Jeremias Meister - Tools & Pipeline

Privacy Policy

Last Updated: 03.08.2026

This Privacy Statement gives you an overview of the processing of your personal data in the context of the use of the website at https://www.cg-jm.com/ (the “Website“) and our desktop software “Project Succession” (the “Software”). This Privacy Statement also informs you about your rights and the possibilities to control your personal data and to protect your privacy. Responsible as a data controller for data processing on the Website is Jeremias Meister, Trautmannstr. 11, 81373 Munich, Germany. This person is also meant if the terms “we“ or “us“ are used in the following. You can contact Jeremias Meister with privacy related inquiries under contact@cg-jm.com.

1. Introduction

In the following, we provide information about the collection of personal data when using our website cg-jm.com and our profiles in social media. Personal data is any data that can be related to a specific natural person, such as their name or IP address.

1.1. Contact details

The controller within the meaning of Art. 4 para. 7 EU General Data Protection Regulation (GDPR) is Jeremias Meister Trautmannstr. 11 81373 Munich Germany, email: contact@cg-jm.com.

Project Succession is commercially released under a registered company, the data controller is: cg-jm Jeremias Meister (Einzelunternehmen), Trautmannstr. 11, 81373 Munich, represented by the Managing Director.

We are not legally required to appoint a Data Protection Officer pursuant to Art. 37 GDPR.

We detail the scope of data processing, processing purposes and legal bases below. In principle, the following come into consideration as the legal basis for data processing:

1.3. Data processing outside the EEA

Insofar as we transfer data to service providers or other third parties outside the EEA, the security of the data during the transfer is guaranteed by adequacy decisions of the EU Commission, insofar as they exist (e.g. for Great Britain, Canada and Israel) (Art. 45 para. 3 GDPR).

If no adequacy decision exists (e.g. for the USA), the legal basis for the data transfer are usually, i.e. unless we indicate otherwise, standard contractual clauses. These are a set of rules adopted by the EU Commission and are part of the contract with the respective third party. According to Art. 46 para. 2 lit. b GDPR, they ensure the security of the data transfer. Many of the providers have given contractual guarantees that go beyond the standard contractual clauses to protect the data. These include, for example, guarantees regarding the encryption of data or regarding an obligation on the part of the third party to notify data subjects if law enforcement agencies wish to access the respective data.

In addition, for transfers to service providers in third countries where no adequacy decision exists (e.g., the USA), we rely on the EU Standard Contractual Clauses (SCCs) according to Art. 46 para. 2 lit. c GDPR.

Despite these safeguards, we cannot guarantee that access by public authorities in the third country can be fully excluded. Data subjects may request copies of the relevant SCCs by contacting us.

1.4. Storage duration

Unless expressly stated in this privacy policy, the data stored by us will be deleted as soon as they are no longer required for their intended purpose and no legal obligations to retain data conflict with the deletion. If the data are not deleted because they are required for other and legally permissible purposes, their processing is restricted, i.e. the data are blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.

1.4.1 Specific Retention Periods

In addition to our general deletion policy, the following specific retention periods apply:

1.5. Rights of data subjects

Data subjects have the following rights against us with regard to their personal data:

Data subjects also have the right to complain to a data protection supervisory authority about the processing of their personal data. Contact details of the data protection supervisory authorities are available at https://www.bfdi.bund.de/EN/Service/Anschriften/Laender/Laender-node.html.

Where processing is based on consent (e.g., behavioral analytics within the Software, beta surveys), data subjects may revoke their consent at any time by contacting us at contact@cg-jm.com.

Revocation does not affect the lawfulness of processing carried out before the revocation.

1.6. Obligation to provide data

Within the scope of the business or other relationship, customers, prospective customers or third parties need to provide us with personal data that is necessary for the establishment, execution and termination of a business or other relationship or that we are legally obliged to collect. Without this data, we will generally have to refuse to conclude the contract or to provide a service or will no longer be able to perform an existing contract or other relationship.

Mandatory data are marked as such.

1.7. No automatic decision making

As a matter of principle, we do not use a fully automated decision-making process in accordance with article 22 GDPR to establish and implement the business or other relationship. Should we use these procedures in individual cases, we will inform of this separately if this is required by law.

1.8. Making contact

When contacting us, e.g. by e-mail or telephone, the data provided to us (e.g. names and e-mail addresses) will be stored by us in order to answer questions. The legal basis for the processing is our legitimate interest (Art. 6 para. 1 s. 1 lit. f GDPR) to answer inquiries directed to us. We delete the data accruing in this context after the storage is no longer necessary or restrict the processing if there are legal retention obligations.

1.9. Competitions

Occasionally, we offer competitions via our website or in other ways. We process the data requested in these competitions in order to determine and notify the winners. Afterwards, we delete the data. It may also be that we only offer competitions for existing customers. In this case, we only process the name to determine the winners and the contact data to notify the winners.

It is our legitimate interest to offer competitions to attract customers or to interact with our existing customers. The legal basis for data processing is Art. 6 para. 1 s. 1 lit. f GDPR.

1.10. Customer surveys

From time to time, we conduct customer surveys to get to know our customers and their wishes better. In doing so, we collect the data requested in each case. It is our legitimate interest to get to know our customers and their wishes better, so that the legal basis for the associated data processing is Art. 6 para. 1 s. 1 lit. f GDPR. We delete the data when the results of the surveys have been evaluated.

1.11 Data processing for the provision of our software products

For the purposes of creating an account and the subsequent use of our Project Succession software, we process the following personal data: Display name, email address, IP address. Art. 6(1)(b) GDPR (Performance of a Contract). We have a need in collecting this data in order to provide our software.

For the purposes of creating, offering to use, developing and improving our Project Succession software and to analyze user behavior and preferences, we also process the following personal data:

Behavior in the Project Succession Software

Interactions related to the user account created for Project Succession

(Additional) behavioral data on cg-jm.com that goes beyond the basic, pseudonymised web statistics described in section 3.1

The legal basis of the processing is Art. 6 para. 1 p. 1 lit. a GDPR. The processing is based on consent. Data subjects can revoke their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The revocation does not affect the lawfulness of the processing until the revocation.

1.12. Conducting surveys as part of our alpha/beta tests

Users are offered the opportunity to complete a survey about their use of the Project Succession. In doing so, the following personal data will be processed:

The legal basis of the processing is Art. 6 para. 1 p. 1 lit. a GDPR. The processing is based on consent. Data subjects can revoke their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The revocation does not affect the lawfulness of the processing until the revocation.

1.13. Children

Our services, including the Software and Website, are not intended for persons under 16 years of age.

We do not knowingly collect personal data from children. If we become aware that data of a person under 16 has been collected, we will delete this data immediately.

2. Newsletter

We reserve the right to inform customers who have already used services from us or purchased goods from time to time by email or other means electronically about our offers, if they have not objected to this. The legal basis for this data processing is Art. 6 para. 1 s. 1 lit. f GDPR. Our legitimate interest is to conduct direct advertising (recital 47 GDPR). Customers can object to the use of their email address for advertising purposes at any time without incurring additional costs, for example via the link at the end of each e-mail or by sending an e-mail to our above-mentioned e-mail address. Interested parties have the option to subscribe to a free newsletter. We process the data provided during registration exclusively for sending the newsletter. Subscription takes place by selecting the corresponding field on our website, by ticking the corresponding field in a paper document or by another clear action, whereby interested parties declare their consent to the processing of their data, so that the legal basis is Art. 6 para. 1 s. 1 lit. a GDPR. Consent can be revoked at any time, e.g. by clicking the corresponding link in the newsletter or notifying our e-mail address given above. The processing of the data until revocation remains lawful even in the event of revocation.

Based on the consent of the recipients (Art. 6 para. 1 s. 1 lit. a GDPR), we also measure the opening and click-through rate of our newsletters to understand what is relevant for our audience.

3. Data processing on our website and within the Software

For all non-essential cookies and external services requiring consent, we use a custom two-layer consent banner.

When visiting our Website for the first time, users are presented with a banner offering three choices of equal effort: “Accept all” (enables analytics and all external services listed below), “Decline” (no analytics, no external services), and “Settings”, where consent can be given separately per purpose: analytics (Google Analytics 4), live prices & checkout (Paddle), and embedded video (YouTube).

The choice — together with its date and the version of this banner — is stored locally in the browser (localStorage, see Section 3.3) and can be changed or withdrawn at any time through the “Cookie Settings” link in the website footer, with no more effort than giving consent. Withdrawing analytics consent also deletes the analytics cookies already set in your browser. Withdrawal takes effect immediately for analytics and from the next page load for external services that are already displayed. If we materially change this policy or the banner, previously stored consents are treated as expired and users are asked again.

No analytics data is collected and no external service is loaded unless the user actively consents. Declining does not affect the functionality of the Website.

Legal basis: Art. 6 para. 1 lit. a GDPR (Consent); § 25 (1) TDDDG.

3.1 Website Analytics (Google Analytics 4)

We use Google Analytics 4 (“GA4”), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). GA4 uses cookies to analyze how visitors interact with our Website.

GA4 is only activated after the user has given explicit consent via our cookie consent banner (see Section 3.0). Without consent, no analytics cookies are set and no data is transmitted to Google.

Legal basis: Art. 6 para. 1 lit. a GDPR (Consent).

Data collected: Page views, session duration, referral source, approximate geographic location, device type, browser type, and screen resolution. IP addresses are anonymized by default in GA4.

Cookies set:

Data transfers: Google may transfer data to servers in the United States. Google LLC participates in the EU-US Data Privacy Framework. Additional safeguards are provided via Standard Contractual Clauses (see Section 1.3).

Opt-out: You can withdraw your consent at any time by clicking the “Cookie Settings” link in the website footer and declining (or unchecking “Analytics” under Settings and saving). Withdrawing consent also deletes the _ga cookies already set in your browser. You can additionally install the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout

Google’s privacy policy: https://policies.google.com/privacy

3.2. Customer account

Users of Project Succession can create a customer account within the tool. We process the data requested in this context in order to provide the Software and fulfil our contractual obligations. Legal basis for the processing is Art. 6 para. 1 s. 1 lit. b GDPR (performance of a contract).

In addition to the data entered during registration, we process IP addresses, browser resolution and, in the case of SSO, the data transmitted via OpenID.

Users may request deletion of their Project Succession account at any time by contacting us at contact@cg-jm.com. Upon deletion, all account-related data will be removed unless statutory retention obligations apply (see section 1.4.1).

3.2.1. Error Logs and Crash Reports

When the Software encounters technical errors or crashes, diagnostic data may be generated. This can include:

Processing these logs is necessary to ensure stability, security, and improvement of the Software.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in maintaining functionality).

Crash logs are stored for a maximum of 12 months unless earlier deletion is required or requested.

The Project Succession marketing page embeds a YouTube video (trailer). To protect your privacy, the video does not load automatically. Instead, a placeholder is displayed, and the YouTube iframe is only loaded after you explicitly click “Load video”, choose “Accept all” in the cookie banner, or select the YouTube option under the banner’s “Settings” (see Section 3.0). Your choice is stored in your browser (localStorage entry yt-consent) so that you are not asked again on every visit.

Provider: YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Privacy mode: When the video is loaded, it is embedded via youtube-nocookie.com (YouTube’s extended privacy mode). In this mode, YouTube does not store browser cookies that identify you for personalized advertising until you actively interact with (play) the video. However, even in this mode, the loading of the player itself transmits data to Google, including:

If you play the video while signed into a Google account, Google may associate the playback with your account.

Data transfer outside the EEA: Google may transfer data to servers in the United States. Google LLC participates in the EU-US Data Privacy Framework. Additional safeguards are provided via Standard Contractual Clauses (see Section 1.3).

Legal basis: Art. 6 para. 1 lit. a GDPR (Consent). Without consent (i.e. when the placeholder is shown), no data is transmitted to YouTube/Google.

Opt-out / withdrawal of consent: You can withdraw your YouTube consent at any time via the “Cookie Settings” link in the website footer — either by choosing “Decline” (removes all stored service confirmations) or by unchecking “Embedded video (YouTube)” under Settings and saving. The withdrawal takes effect from the next page load. You can also avoid loading the embed by simply not clicking the “Load video” button.

Google’s privacy policy: https://policies.google.com/privacy

3.3. Local storage and technically necessary cookies

Our Website itself sets no tracking cookies. The following entries are stored in your browser’s localStorage solely to remember your consent choices. They are first-party, have no expiry date, and are deleted when you clear your browser’s site data or withdraw your consent via “Cookie Settings”:

This storage is strictly necessary to honor your consent decisions and is therefore exempt from the consent requirement under § 25 (2) Nr. 2 TDDDG. The associated processing is based on Art. 6 para. 1 lit. f GDPR (our legitimate interest — and obligation under Art. 7 GDPR — to respect and demonstrate your consent choices).

Our hosting provider Cloudflare (see Section 3.4.4) may set a technically necessary security cookie (e.g. __cf_bm, lifetime approx. 30 minutes) for bot detection and attack mitigation. This cookie is strictly necessary for the secure operation of the Website (§ 25 (2) Nr. 2 TDDDG; Art. 6 para. 1 lit. f GDPR).

Cookies set by Google Analytics (see Section 3.1) and by Paddle in the context of price preview and checkout (see Section 3.4.2) are consent-based and described in the respective sections.

3.4. Third Parties

3.4.1. Google Firebase

We use Firebase, a framework from Google Ireland Limited (privacy policy: https://firebase.google.com/support/privacy), through which we track and manage the following real-time features in the software:

Firebase Authentication and Firestore: We use these services to create and manage your user account, authenticate you, and store your license information (e.g., email, hashed password, license status). This processing is necessary to provide you with the software you have licensed. The legal basis is Art. 6 para. 1 lit. b GDPR (Performance of a Contract).

Firebase Functions allows the Software to securely communicate with third party providers like Paddle.com Market Limited (https://www.paddle.com/legal/privacy) or Atlassian (https://www.atlassian.com/legal/privacy-policy)

Checkout session verification on the Website: When you open the buy page (/buy) or the enterprise checkout page (/enterprise-seat-checkout) from the Software, the Website — only after you have actively confirmed the loading of external services via the notice shown on the page — transmits your checkout session ID to a Firebase Cloud Function operated in the us-central1 region (USA) and receives the email address and account details associated with your session, in order to attribute the purchase to your account. The legal basis is Art. 6 para. 1 lit. b GDPR (Performance of a Contract). The transfer to the USA is safeguarded by Google LLC’s certification under the EU-U.S. Data Privacy Framework.

We use the information processed by Google to evaluate the use of the app in order to facilitate the optimisation and further development of the software. The processing is based on Art. 6 para. 1 s. 1 lit. a GDPR. Data subjects can revoke their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The revocation does not affect the lawfulness of the processing until the revocation.

Passwords stored via Firebase Authentication are hashed using industry-standard hashing algorithms (e.g., bcrypt or equivalent), never stored in plain text.

3.4.2. Paddle

We use the reseller Paddle.com Market Limited (Paddle) to handle all payment processing and order fulfillment. Paddle is the “Merchant of Record” for all transactions. When you purchase our Software, you provide your personal data (name, address, payment information, email) directly to Paddle. We do not receive or store your full payment details. We only receive information from Paddle necessary to fulfill the contract, such as your email address and license type, to create your account.

Paddle is the data controller for your payment and purchase data. The legal basis for this processing is Art. 6 para. 1 lit. b GDPR (Performance of a Contract). Paddle’s privacy policy is available at: https://www.paddle.com/legal/privacy.

Loading of the Paddle SDK (price preview and checkout): On the Project Succession marketing page (/project-succession), the buy page (/buy), and the enterprise checkout page (/enterprise-seat-checkout), the Paddle JavaScript SDK is loaded from cdn.paddle.com only after you actively confirm this via the notice shown on the page (“Show live prices” / “Load checkout”). Once confirmed, the SDK retrieves and displays current prices in your local currency; this transmits your IP address and basic browser information to Paddle. Your confirmation applies only to the respective section of the page and is stored in your browser (localStorage entry paddle-consent) so that you are not asked again on every visit. Consent can also be given via our cookie consent banner — for all external services at once (“Accept all”) or individually under “Settings” (see Section 3.0). You can revoke your consent at any time via the “Cookie Settings” link in the website footer, either by choosing “Decline” (removes all stored service confirmations) or by unchecking the respective service under Settings and saving; the revocation takes effect from the next page load.

Legal basis: Art. 6 para. 1 lit. a GDPR (Consent) and § 25 (1) TDDDG — the SDK and any cookies it sets (e.g. for fraud prevention and request integrity) are only loaded after your active confirmation. The processing is further limited and safeguarded because:

The localStorage entries that store your consent choices themselves are strictly necessary storage within the meaning of § 25 (2) Nr. 2 TDDDG (see Section 3.3).

You can object to this processing on grounds relating to your particular situation under Art. 21 GDPR by contacting us at contact@cg-jm.com.

3.4.3. GitHub

The download section of the Project Succession marketing page is served entirely through our hosting provider Cloudflare (see Section 3.4.4): release information is part of the Website itself, and installer downloads are delivered from our subdomain downloads.cg-jm.com via Cloudflare R2 object storage. No connection to GitHub is established when viewing the page or downloading the software.

The page contains an outbound link (“View on GitHub”) to our public release archive at GitHub (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA; privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement). Data is transmitted to GitHub only if you actively follow this link, at which point GitHub’s privacy statement applies. GitHub, Inc. is certified under the EU-U.S. Data Privacy Framework.

3.4.4. Cloudflare (Hosting and Content Delivery)

Our Website is delivered via the global network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”; privacy policy: https://www.cloudflare.com/privacypolicy/). All requests to our Website pass through Cloudflare’s servers. In the process, Cloudflare processes technical connection data — in particular your IP address, the requested URL, browser type and version, operating system, referrer URL, and the date and time of the request — in order to deliver the Website reliably and to protect it against attacks (e.g. DDoS) and other security threats. Cloudflare may also collect aggregated network telemetry (network error logging) for these purposes. This includes software downloads for Project Succession, which are delivered from our subdomain downloads.cg-jm.com via Cloudflare R2 object storage under the same processing terms.

This processing is strictly necessary for the operation and security of the Website; no consent is required. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in the secure, fast and reliable delivery of our Website). Cloudflare acts as our processor under a data processing agreement pursuant to Art. 28 GDPR. Transfers to the USA are safeguarded by Cloudflare, Inc.’s certification under the EU-U.S. Data Privacy Framework as well as EU Standard Contractual Clauses. Connection data is retained only as long as necessary for the stated purposes.

3.5. User-Generated Content (Local Data)

Project Succession enables users to create automation pipelines (“User-Generated Content”). This includes scripts, workflows, configurations, third-party tool connections, and any other material created within the Software. All such data is processed and stored exclusively on the user’s local device. We do not access, upload, analyze, or collect this data unless the user expressly and voluntarily provides it (e.g., for support).

You remain the sole controller of this data (Art. 4 No. 7 GDPR).

4. Data processing on social media platforms

We are represented in social media networks in order to present our organization and our services there. The operators of these networks regularly process their users’ data for advertising purposes. Among other things, they create user profiles from their online behavior, which are used, for example, to show advertising on the pages of the networks and elsewhere on the Internet that corresponds to the interests of the users. To this end, the operators of the networks store information on user behavior in cookies on the users’ computers. Furthermore, it cannot be ruled out that the operators merge this information with other data. Users can obtain further information and instructions on how to object to processing by the site operators in the data protection declarations of the respective operators listed below. It is also possible that the operators or their servers are located in non-EU countries, so that they process data there. This may result in risks for users, e.g. because it is more difficult to enforce their rights or because government agencies access the data.

If users of the networks contact us via our profiles, we process the data provided to us in order to respond to the inquiries. This is our legitimate interest, so that the legal basis is Art. 6 para. 1 s. 1 lit. f GDPR.

4.1. Instagram

We maintain a profile on Instagram. The operator is Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The privacy policy is available here: https://help.instagram.com/519522125107875.

4.2. YouTube

We maintain a profile on YouTube. The operator is Google Ireland Limited Gordon House, Barrow Street Dublin 4. Ireland. The privacy policy is available here: https://policies.google.com/privacy?hl=de.

4.3. LinkedIn

We maintain a profile on LinkedIn. The operator is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

The privacy policy is available here: https://www.linkedin.com/legal/privacy-policy?_l=de_DE. One way to object to data processing is via the settings for advertisements: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

4.4. TikTok

We maintain a profile on TikTok. The operator is musical.ly Inc, 10351 Santa Monica Blvd #310, Los Angeles, CA 90025 USA. The privacy policy is available here: https://www.tiktok.com/de/privacy-policy.

4.5 Reddit

We maintain a profile on Reddit. The operator is Reddit, Inc, 548 Market St. #16093, San Francisco, California 94104, USA. The privacy policy is available here: https://www.reddit.com/policies/privacy-policy.

4.6 Discord

We maintain a profile on Discord. The operator is Discord Inc, San Francisco, CA, 444 De Haro Street, USA. The privacy policy is available here: https://discord.com/privacy.

5. Changes to this privacy policy

We reserve the right to change this privacy policy with effect for the future. A current version is always available here.

6. Questions and comments

If you have any questions or comments regarding this privacy policy, please feel free to contact us using the contact information provided above.

Effective Date and Versioning

This Privacy Statement is Version 1.4 and was last updated on 03.08.2026.

Future changes will be published on this page.