Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Helmut Balzersen
Große Howe 7
33607 Bielefeld, Germany
E-Mail: info@derkiassistent.de

We process personal data only where permitted by law or covered by consent. The legal bases are in particular:

• Art. 6(1)(b) GDPR – Performance of a contract (providing the tool after purchase)
• Art. 6(1)(f) GDPR – Legitimate interests (operation & security of the platform)
• Art. 6(1)(c) GDPR – Legal obligations (tax, accounting)

When you visit the site the web server automatically stores the following data in server log files:

Data category	Purpose	Retention
IP address (truncated)	Security, troubleshooting	7 days
Date & time of access	Error analysis	7 days
URL accessed	Error analysis	7 days
Browser type & OS	Compatibility	7 days
HTTP status code	Error analysis	7 days

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating and securing the platform).

Purchasers of the AI Assistant can store the following data in a school profile, which is saved on our server in a MySQL database:

Field	Example	Purpose
School name	"Surf & Kite School"	Personalising AI replies
Prices	"Beginner: €60/day"	AI replies to booking enquiries
Info	"Meeting point: South Beach"	AI replies about location etc.
Licence code	"KS-7X9M2"	Linking data to the user
Last updated	Timestamp	Technical administration

Data is deleted on request at any time – an e-mail is sufficient. Legal basis: Art. 6(1)(b) GDPR.

To use the AI features, users enter their own Anthropic API key. This key is:

• stored exclusively in the user's browser (localStorage)
• transmitted temporarily to our server with each AI request
• forwarded from our server to the Anthropic API
• not stored in our database
• not recorded in server logs

Purchases are processed via Digistore24 GmbH (St.-Martin-Str. 78, 81541 Munich, Germany). Digistore24 acts as the contracting party and is independently responsible for payment processing. We only receive the e-mail address needed to deliver the product (licence code). Payment data is processed exclusively by Digistore24.

Digistore24 privacy policy: digistore24.com/en/privacy

To generate AI replies, text inputs (customer enquiries, school profile data) are transmitted to the API of Anthropic, PBC (548 Market Street, Suite 98777, San Francisco, CA 94104, USA).

Anthropic processes this data as a data processor under a Data Processing Agreement (DPA). As Anthropic is based in the USA, data is transferred to a third country. The basis for this is the EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.

Further information: anthropic.com/privacy

The tool stores the following data locally in the user's browser via localStorage:

Key	Content	Purpose
kiCode	Licence code (e.g. KS-7X9M2)	Automatic login on next visit
kiApiKey	User's Anthropic API key	No need to re-enter the key

localStorage data never leaves the user's browser and is not transmitted to us. It can be deleted at any time via browser settings. localStorage is not a cookie and therefore does not require a cookie consent banner.

Matomo Analytics is operated on our own server (matomo.derkiassistent.de). Only anonymised access data is collected (pages visited, approximate country of origin, device type). IP addresses are anonymised before storage. There is no cross-session tracking and no personal data is transmitted to third parties. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in anonymous usage analysis). More info: matomo.org/privacy

Anyone who signs up for our free daily AI Morning Briefing enters their e-mail address and confirms the subscription via a double opt-in procedure: after submitting the form you receive a confirmation e-mail, and only after clicking the link it contains does the subscription become active.

To send the briefing and to document the consent (Art. 7 GDPR) we store the following data in our database:

Data category	Purpose
E-mail address	Sending the briefing
Consent text & version	Proof of what exactly was consented to
IP address at sign-up & confirmation	Proof of consent (double opt-in)
Timestamp of sign-up & confirmation	Proof of consent
Status (pending / confirmed / unsubscribed)	Managing the mailing list

Legal basis: Art. 6(1)(a) GDPR (consent).

Storage period: The data is stored for as long as the subscription is active. After unsubscribing, the status is set to “unsubscribed”; the consent record may be kept for a limited time to meet legal proof obligations and is then deleted. Complete deletion is possible at any time by e-mail to info@derkiassistent.de.

Delivery: The e-mails are sent via our hosting provider (ALL-INKL.COM – Neue Medien Münnich). E-mail addresses are not passed on to third parties for advertising purposes.

Under the GDPR you have the following rights:

Right	Legal basis	What this means
Access	Art. 15 GDPR	You can find out at any time what data we hold about you.
Rectification	Art. 16 GDPR	Incorrect data will be corrected on request.
Erasure	Art. 17 GDPR	You can request deletion of your data – we delete your school profile immediately on request.
Restriction	Art. 18 GDPR	Processing can be restricted under certain circumstances.
Objection	Art. 21 GDPR	You can object to processing based on legitimate interests.
Portability	Art. 20 GDPR	Your data can be provided in a machine-readable format.
Complaint	Art. 77 GDPR	You can lodge a complaint with a supervisory authority.

To exercise your rights contact us at: info@derkiassistent.de

Competent supervisory authority (Germany): Federal Commissioner for Data Protection and Freedom of Information (BfDI)

We reserve the right to update this privacy policy when legal requirements change or new processing activities are added.