Privacy Policy

1. Controller

We have not appointed a data protection officer under Art. 37 GDPR, as we do not permanently employ more than 20 people involved in the automated processing of personal data and do not carry out a core activity that requires extensive, regular and systematic monitoring of data subjects or extensive processing of special categories of personal data.

2. Hosting

This website is hosted externally. Personal data collected on this website is processed on the host's servers. This may include, in particular, IP addresses, timestamps, pages visited and similar server log data. External hosting is carried out in the interest of a secure, fast and efficient provision of our online offering (Art. 6 (1) (f) GDPR).

3. Contact Form and Enquiries

Via the contact form and via the enquiry field of our AI assistant Nina (see section 4) we collect your name, email address, optionally your company, the topic and your message. If the enquiry comes from the chat with Nina, we include the chat so far, so that we understand your request without asking again. We process this information exclusively to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measure) and Art. 6 (1) (f) GDPR (legitimate interest in processing enquiries).

We store every enquiry in our self-hosted database (Baserow). It runs on our server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Germany. In addition, we deliver the enquiry to our mailbox by email; for sending we use Mailjet (Mailjet SAS, 13-13 bis rue de l'Aubrac, 75012 Paris, France). We have a data processing agreement under Art. 28 GDPR with both providers.

Retention period: we delete enquiries that do not lead to a collaboration at the latest 24 months after your last contact. If an order results, the statutory retention periods for business correspondence apply.

4. AI Assistant Nina (Chat and Voice)

The button at the bottom right opens Nina, our AI assistant. Nina is an artificial intelligence, not a person. She answers questions about the content of this website and takes enquiries for us.

Chat: we process your messages on our own server (voice.made-with.ai, Hetzner, Germany) and search Nina's knowledge base (Qdrant) there. It contains only the public content of this website. To formulate the answer, we send your message, the chat so far and the website content found to Google's Gemini language model, via the EU endpoint of the service provider Eden AI SAS, 10 rue de Penthièvre, 75008 Paris, France. This endpoint rejects requests to models outside the EU. If the service fails, a language model on our own servers (Ollama) answers. Your browser holds the chat while the window is open; we only store it if you send an enquiry (section 3). Please do not enter sensitive information in the chat, such as health details or ID numbers.

Voice window: for the conversation in your browser, we transmit your voice input in real time to Google's Gemini Live service, which generates the spoken answer. Processing by Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-U.S. Data Privacy Framework. Your browser asks for access to the microphone before the first conversation.

Enquiries via Nina: if you would like to send us an enquiry, Nina shows an input field. Nina writes the topic and a summary of your request from the conversation (in the chat via Gemini as described above); you can change both before sending. You type your name, email address and company into the field. These details go directly to this website and from there to our database and our mailbox (section 3). They are not passed to the language model.

Protection against misuse: so that Nina is only used for questions about our services, our server automatically checks every message and every spoken input for attempts to obtain internal data, inject program code or reprogram Nina. For this we process your IP address as well as the start and duration of your conversations. Each connection can have at most five conversations in 24 hours, each lasting at most ten minutes. After the first detected attempt you receive a notice; after the second we end the connection and block access for your connection for 24 hours. We are informed about every incident by email (sent via Mailjet) with the time, IP address and an excerpt of your input. A person reviews every incident. We delete conversation times and IP addresses after 7 days, incident details after 90 days and blocks when they expire.

The legal basis for the chat and the voice window is the handling of your request (Art. 6 (1) (b) GDPR) and our legitimate interest in fast information and in the security of our systems (Art. 6 (1) (f) GDPR).

5. Free tools under /tools

The brand kit extractor and the video call background generator work with a web address you enter. Only that address is transmitted, and only the publicly available start page of the named domain is read. The logo, the colour values and the typeface information are returned to your browser and processed there. The generated picture is produced entirely in your browser and is not transmitted to us. We store neither the logo nor the generated picture.

For technical reasons we process your IP address with every request. It is held in memory solely to limit the number of requests (ten per hour), is not stored permanently and is not combined with other data. The result of a request is cached for 24 hours under the domain requested, so that a repeated request does not open the third-party page again. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing the service and protecting it from abuse).

Processing takes place on a server in Germany. By using the tools you confirm that you are entitled to use the brand you enter.

6. Cookies & Tracking

This website does not use any analytics or tracking tools and no advertising cookies. Only a technically necessary, local storage of your theme preference (light/dark) is used in your browser. No personal data is processed and no consent is required (Art. 6 (1) (f) GDPR, legitimate interest in a properly functioning display).

7. Disclosure to Third Parties

Beyond the service providers named in sections 3 and 4, we do not pass your data on to third parties, except where required by law or necessary for the performance of a contract.

8. Your Rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection (Art. 21 GDPR) regarding your personal data. To exercise these rights, please use the contact address above. You also have the right to lodge a complaint with a competent data protection supervisory authority.