AIream

Legal

Privacy Policy

Last updated: 28 June 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws of the EU member states and other data protection provisions is:

Anton Klein
Im Lerchenfeld 15A
30823 Garbsen
Germany
Email: info@aiream.dev

2. General Information on Data Processing

With this Privacy Policy we comply with our information obligations under Art. 13 GDPR (data collected directly from you) and Art. 14 GDPR (data collected from third-party sources, where applicable). We aim to provide this information in a precise, transparent, intelligible and easily accessible form using clear and plain language as required by Art. 12 GDPR.

We process personal data of our users only to the extent required to provide a functional website and our content and services. Every processing activity requires a legal basis under Art. 6 (1) GDPR. In particular, the following legal bases may apply:

  • Art. 6 (1) (a) GDPR - consent, for example for analytics or marketing cookies and newsletter subscriptions.
  • Art. 6 (1) (b) GDPR - performance of a contract or pre-contractual measures, for example processing your project inquiry.
  • Art. 6 (1) (c) GDPR - compliance with a legal obligation, for example commercial and tax retention duties.
  • Art. 6 (1) (f) GDPR - legitimate interests, for example security, stable operation of the website, protection against abuse and needs-based improvement of the website.

In Germany, the provisions of the Federal Data Protection Act (BDSG) also apply. Storage of information on end-user devices and access to such information is governed by Section 25 TDDDG (formerly Section 25 TTDSG).

3. Your Rights as a Data Subject

Under the GDPR, you have extensive rights against us as controller. We respond to your requests without undue delay in accordance with the legal requirements. In particular, you have:

  • the right of access to the data stored about you (Art. 15 GDPR);
  • the right to rectification of inaccurate or incomplete data (Art. 16 GDPR);
  • the right to erasure of your data ("right to be forgotten", Art. 17 GDPR);
  • the right to restriction of processing (Art. 18 GDPR);
  • the right to data portability (Art. 20 GDPR);
  • the right to object to processing (Art. 21 GDPR), in particular to processing based on Art. 6 (1) (f) GDPR and to processing for direct marketing purposes;
  • the right to withdraw consent at any time (Art. 7 (3) GDPR); withdrawal does not affect the lawfulness of processing based on consent before its withdrawal;
  • the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement.

Where processing is based on your consent, the requirements of Art. 7 GDPR apply, including proof of consent, intelligible form and the possibility to withdraw consent at any time. To exercise your rights, a simple message to the contact details listed in section 1 is sufficient.

4. Website Provision / Hosting

Alfahosting GmbH

This website is hosted by Alfahosting GmbH, Ankerstrasse 3b, 06108 Halle (Saale), Germany. When our website is accessed, technically necessary data is recorded in server log files and stored for a limited period. This includes in particular:

  • IP address of the requesting device, shortened or anonymized where technically possible
  • date and time of access
  • requested URL and transferred data volume
  • HTTP status code, referrer URL and user agent (browser, operating system)

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure and stable provision of the website). We have concluded a data processing agreement with the host under Art. 28 GDPR. The servers are located in Germany.

5. Tag Management and Audience Measurement

Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Tag Manager is used to manage website tags and does not itself perform user data analysis. However, it may establish a connection to Google servers and transmit the IP address and user agent. It is integrated only after your explicit consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). A transfer of data to the United States cannot be excluded; the transfer is based on the EU-US Data Privacy Framework and supplementary standard contractual clauses.

Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited. Google Analytics uses cookies and similar technologies to analyze the use of our website. Processed data may include a shortened IP address, device and browser information, referrer, access times and interactions with the website. Processing takes place only on the basis of your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Data may be transferred to Google servers in the United States; the transfer is based on the EU-US Data Privacy Framework and supplementary standard contractual clauses. You can withdraw your consent at any time via the cookie settings. Further information: policies.google.com/privacy.

PostHog (Audience Measurement & Session Replay)

We use PostHog to analyze website usage. The provider is PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. We use only PostHog's EU region with data storage in the European Union (Frankfurt am Main, Germany). We have concluded a data processing agreement with PostHog under Art. 28 GDPR. We operate PostHog in a hybrid model with two separate processing activities:

a) Anonymous audience measurement (server-side, without consent). Page views and conversion events, for example submitting the contact form, are recorded server-side. We do not use cookies and do not access information on your device (no local storage). Instead, we create a pseudonymous identifier that changes daily (one-way hash of IP address, browser identifier and date with a secret server-side key); your IP address is neither transmitted to PostHog nor stored there. For approximate regional classification, only a shortened network segment of the IP address, for example /24, is processed. No personal profiles are created. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in data-minimizing, anonymous audience measurement). Because no information is stored on or read from your device, consent under Section 25 TDDDG is not required. You may object to this processing under Art. 21 GDPR.

b) Session replay and heatmaps (client-side, only with consent). Only with your consent does PostHog record session replays in your browser, such as mouse movements, clicks and scrolling behavior, as well as heatmaps to identify usability issues and improve the offering. Inputs in form fields are automatically masked. No cookies and no persistent local storage are set; storage takes place only in the page's volatile memory. The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). You can withdraw your consent at any time with future effect via the cookie settings (Art. 7 (3) GDPR).

A transfer to third countries, in particular the United States for provider administration, may occur and is based on the EU-US Data Privacy Framework and standard contractual clauses. Further information: posthog.com/privacy.

YouTube (Embedded Videos)

We embed videos from the YouTube platform on individual pages. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Where technically available, we use YouTube's enhanced privacy mode ("no-cookie"), under which YouTube states that it stores information about website visitors only when they actively start a video. When a video is played, YouTube may set cookies and similar technologies and process data such as IP address, device and browser information, viewing time, videos played and, where applicable, account identifiers of logged-in YouTube users. Processing takes place only on the basis of your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Data may be transferred to the United States; the transfer is based on the EU-US Data Privacy Framework and standard contractual clauses. Further information: policies.google.com/privacy.

Meta Pixel (Facebook Pixel)

We use Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). The pixel can be used to track the behavior of visitors after they click on a Meta advertisement and are redirected to our website. Processed data may include IP address, browser and device information, pixel ID and interaction events. This processing takes place only on the basis of your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Joint controllership with Meta exists under Art. 26 GDPR. Data may be transferred to the United States; the transfer is based on the EU-US Data Privacy Framework and standard contractual clauses. Further information: facebook.com/privacy/policy.

6. Spam Protection - Google reCAPTCHA (Required)

To protect our forms against automated requests (bots), we use Google reCAPTCHA v3 provided by Google Ireland Limited. This may involve transmitting and evaluating data such as IP address, time spent on the website, mouse and keyboard input and browser and device information. reCAPTCHA is a strictly necessary technical protection measure to ensure the intended operation of our contact form and cannot be disabled. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in protection against abuse, spam and automated attacks) and Section 25 (2) No. 2 TDDDG, because access to device information is strictly necessary to provide the service expressly requested by the user (submission of the contact form). Data may be transferred to the United States and is based on the EU-US Data Privacy Framework and standard contractual clauses. Further information: policies.google.com/privacy.

7. Use of AI Services (LLM) in the Pre-Contractual Phase

When processing your contact inquiry and project idea, before the start of a paid engagement, we use large language model (LLM) services to record and classify your inquiry and prepare the initial conversation. Content provided by you, such as descriptions of your idea or uploaded documents, may be transmitted to the providers listed below. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures at your request) and Art. 6 (1) (f) GDPR (legitimate interest in efficient, AI-supported processing of inquiries). Data may be transferred to third countries, in particular the United States, based on the EU-US Data Privacy Framework and standard contractual clauses. We configure the services so that your inputs are not used to train the models where the respective provider offers this option.

After contract conclusion: As soon as a paid engagement is concluded and we process personal data within your customer project, this Privacy Policy no longer governs that processing. Instead, the data processing agreement (DPA / AVV) to be concluded with you under Art. 28 GDPR applies. Please also see our Terms (section 2) and the separate DPA.

Claude (Anthropic)

Provider: Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA. Processed data: inputs transmitted to the model (prompts, document contents, code), API usage metadata. Privacy information: anthropic.com/legal/privacy.

Gemini (Google)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for EU users), or Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Processed data: inputs transmitted to the model, API usage metadata. Privacy information: policies.google.com/privacy.

ChatGPT (OpenAI)

Provider: OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, or OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA. Processed data: inputs transmitted to the model (prompts, document contents, code), API usage metadata. Privacy information: openai.com/policies/privacy-policy.

Please do not transmit special categories of personal data (Art. 9 GDPR) or third-party secrets via our forms and uploads unless this is expressly necessary and agreed with us.

8. Contact and Inquiry Form

When you use our contact form, we process the data you provide, in particular name, email address, free text about your idea and uploaded files, to handle your inquiry and initiate a potential contract. The legal basis is Art. 6 (1) (b) GDPR or Art. 6 (1) (f) GDPR. The data is deleted once it is no longer required for the purpose and no statutory retention obligations prevent deletion.

9. Storage of Inquiries - Supabase (CRM)

We store the content submitted via our contact and inquiry form in a database in order to process your inquiry and manage the customer relationship (CRM). The provider of this database infrastructure is Supabase, Inc., 970 Toa Payoh North #07-04, Singapore. Storage is performed server-side by our server; your browser does not establish a connection to Supabase. Processed data includes in particular name, email address, free text about your idea, the selected language and the descriptions you entered for uploaded files. The file contents themselves are not stored in the database; they are transmitted only by email. We also store email correspondence with you via our project mailbox (onboarding@aiream.dev), inbound and outbound, including subject, message text, sender and recipient addresses and timestamps, in order to process and document the inquiry and business relationship. In addition, we process technical metadata (IP address, user agent, timestamp) for spam prevention and handling the inquiry.

The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures at your request) and Art. 6 (1) (f) GDPR (legitimate interest in processing and documenting inquiries). We have concluded a data processing agreement with the provider under Art. 28 GDPR. Because Supabase, Inc. is a company outside the EU (USA / third country), data may be transferred to a third country; the transfer is based on the EU-US Data Privacy Framework and supplementary standard contractual clauses. Further information: supabase.com/privacy.

10. Cookies and Consent Management

Storage of information on your device and access to such information is governed by Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act, formerly Section 25 TTDSG). Technically necessary cookies, for example to store your theme or language choice, are set without consent on the basis of Section 25 (2) No. 2 TDDDG. All other cookies and comparable technologies (analytics, marketing) are used only after your consent under Section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR. You may withdraw your consent at any time with future effect (Art. 7 (3) GDPR).

11. Security of Processing

We implement appropriate technical and organizational measures (TOMs) to ensure a level of protection appropriate to the risk for your personal data (Art. 32 GDPR). These include in particular:

  • transport encryption of all data transmissions via this website using SSL/TLS (HTTPS);
  • access and permission concepts as well as authentication for internal systems;
  • regular updating of the software used and protection against unauthorized access, loss or alteration;
  • pseudonymization and data minimization where appropriate for the respective purpose.

Where we use external service providers that process personal data on our behalf, we conclude data processing agreements under Art. 28 GDPR and require them to maintain an appropriate level of data protection.

12. Changes to this Privacy Policy

We update this Privacy Policy when the legal situation or our processing activities change. The current version is always available on this page.