Privacy Policy This is an English translation provided for convenience. The legally binding version is the German version at bernauer.ai/de/datenschutz. In case of discrepancy, the German version prevails. Last updated: 2026-11-08 1. Controller Controller within the meaning of the GDPR and other national data protection laws: Leon Bernauer Bergstraße 1 69120 Heidelberg Germany Email: leon@bernauer.ai 2. General notes This privacy policy informs you about the nature, scope, and purpose of the processing of personal data on this website. Personal data is any data that can be used to identify you personally. 3. Hosting (Vercel) This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the website, Vercel automatically processes server log files (IP address, date/time, page accessed, referrer, user agent) required for secure operation (Art. 6 (1) lit. f GDPR, legitimate interest). Because Vercel operates servers in the US, a transfer to a third country takes place. The transfer is based on EU Standard Contractual Clauses (Art. 46 (2) lit. c GDPR). Vercel is a participant in the EU-U.S. Data Privacy Framework. Vercel privacy policy: https://vercel.com/legal/privacy-policy The fonts used on the website are downloaded to our own server when the website is built and are served from there. Visiting the site does not open a connection to Google servers. 4. Cloudflare (DNS, CDN, bot protection, Web Analytics) We use Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, for DNS, content delivery, bot protection (Cloudflare Turnstile), and cookie-free analytics (Cloudflare Web Analytics). Cloudflare processes IP addresses, user-agent data, and request metadata for secure operation and to defend against automated attacks (Art. 6 (1) lit. f GDPR). Cloudflare Web Analytics sets no cookies and does not attribute individual visitors; collection is anonymous. Cloudflare is a participant in the EU-U.S. Data Privacy Framework and uses EU Standard Contractual Clauses. Privacy policy: https://www.cloudflare.com/privacypolicy/ 5. Contact form and lead capture When you use the contact form, we collect the data you enter: name, work email address, company, phone number, and message. If you request a Discovery Call through the booking form on the German site, we store your name, work email address and phone number together with your answers: how you use AI today, which tasks take your team the most time (optionally with one point you type yourself), roughly how many hours per week that is, and your team size. As the company, we store the domain of your email address. We process this data to handle your request (Art. 6 (1) lit. b GDPR, contract initiation; otherwise lit. f GDPR, legitimate interest in answering inquiries). Providing this data is voluntary, but without it we cannot handle your request. No automated decision-making, including profiling, takes place. When you submit the form we also store your IP address, your browser's user agent and the result of the bot check. This protects the form against abuse and spam (Art. 6 (1) lit. f GDPR, legitimate interest). The bot check (Cloudflare Turnstile, see section 4) only loads once you scroll to the form. Requests are stored in a database with Supabase Inc. (USA); the database server is located in the EU region Frankfurt (AWS Frankfurt). We send confirmation and notification emails via Resend, Inc. (USA, EU region for sending infrastructure). Data processing agreements under Art. 28 GDPR are in place with both providers. We store lead data for a maximum of 24 months if no business relationship is established. If a business relationship is established, the statutory retention periods apply (in particular § 147 AO, § 257 HGB). 6. Email communication (Google Workspace) When you contact us by email or we reply to your lead request by email, your information is processed by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google processes this data for email transmission and storage on our behalf. Google privacy policy: https://policies.google.com/privacy 7. Transfer to third countries Some of the providers mentioned above have their headquarters or server infrastructure in the US. Transfers are based on EU Standard Contractual Clauses and, where applicable, certifications under the EU-U.S. Data Privacy Framework. 8. SSL/TLS encryption This website uses SSL/TLS encryption for all data transmissions (visible by "https" and the lock icon in the browser). 9. Cookies This website does not set cookies for tracking or marketing purposes. Technically necessary cookies are used exclusively to ensure the functionality of the website. 10. Your rights You have the right at any time to: - Access (Art. 15 GDPR) - Rectification of incorrect data (Art. 16 GDPR) - Erasure (Art. 17 GDPR) - Restriction of processing (Art. 18 GDPR) - Data portability (Art. 20 GDPR) - Object to processing (Art. 21 GDPR) Contact leon@bernauer.ai for any of the above. 11. Right to lodge a complaint You have the right to lodge a complaint with a supervisory authority. The competent authority for our business is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg Königstraße 10a 70173 Stuttgart Germany https://www.baden-wuerttemberg.datenschutz.de 12. Changes to this policy We reserve the right to adapt this privacy policy so that it always complies with current legal requirements. The new privacy policy applies to your next visit.