Privacy policy

Concrete Human Collaborate, Hauptstraße 50, 83684 Tegernsee, Germany, is the controller for the processing described here. Write to partner@concretehuman.com with any question about your data, including the requests listed under Your rights.

Our hosting provider writes a log entry for every request: browser type and version, operating system, the page you came from, the hostname of the requesting computer and the time. We use it to keep the site running and to find faults. It is not combined with anything else and it is not used to build a profile.

You can sign in with an email address. There is no password. You type your address, we send a one-time code to it, and entering that code creates a session. We store the address, the name you give yourself if you give one, and the times the account was created and last used.

Codes are delivered by Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA. Your address goes to them for that, and for the messages about a series you have sent in: whether we selected it, and what follows from that. Those messages carry the title of the series and the decision. Nothing else goes to them. The legal basis is the contract you enter into by using the account, Art. 6 Abs. 1 lit. b GDPR.

Ask us at partner@concretehuman.com and we delete the account and everything attached to it.

When you send in a series we keep the files you uploaded and what you wrote about them: the title of the series and its text, and for each photograph its title, its description, the country it was taken in and the year. We also record the date and time you ticked each of the boxes on the form, because those answer a later question about what you agreed to and on what day.

Each photograph is kept twice. The file you uploaded stays exactly as you sent it, and only you and the operator can fetch it; it is there so the work can be checked and printed. From it we make a second copy, and that is the one shown on the site. Before it is shown we take the location data out of it, along with the camera serial number and the name of the registered owner. The photographer and the copyright line stay in, because they carry the credit.

The file you uploaded keeps everything your camera wrote into it, including the exact position where the photograph was taken. That file is never published.

A photograph may show people who can be recognised. By sending it you assure us that they agreed and that you can show it on request; the terms of participation set that out. If you appear in a photograph on this site and want it taken down, write to partner@concretehuman.com and we take it down.

A draft you delete goes, and the files with it. A series we do not select stays until you delete it, or until you close the account. You decide whether it shows on your profile page, and you can change that at any time. A series that is selected stays online until you withdraw the right in writing.

The legal basis is the contract you enter into by taking part, Art. 6 Abs. 1 lit. b GDPR.

If you give yourself a profile address, the page at that address is public and anybody can read it. What it shows is what you filled in on your account page: your name, a portrait if you upload one, your year and place of birth, your nationality, where you are based, and your biography. None of it is required, and you can empty any of it. The portrait goes through the same treatment as a submitted photograph, so the location data is taken out of it before it is shown.

One cookie, and only after you sign in: it holds your session so the site knows it is still you on the next page. It is essential to the function you asked for, so it needs no consent banner and cannot be switched off separately. Signing out removes it. There is no tracking cookie, no advertising cookie and no third-party cookie on this site.

Accounts are stored in a Postgres database run by Neon, Inc., 209 Orange Street, Wilmington, DE 19801, USA, on servers in Frankfurt am Main. The site itself is served by Vercel, Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, which may process request data outside the EU. Both are engaged as processors under Art. 28 GDPR, and transfers to the United States run on the European Commission's standard contractual clauses.

Photographs are kept in a private file store run by the same company, on servers in Frankfurt am Main. The store is private: a file has no address anybody can reach without going through this site, and the site decides for each request who may see it.

If you send us an email we keep your address and what you wrote for as long as it takes to answer you and to deal with anything that follows from it. We do not pass it on. When it is no longer needed it goes, unless a retention period in tax or commercial law says otherwise.

Our updates are sent through Substack Inc., 548 Market St, PMB 72296, San Francisco, CA 94104, USA. Subscribing passes your address to Substack, which handles the confirmation email, the list and the delivery. Their privacy policy is at substack.com/privacy.

Every email carries an unsubscribe link, and you can also write to us and we will take you off.

You can ask what we hold about you, have it corrected, have it deleted, have its use restricted, receive it in a portable form and object to processing. You can also complain to a supervisory authority; for us that is the Bayerisches Landesamt für Datenschutzaufsicht in Ansbach.

We update this policy when what we do changes or when the law does. The current version is always the one on this page.