Privacy Policy

1. Overview

This Privacy Policy explains how I process personal data when you visit this website ("Online Offering"). I only process (a) data that is technically necessary to operate and secure the website and (b) data you provide to me when contacting me.

2. Controller

The controller responsible for data processing is:

3. Legal bases

If you are located in the EEA/UK, I process personal data only if a legal basis applies. For this website, the most relevant bases are:

• Legitimate interests (Art. 6(1)(f) GDPR) – operating and securing the website
• Contract / pre-contractual steps (Art. 6(1)(b) GDPR) – if your request relates to a service/contract
• Consent (Art. 6(1)(a) GDPR) – only if I explicitly ask for it

4. Hosting & server log files

When you access this website, the hosting provider processes technical data to deliver the content and ensure security. This may include IP address, date/time of access, requested page/file, referrer URL, browser and operating system information, and status codes.

Purpose

• Delivery of content
• Stability and troubleshooting
• Security and abuse prevention

Legal basis

Legitimate interests (Art. 6(1)(f) GDPR).

Retention

Server log files are kept for at most 30 days, then deleted or anonymized.

Hosting provider

Hosted by: Hetzner Online GmbH
Country: Germany

5. Cookies & local storage

I do not use cookies for advertising or tracking. The website may use strictly necessary browser storage (e.g., localStorage/sessionStorage) to remember basic UI settings. This storage remains on your device and can be deleted in your browser settings.

If I introduce non-essential cookies in the future, I will request your consent beforehand.

6. Contact

If you contact me (e.g., by email), I process the information you provide (such as your email address and message content) to respond to your request.

Data processed

• Contact details (e.g., email address, name if provided)
• Message content
• Metadata (e.g., time of contact)

Legal basis

Art. 6(1)(b) GDPR (contract-related) or Art. 6(1)(f) GDPR (general communication).

Retention

Until the request is completed, plus a reasonable period for follow-up; longer if required by law.

7. Feature requests sent by email

You can submit a feature request by sending an email to the request address shown on the request page. The email is picked up by the workflow automation (n8n) and turned into a ticket on the project board.

Data processed

• Sender email address
• Subject line
• Message content
• Metadata (e.g., time of receipt)

Purpose

• Creating a ticket from your request
• Sending you a confirmation email once the ticket has been created
• Notifying you by email when the ticket moves to another board column
• Enforcing the daily request limit

Who can see your request

The ticket, including your email address as its creator, is visible to everyone who has access to the project board.

Legal basis

Art. 6(1)(b) GDPR (contract-related) or Art. 6(1)(f) GDPR (general communication).

Processing on my behalf

The mailbox behind the request address is hosted by Hetzner Online GmbH (Germany) and read over IMAP. The emails are then processed by a self-hosted n8n instance running on a Hetzner cloud server (CPX12). The resulting tickets are stored in Google Firebase Realtime Database, region europe-west1 (Belgium).

Retention

Tickets on the project board and the emails they were created from, which remain in the request mailbox until then, are deleted no later than 30 days after the project assessment has been completed.

8. Transfer to an AI service

To turn your request into a ticket, the subject line and the message content are transmitted to Google Gemini. The service generates a title, a category, a priority level and a summary from that text.

Data transmitted

• Subject line
• Message content

Your email address is not transmitted separately. Anything you write inside the message itself is part of the transfer.

Provider

The service is Google Gemini, provided by Google. The model addressed is gemini-3.5-flash, called through Google’s general API endpoint; no regional endpoint is configured. Processing outside the EU can therefore not be ruled out. The transfer is based on the EU Standard Contractual Clauses.

No automated decision-making

The result is a draft ticket that I review and may change. No automated decision is taken that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

Legal basis

Legitimate interests (Art. 6(1)(f) GDPR) – handling requests efficiently.

9. Your rights

If you are located in the EEA/UK, you may have the following rights (depending on the applicable law):

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent at any time (Art. 7(3) GDPR), if processing is based on consent

To exercise your rights, contact me using the details in section “Controller”.

10. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

11. Changes to this policy

I may update this Privacy Policy from time to time. The “Last updated” date at the top indicates the latest version.