Privacy Policy

1. Data controller

2. Data processing

We limit the processing of personal data to what is necessary to operate this website, understand its use, protect it from abuse, and respond to inquiries. The services involved and their purposes are described below.

2.1 Hosting and security with Cloudflare

This website is hosted through Cloudflare Pages and uses Cloudflare Functions, provided by Cloudflare, Inc. Cloudflare processes technical request data such as IP addresses, requested URLs, browser and device information, and traffic metadata to deliver the site and protect it from attacks and abuse.

The legal basis is our legitimate interest in providing a functional, reliable, and secure website (Art. 6(1)(f) GDPR). Cloudflare may retain operational and security data under its own retention policies. Details are available in Cloudflare’s Privacy Policy.

2.2 Website analytics and AI crawler tracking (Databuddy)

We use Databuddy to understand visits and improve the website. Depending on enabled features, it processes page and referrer addresses, visitor and session identifiers, approximate location, browser and device information, interactions, performance measurements, and errors. The browser tracker uses localStorage and sessionStorage for visitor and session information, rather than analytics cookies. Cookieless analytics does not itself mean that data is anonymous or that consent requirements never apply.

Our server also reports AI crawler requests, including the requested path, host, user agent, referrer, and requested content format. The FAQ question text is not included in the crawler reports. The analytics purpose is based on our legitimate interest in understanding and improving the site (Art. 6(1)(f) GDPR), subject to applicable requirements for browser storage. See Databuddy’s Privacy Policy, including its browser privacy-signal and opt-out controls.

2.3 Contact form and email inquiries

If you use the reach-out form, we process the information you provide: your name, email address, company or project, selected services, budget, discovery source, and additional message. We use it to respond to your request and explore a possible collaboration.

The legal basis is Art. 6(1)(b) GDPR for steps taken at your request before entering into a contract and, where applicable, our legitimate interest in responding to inquiries (Art. 6(1)(f) GDPR). Form submissions are processed and delivered by email through Web3Forms, provided by Backpackfy Ventures LLP. See Web3Forms’ Privacy Policy for its processing, infrastructure, and retention information.

We retain inquiries as long as needed to handle the request and any resulting business relationship, and longer where legally required. Web3Forms states that submission data may be retained for up to three years unless a shorter plan-specific period or earlier deletion applies.

2.4 AI-assisted FAQ (OpenAI)

The optional FAQ assistant uses OpenAI’s API with GPT-5 nano. When you submit a question, our Cloudflare Function sends its text and public site information from the deployed site documentation to OpenAI. The model is instructed to answer only from that information and decline questions it cannot answer from the source. It does not browse the web or access private client files.

Please do not enter personal, confidential, or sensitive information. Our application does not forward your IP address to OpenAI or keep a conversation history. Cloudflare stores IP-based request counters for abuse prevention for up to two days.

The legal basis is our legitimate interest in answering service-related questions and preventing abuse (Art. 6(1)(f) GDPR). OpenAI does not use API data for model training by default. Its default abuse-monitoring logs may contain questions and responses for up to 30 days, with possible legal or safety exceptions. See OpenAI’s API data controls. You can also email us instead.

2.5 External links and international processing

Links to social networks, booking services, and external AI assistants take you to services operated by their respective providers. Their privacy policies apply when you use those services.

Our providers may process data outside the European Economic Area, including in the United States and India. Their published policies and data-processing terms describe the applicable transfer arrangements, including standard contractual clauses where used. Contact [email protected] for information about the safeguards relevant to your data.

3. Your rights

Under the GDPR, you have rights regarding your personal data, subject to the applicable legal conditions, including:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Lodging a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, please contact [email protected]. You can complain to a data protection authority, including the Hessian Commissioner for Data Protection and Freedom of Information.

4. Changes to this policy

We may update this policy to reflect changes in our services or legal requirements. The current version applies to your visit.