Privacy notice
How we process personal data under the GDPR.
1. Controller
Lukas Klüpfel
Krausstraße 11
47119 Duisburg, Germany
Email: [email protected]
2. What we process
- Account data — your work email address, role and organisation membership (needed to run your account; legal basis: contract performance, Art. 6(1)(b) GDPR).
- Job inputs — ingredient texts you submit for translation and allergen analysis. These are product data, but we treat them confidentially and scope them to your organisation.
- Audit logs — per-output records (model IDs, prompt hashes, timestamps, cost) kept for reproducibility and billing (legal basis: contract performance and legitimate interest, Art. 6(1)(b) and (f) GDPR).
- Demo requests — company, name, email and message you send via the contact form, used only to respond (Art. 6(1)(b) GDPR, pre-contractual steps).
No tracking cookies, no analytics scripts, no advertising. The only cookies are the session cookie (sign-in) and a short-lived SSO flow cookie. Fonts are self-hosted — no requests to font CDNs.
3. Processors
We use the following processors under Art. 28 GDPR data-processing agreements:
- Railway — application hosting.
- Anthropic — LLM processing of submitted ingredient texts (translation and review).
- Resend — transactional email (sign-in links, invitations, notifications).
- Google — optional single sign-on, only if your organisation chooses to sign in with Google.
Transactional email is dispatched from an EU region (Ireland, eu-west-1). Where a processor is located in the USA, transfers are safeguarded by EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the provider is certified, the EU–U.S. Data Privacy Framework.
4. Retention
- Account data: for the duration of the contract, then deleted or anonymised within 3 months.
- Audit logs: retained while the contract runs — they are the compliance record your QA team relies on — and for up to 24 months after contract end, unless longer statutory retention (e.g. for billing records) applies.
- Demo requests: deleted no later than 6 months after the conversation ends.
5. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), plus the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Contact: [email protected]. The competent supervisory authority for the controller is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.