Privacy policy

1. Controller

The controller for this website is: Andreas David, Muldstr. 88, 06844 Dessau, Germany. Email: info@aidataveil.eu, phone: +49 340 50248986.

When customers have texts veiled through the API, we act as processor (see section 8); the customer is then the controller.

2. Hosting and server logs

The website and the API run on a virtual server of IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany (processor) in a data centre in Spain (European Union). A data processing agreement under Art. 28 GDPR is in place.

When you open our pages, your IP address is processed as technically necessary to establish the connection (Art. 6(1)(f) GDPR, operation and security). Our upstream web server keeps no access logs. The backend logs requests technically (time, requested address, status code, browser identifier) but without your IP address. All technical logs are kept short (at most three files of 10 MB per service; older ones are overwritten).

3. Veiling on the website

The text (up to 2,000 characters) you have veiled on the website is processed in memory only and is not stored. The result goes straight back to your browser.

• We store only counters without personal reference: per day and size class the number of requests, characters, tokens and the computing time.
• To prevent abuse we limit the number of requests per minute. For that we store a check value of your IP address that cannot be reversed (SHA-256 with a secret key, no plain IP address) and delete it after about 70 minutes (Art. 6(1)(f) GDPR).

4. Reporting missed words

If you report a missed word, we store only the word, the type you chose (e.g. person, place), the language and the number of reports, never the text and no IP address. We review the report and may add the word to our general list (Art. 6(1)(f) GDPR, improving the service). Please do not report real names or other personal data.

5. Storage in your browser

We store nothing in your browser. The language is part of the page address; the light/dark display follows your system setting, and switching it only lasts until you reload the page. There are no tracking cookies and no persistent local storage. For navigation (back button, scroll position) the page framework keeps technically necessary entries in your tab’s session storage; they contain no personal data and disappear when you close the tab. The only other exception is the technically necessary session cookie we set after you sign in (section 6).

6. Account and sign-in

An account needs only your email address; there is no password. We send you a code that you enter (Art. 6(1)(b) GDPR, contract or pre-contractual steps).

• Stored: email address, time of creation and last sign-in, your role in the account and, if you wish, name, company, billing address and VAT ID, plus your notification settings.
• Sign-in codes are valid for 10 minutes, can be used once and are stored only as check values.
• The session cookie veil_session (HttpOnly, Secure, SameSite) is valid for 14 days and compared with a check value; it serves only to keep you signed in.
• Accounts that were never confirmed are deleted after 7 days, open invitations after 14 days.
• You can delete your profile in the settings at any time. This deletes your sign-in data; if you are the last person in an account, its keys, rule sets and counters are deleted too.

7. Emails

We send emails only when the service needs them: sign-in codes, confirmation of a new email address, invitations to an account and, if you switch it on in your profile, notices about the use of your quota. Emails are sent through the email service of our hosting provider. The sender mailbox is emptied automatically every day; messages stay there for about one calendar day at most.

8. API and processing on behalf of customers

When customers have texts veiled through the API, we process them on the customer’s behalf under Art. 28 GDPR and a data processing agreement. In this case:

• Requests answered immediately are processed in memory. The text is not stored.
• We store counters per account (requests, characters, tokens, per month and day) for billing, limits and forecasts, and keys only as a check value with a short prefix.
• Rule sets (terms, fields, patterns) are stored by the customer in its own account. They may contain personal data for which the customer is responsible, and are deleted when the customer deletes them or the account.
• Longer texts are processed in the background. The text is stored encrypted (AES-256-GCM) and deleted right after processing. The result stays encrypted until the customer has fetched and confirmed it, at most 24 hours (60 minutes after the last block was fetched). This data is excluded from backups.
• Sample texts customers use in the field assistant or in the test of a rule set are processed only transiently and not stored.

9. Billing

Billing is by tokens. For invoices we use the details from the account profile (Art. 6(1)(b) and (c) GDPR). We keep invoice data as long as commercial and tax law requires (currently up to ten years). No payment service provider is connected at present; we will update this policy when that changes.

10. Backups

The database is backed up daily; backups are kept for 14 days and then deleted. Background jobs (section 8) are not included. Backups are also stored within the EU.

11. Recipients and third countries

Recipients are only our processors: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany (hosting and email delivery). We do not transfer personal data to countries outside the EU/EEA. There is no automated decision-making within the meaning of Art. 22 GDPR.

12. Security

Transmission is encrypted with TLS. We restrict access by role, store keys and codes only as check values and keep stored texts as short and as encrypted as possible.

13. Your rights

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).
• Objection to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future.
• Complaint to a supervisory authority (Art. 77), e.g.: Landesbeauftragter für den Datenschutz Sachsen-Anhalt, Leiterstraße 9, 39104 Magdeburg.

To exercise your rights, write to info@aidataveil.eu.

14. Changes

We update this policy when the service changes. The version published here applies.