Privacy

This site sets no cookies and stores nothing in your browser. There are no analytics, tracking or advertising services. The fonts are served from this server.

I only process data about you when you open the site, write to me via the form or call the AI assistant.

Email: lukas.ripota@gmail.com

On every visit the host processes access data: IP address and the approximate location derived from it, time, requested URL including parameters, browser identifier and status code. This is necessary to deliver the site and protect it against attacks.

Host: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. In my Vercel account (Hobby plan) these logs can be viewed for 1 hour. For visitors' traffic data Vercel is itself a controller. How long Vercel keeps access data for its own purposes such as abuse prevention is set out in Vercel's privacy notice; it does not state a fixed period.

The legal basis is Art. 6(1)(f) GDPR, my legitimate interest in a secure, available site. The server functions run in Frankfurt; Vercel may, however, also process data in the USA and is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR).

You enter your task and an email address for my reply; name and company are optional. I only use the details to reply to you.

The server sends the message via the email service Resend to my Gmail inbox. To prevent mass sending it counts how often an IP address sends (at most 5 per hour) and checks how long filling in the form took. For this the IP address is held only in memory, never in a file or database.

Resend: Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, as a processor (Art. 28 GDPR). Resend processes the data in the USA and is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR).

Gmail: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process the data outside the EU, for example in the USA; Google LLC is certified under the EU-US Data Privacy Framework.

The legal basis is Art. 6(1)(f) GDPR, my interest in answering enquiries; where it concerns a contract with you personally, Art. 6(1)(b) GDPR. For the limit against mass sending the basis is likewise Art. 6(1)(f) GDPR, my interest in preventing abuse.

The assistant only starts when you click a call button (e.g. “Call my AI assistant”) and then “Call” in the window; your browser only enables the microphone once you allow it. Your voice (or your text, if you type) and which page and section are currently open then go directly from your browser to Google's Gemini Live API. A call lasts at most 5 minutes. I record nothing.

My server only issues a one-time key for this and does not see the conversation. When the assistant looks something up on this site, its search query goes via my server to Google's Gemini Embedding API. So that the same question is not computed twice, the query stays in memory without any link to your IP address until 500 queries have accumulated or the server restarts.

To prevent abuse the server limits per IP address calls (4 per hour, 2 at the same time), searches (80 in 10 minutes) and messages (3 per hour); in total at most 15 calls in 24 hours are possible. For this the IP address is held only in memory; the server deletes expired entries on the next request, at the latest when the server instance ends.

Contracting party for the Gemini API: Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. In the paid service Google processes the data as a processor and does not use inputs and replies to improve its products. Google keeps them for 55 days to detect and prevent violations of its Prohibited Use Policy, and for legally required disclosures. For resuming a session Google keeps the conversation state for up to 24 hours. Google may also process the data in the USA; Google LLC is certified under the EU-US Data Privacy Framework.

The legal basis for the call is your consent (Art. 6(1)(a) GDPR), which you give by clicking “Call” after the notice in the call window. You can withdraw it at any time by hanging up (Art. 7(3) GDPR); processing carried out until then remains lawful. For the limits the basis is Art. 6(1)(f) GDPR, my interest in limiting abuse and costs.

The site stores nothing on your device and reads nothing from it. It only requests microphone access for the call you start yourself, and your browser asks you separately. Insofar as § 25 TDDDG (German Telecommunications Digital Services Data Protection Act) applies, the access is strictly necessary for this explicitly requested service (§ 25(2) no. 2 TDDDG).

If you ask the assistant to pass on a message, it takes down name, company, contact, request and, if you like, a preferred time. You see the message first. It is only sent once you click or explicitly say “send it”, then, as with the form, via Resend to my Gmail inbox.

The legal basis is your consent through this confirmation (Art. 6(1)(a) GDPR). For the limit (3 messages per hour per IP address) the basis is Art. 6(1)(f) GDPR.

• Access logs at Vercelin my account 1 hour (Hobby plan); Vercel's own storage without a fixed period, see Vercel's privacy notice
• IP addresses for the limitsin memory only; the server deletes expired entries on the next request, at the latest when the server instance ends
• The assistant's search queriesin memory only, without IP address, until 500 queries have accumulated or the server restarts
• Messages from the form and the assistantin my inbox until your enquiry is dealt with; at Resend 30 days, in backups up to 7 days longer
• Calls with the assistantat Google 55 days for abuse monitoring and legally required disclosures; up to 24 hours for resuming a session

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). An email to lukas.ripota@gmail.com is enough.

You are not obliged to provide any data; without an email address, however, I cannot reply. There is no automated decision-making under Art. 22 GDPR: the assistant answers questions, it decides nothing about you.

Where I process data on the basis of Art. 6(1)(f) GDPR (hosting, form, limits), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). An email to lukas.ripota@gmail.com is enough.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is: