Privacy Policy
Datenschutzerklärung
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Chris Zemmel
Ostendstraße 1
75331 Engelsbrand, Germany
Email: chris@zyric.de
2. Hosting
This website runs on a server operated by the controller and rented from Hetzner Online GmbH, Germany, which acts as a processor. When the website is accessed, technically necessary access data (including IP address, time of access, requested resource, volume of data transferred, and user agent) is processed in order to deliver the page and ensure the security of operation. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the secure and stable operation of the site). The server is located in Germany and hosting involves no transfer to a third country.
3. Contact form
If you use the contact form, we process the data you provide (name, email address, and message) in order to respond to your inquiry. When you submit the form, your name, email address and message, together with the time of submission, are transmitted to the operator as a message via the messaging service Telegram. Nothing is transmitted when you merely visit the site. The legal basis is Art. 6 (1) (b) GDPR (initiation or performance of pre-contractual measures) and Art. 6 (1) (f) GDPR (legitimate interest in processing inquiries).
The same applies to the inquiry forms on the German service pages (/server-betrieb, /softwareentwicklung) and the callback form on /gastro. They ask for a name, an email address or phone number, and, on the service pages, a short description. Along with these, the message names the page the form was sent from and, if the address you arrived at carried one, its source parameter (for example "gads" for a search ad). No cookie is set and nothing is passed to an advertising network.
The same applies to the form on /k, the page the QR code on our business card leads to: if you leave your details there (optionally what your message is about, such as a project inquiry or an application, your name, optionally your company, an email address or phone number, and an optional note), they are used only to get in touch with you. You can optionally attach up to three files (for example an application or a document you want to discuss). Attachments are stored privately in the operator's file storage on the server that runs this website, are never publicly reachable, are used only to answer your message, and are deleted on request, otherwise together with the message (see section 8). They are not sent to Telegram; the Telegram message only says how many files were attached. To limit abuse, the number and size of uploads per IP address are counted for up to two days; the address is stored only as a hash. If you mark your message as an application, it and any documents you attach are deleted automatically six months after receipt unless a working relationship results from it (see section 8).
In addition to the Telegram message, every submission is stored in the database on the server that runs this website, so the inquiry can be read and answered there. Only the operator can access it. If we answer by email, the reply is sent through the email service described in section 4a.
4. Transfer to Telegram
For the contact-form messages described in section 3, we use the service Telegram (Telegram FZ LLC, Dubai, UAE), which receives them as recipient. In doing so, personal data may be transferred to a third country outside the EU/EEA for which no adequacy decision by the EU Commission exists. A corresponding data protection risk cannot be entirely ruled out.
4a. Sending email
Emails we send from chris@zyric.de through this website, such as a reply to your inquiry, are delivered by Resend (Resend, Inc., San Francisco, USA), using its EU region (Ireland). Resend processes your email address and the content of the message on our behalf in order to deliver it. Resend is a US company, so a transfer to the USA cannot be ruled out; it takes place on the basis of the EU Standard Contractual Clauses. The legal basis is Art. 6 (1) (b) and (f) GDPR.
A log of each email sent this way (recipients, subject, text, the names and sizes of attachments, and the delivery status reported back by Resend) and unfinished drafts are stored in the database on the server that runs this website. Attachments themselves are passed to Resend for delivery and not stored here. Only the operator can access this data.
4b. Customers, quotations and invoices
If you are a customer, we store your name or company, postal address, email address and the quotations, order confirmations and invoices we issue to you, with payment dates, on the server that runs this website. Invoices are sent as PDF by email through Resend (see 4a). We process this data to perform our contract with you and to meet statutory retention duties (Art. 6 (1) (b) and (c) GDPR); invoices and accounting records are kept for the statutory periods (8 to 10 years) and then deleted.
4c. Zyra, the AI assistant
On the home page you can ask Zyra, an AI assistant, about Chris Zemmel's work. Zyra is an AI, not a person (Art. 50 of the EU AI Act): its answers are generated automatically, can contain mistakes and are not binding. Please do not enter sensitive personal data. Only what you type or paste into the assistant is processed, and only when you send it.
Purpose and legal basis: answering your questions about our work, Art. 6 (1) (f) GDPR (legitimate interest in presenting our work and answering enquiries); where you use Zyra to prepare a hiring or project enquiry, also Art. 6 (1) (b) GDPR (pre-contractual measures).
To generate the answers, your question, any text you paste and the earlier messages of the same conversation are sent to Anthropic Ireland, Limited (Dublin, Ireland), the provider of the AI model Claude, which processes them on our behalf under its commercial terms and data processing addendum (Art. 28 GDPR). Anthropic may process data in the USA; such transfers are safeguarded by the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). Your IP address is not passed to Anthropic. Under its commercial terms Anthropic does not use these inputs to train its models and deletes them by default within 30 days, unless it has to keep them longer by law or to deal with a violation of its usage policy.
We do not store the content of your conversation. It is kept only in your browser's sessionStorage and disappears when you close the tab; no cookie and no localStorage are used for it. To protect against abuse and to limit costs, the server counts requests per IP address; the address is stored only as a salted hash and deleted after two days at the latest. Monthly totals (number of requests, tokens used and costs) are kept without any reference to you. The live status Zyra can show is read from our own infrastructure and contains no personal data.
AI in the operator's console: the private administration behind this website (Zyric Console) also uses Anthropic as a processor, on the same terms, for individual actions the operator starts by hand: reading, describing or transcribing a document in the operator's file storage (for example an incoming invoice), and suggesting wording for quotations and invoices. Such documents and drafts can contain personal data of business partners and customers. Nothing is sent without such an action, and each action sends only the one document or draft concerned. The legal basis is Art. 6 (1) (b), (c) and (f) GDPR, depending on the document.
5. Reach measurement
None. This website runs no reach measurement, no web analytics, and no tracking service. Nothing beyond the access data described in section 2, what you submit through the forms described in section 3 and what you send to Zyra (section 4c) is collected.
7. Fonts
The fonts used (Inter and Space Grotesk) are downloaded at build time and served locally from our server; no connection is made to external providers such as Google Fonts when you visit the site, and no request carrying your IP address reaches Google.
8. Storage period
We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods. Inquiries submitted via the forms are deleted once they have been processed, provided no statutory retention obligations prevent this; the copy kept in the website's database, including any files attached on /k, is deleted automatically 12 months after receipt at the latest. Applications sent via /k, including their attachments, are deleted automatically six months after receipt; only if a working relationship results from an application is it kept for as long as that relationship requires.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing based on Art. 6 (1) (f) GDPR (Art. 21). To exercise your rights, a message to the email address above is sufficient.
10. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority includes the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg).
See also our Legal Notice and our Accessibility statement.