Privacy policy

Controller

Peter Mustermann, Musterstraße 1, 12345 Musterstadt, Germany, peter.mustermann@example.com

In short

You need no account for the analysis and give no name or email address. We store what you write about your task and delete it after 30 days. Please describe processes and kinds of data, but no real records, names or credentials.

What we process during an analysis

Your description of the task, your answers in the interview and the result (verdict, platform, process, diagram). Also technical data: times, language, cost and duration of the AI calls.

The legal basis is Art. 6(1)(b) GDPR (you request the analysis) and, for abuse protection, Art. 6(1)(f) GDPR (legitimate interest in keeping the free service affordable and secure).

Retention

Analyses are deleted automatically 30 days after they start, including those from the pilot.

Counters for abuse protection expire after one day at the latest. The cost of AI calls is kept for accounting, without any link to your text.

Cookie and abuse protection

We set a single, strictly necessary cookie (ff_b). It holds a random identifier so you find your analysis again in the same browser and we can limit free analyses per browser. It expires after one year. We set no cookies for advertising or tracking.

We do not store your IP address. To limit analyses per network we count under an irreversible key derived from the shortened address.

When you start an analysis, Cloudflare Turnstile invisibly checks that a human is using the service. Cloudflare processes technical data from your browser and your IP address for this.

Recipients and processors

Vercel Inc. (USA): hosting of the app, servers in Frankfurt. Server logs contain no text from your analysis.

Supabase Inc.: database in Frankfurt.

Anthropic PBC (USA): the AI agents run on the Claude API. Your description and answers are sent to Anthropic and processed in the USA. Anthropic does not use API inputs to train its models.

Upstash Inc.: counters for the limits, servers in Frankfurt.

Cloudflare Inc. (USA): Turnstile, see above.

Resend Inc. (USA): sending emails, only if you join a waitlist, servers in Ireland.

Functional Software Inc. (Sentry): error reports of the app, servers in the EU, without your texts and without IP address.

PostHog Inc.: counting the steps of an analysis (such as “interview finished”), servers in the EU, without cookies, without your texts and without IP address.

Data processing agreements are in place with all providers. Transfers to the USA rely on the EU-US Data Privacy Framework or standard contractual clauses.

Waitlist

If you join a waitlist, we store your email address, the occasion and when you consented. You first get an email with a confirmation link; without confirmation we delete the address after 7 days. Every email contains an unsubscribe link, after which the address is deleted immediately. The legal basis is your consent (Art. 6(1)(a) GDPR).

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you may withdraw consent at any time. Write to peter.mustermann@example.com. You may also lodge a complaint with a data protection supervisory authority.