them, for traceability and security (Art. 6 (1) (f) GDPR).

Requests to your own herp instance pass through herp Cloud. Their content is only passed on and not stored. For each request we log the instance, key ID, path, status, duration and size, without IP address and without content.

At login we use your IP address only briefly in memory to limit too many login attempts. It is not stored.

We keep your account data as long as your account exists. After that we delete it, unless a legal retention duty applies, for example for invoices.

Cookies in the customer area

In the customer area we only set cookies that the service technically needs (Section 25 (2) TDDDG, Art. 6 (1) (b) GDPR). No consent is needed for them.

  • herp_access: keeps you logged in, 15 minutes.
  • herp_refresh: renews your login, 30 days from the last use.
  • herp_login: ties a running login to this browser until it is finished, at most 15 minutes.
  • herp_return: remembers for an invitation where to go after the login, until the login, at most 1 hour.
  • herp_account: remembers the account you chose last, 1 year.

Sending emails

We send login and invitation emails and the messages of the contact form through IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Your email address and the content of the mail are processed for that. A data processing agreement under Art. 28 GDPR is in place with the provider.

Links to GitHub

The website links to the source code on GitHub (GitHub, Inc., USA). Only when you follow such a link does GitHub's privacy policy apply.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to hello@herp.app for this.

You can also complain to a data protection supervisory authority, for example the one responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

The German version of this privacy policy is the binding one.

Last updated: 2026-11