Privacy Policy

Last updated: 12 November 2026

This policy explains how schnaitl.tech Identity, the sign-in service at auth.schnaitl.tech for the applications listed on the schnaitl.tech Identity page, handles personal data.

Controller

Schnaitl IT Solutions, Raphael Schnaitl
Enzianstr. 23B, 83395 Freilassing, Germany
impressum@schnaitl.tech

Further details are in the Impressum.

Data we receive from Google

When you sign in with Google, we request the openid, email and profile scopes. From the information Google returns we store:

• your Google account identifier
• your email address and whether Google has verified it
• your full name, given name and family name

We do not store your profile picture, and we do not request access to Gmail, Google Drive, Contacts, Calendar or any other Google data.

How we use it

• to confirm your identity and check that your email address is on the allowlist of invited users
• to create your account and assign the groups that decide which services you may use
• to pass your name, email address and groups to the connected service you are signing in to, as a signed token

We do not use this data for advertising or profiling, we do not sell it, and we do not use it to train AI models.

Google API Services User Data Policy

schnaitl.tech Identity's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where the data is stored

Account data is stored in Amazon Cognito, operated by Amazon Web Services in the EU (Frankfurt, eu-central-1) region. Amazon Web Services processes it on our behalf under a data processing agreement. Google acts as the identity provider; its own privacy policy applies to your Google account.

Technical logs from the sign-in process are kept for at most 30 days and are used only to operate and secure the service.

Cookies

The sign-in pages set only the cookies needed to keep your sign-in session. They use no tracking or advertising cookies.

Legal basis

We process this data to provide the service you were invited to use (Art. 6(1)(b) GDPR) and, for technical logs, on the basis of our legitimate interest in running the service securely (Art. 6(1)(f) GDPR).

Retention

Your account data is kept while you have access to the connected services. It is deleted when your access ends or when you ask us to delete it. Content you create in a connected service, such as messages or notes, is handled by that service and is not part of this sign-in data.

Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability (Art. 15 to 21 GDPR). To use any of these rights, email impressum@schnaitl.tech. You can also remove schnaitl.tech Identity's access in your Google account settings.

You may lodge a complaint with a data protection supervisory authority, for example the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

Changes

We will publish any changes to this policy on this page and update the date at the top.