Privacy policy

Controller

Daniel Hütte, Inselgarten 25, 48151 Münster, Germany. Email: kontakt@speedofthespirit.dev

There is no data protection officer because the legal requirements for appointing one are not met.

Visiting the site

The site is delivered through Cloudflare (Cloudflare, Inc., USA). When you open it, Cloudflare processes technically necessary data: IP address, time, requested address and details sent by your browser. This is needed to deliver the site and protect it against attacks (Article 6(1)(f) GDPR). I do not keep access logs myself.

No cookies, no tracking

The public pages set no cookies and use no analytics or advertising services. Typefaces, the 3D scene, images and music are hosted on this domain; no third-party content is loaded. The music only starts when you start the flight yourself.

Contact by email

When you write to me, I process your email address and the content of your message in order to reply (Article 6(1)(b) and (f) GDPR). The mailbox is hosted by Zoho Mail (Zoho Corporation B.V., Netherlands) in data centres in the European Union. I delete messages once the matter is settled and no statutory retention period applies.

Account and sign-in

For an account I store your email address, your role and a hash of your password. The password itself is never stored in plain text (Article 6(1)(b) GDPR). The data is kept for as long as the account exists.

After sign-in the site sets a cookie named “repocity_ausweis” and an entry in your browser's storage. Both keep you signed in for at most 30 days and are technically necessary (section 25(2) no. 2 of the German TDDDG). A design chosen in the interface is likewise stored only in your browser.

Failed sign-in attempts are counted for a short time to protect accounts against unauthorised access. A password reset link is valid for 30 minutes. If you set up a second factor, a secret is stored for it until you remove it again.

Vault for credentials

Credentials for other services that you place in the vault are stored encrypted, with a separate key per account and apart from the account data. They are kept until you delete them or the account ends (Article 6(1)(b) GDPR).

Tasks, templates, files and appointments

Whatever you enter or have generated in the signed-in interface is assigned to your account and used only to provide the service (Article 6(1)(b) GDPR). Tasks and messages expire after 30 days. Templates, files and appointments remain until you delete them or the account ends.

Question window Mia

Mia is an AI assistant and labelled as such. If a question cannot be answered from the content of the site, its wording is sent to Anthropic (Anthropic, PBC, USA) to be answered. Stored are the time, your identifier or a guest marker, tier, length of the request and the cost incurred; the wording for at most 30 days (Article 6(1)(b) and (f) GDPR).

Payment

No payment function is currently active. This policy will be extended before one is enabled.

Recipients and transfers to third countries

Recipients are the service providers named above: Cloudflare (delivery, storage of account and usage data), Zoho (email) and Anthropic (question window). Cloudflare and Anthropic are based in the USA; transfers there are subject to Articles 44 et seq. GDPR. Data is not passed on to other third parties unless required by law.

Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and the right to object to processing based on legitimate interests (Article 21).

An email to kontakt@speedofthespirit.dev is sufficient.

You may also lodge a complaint with a data protection supervisory authority (Article 77 GDPR), for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

Note on language

The German version of this policy is the authoritative one.