Privacy policy

1. Controller

Mirai International Operations OÜ
Sepapaja tn 6
15551 Tallinn
Estonia
Email: Show email address

Represented by Jonas Hartmann, member of the management board (juhatuse liige). For any questions about data protection, you can reach us at the email address above.

2. Summary

• This website sets no cookies and uses no analytics or tracking tools. It only loads JavaScript for the spam protection Cloudflare Turnstile, and only on the contact form and when showing our email address (section 6).
• Apart from this spam protection, no third-party content is embedded. We serve the font ourselves; no data is transferred to Google or other font providers.
• The contact form sends your entries directly to our customer portal. We use them only to handle your request. This website has no form for cancelling contracts.
• On most pages, we only show our email address after a short security check so that spam bots cannot harvest it. It is shown directly in the imprint and in the legal texts.
• The server of this website fetches the descriptions and prices of our plans from the customer portal. No data about you is transferred in the process.
• With Intelligence, the customer portal sends your chat messages to AI models on Cloudflare; details in section 10.
• Links to other services (such as the customer portal or Cal.com) only transfer data to these services once you click them.

3. Provision of the website

The website is delivered via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit it, Cloudflare processes technically necessary data: IP address, date and time, the address requested, the amount of data transferred, browser and operating system information and the previously visited page. This is necessary to deliver the site and to protect it against attacks.

The legal basis is our legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses also apply. We ourselves do not store any access logs of this website; for the logs of the customer portal, see section 8.

4. Contact by email

When you write to us, we process your details to handle your enquiry (Art. 6(1)(b) GDPR for enquiries about contracts, otherwise point (f)). Our mailboxes are operated by ALL-INKL.COM - Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, as our processor. We delete messages once they have been dealt with, unless statutory retention obligations prevent this.

5. Contact form, cancellations and withdrawals

The contact form sends your entries directly to our customer portal at dashboard.mein-hartmann.de. The customer portal also runs on Cloudflare; it stores the entries in its database, assigns a reference number and notifies us by email. Before sending, Cloudflare Turnstile checks that the request comes from a human (section 6).

Which data

Name, email address, subject (optional) and message, as well as the language of the page and the date and time of receipt. The result of the Turnstile check (a token) is also sent to the customer portal with the form, which has it confirmed by Cloudflare.

Purpose and legal basis

We use the details only to answer your enquiry. The legal bases are Art. 6(1)(b) GDPR for enquiries about contracts and pre-contractual enquiries and otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). The customer portal’s emails are sent via Cloudflare’s email service.

Protection against misuse

To prevent anyone from misusing the form on a large scale, the customer portal counts for a short time (currently 15 minutes) how many forms are sent from the same IP address. The IP address is not stored together with your enquiry. The legal basis is our legitimate interest in a functioning form (Art. 6(1)(f) GDPR).

Cancellations and withdrawals

This website has no form for cancelling contracts; the cancellation page (Kündigung, German) only provides a template to copy. We process cancellations and withdrawals that you send us by email, in the customer portal or by letter in order to end or unwind the contract and to confirm receipt to you (Art. 6(1)(b) and (c) GDPR). We also keep them as proof (Art. 6(1)(f) GDPR; our legitimate interest is being able to prove that the contract has ended and what you declared). For cancellations by email, section 4 also applies.

If you declare a cancellation or withdrawal in the customer portal, we store the date and time of receipt, the wording of the declaration and the IP address it was sent from as proof. When you order a cloud server, we store your confirmations (terms, your responsibility as operator, immediate start) in the same way, with their wording, the time and the IP address.

Storage period

After they have been dealt with, we keep contact enquiries for follow-up questions for a maximum of three years and then delete them, unless there is a statutory retention obligation. We keep cancellations, withdrawals and the confirmations given when ordering a cloud server as proof until three years after the end of the year in which the contract ended, and beyond that only where statutory retention obligations require it.

6. Spam protection with Cloudflare Turnstile

To prevent programs (bots) from misusing our contact form and our email address, we use Cloudflare Turnstile on this website; the same check protects the link to our booking calendar. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile is only loaded on pages that contain the contact form, a “Show email address” link or a link to book an appointment.

How the check works

• Contact form: the check runs before sending. The result (a short-lived token) is sent to our customer portal together with the form; the customer portal has it confirmed by Cloudflare and only then accepts the message.
• Show email address: the check only starts when you click “Show email address”. Your browser then sends the token to our customer portal at dashboard.mein-hartmann.de; the customer portal has it confirmed by Cloudflare and returns the address. To prevent misuse, the customer portal limits how often the address can be retrieved within a short time.
• Book an appointment: the same applies to the links to our booking calendar (Cal.com): the check starts when you click one of them, and only then does the customer portal return the link. Data is only transferred to Cal.com when you open the calendar (see section “Appointment booking”).

For this, your browser loads a script and a small check field from challenges.cloudflare.com. Usually no click is needed; sometimes Turnstile asks you to tick a box.

Which data

Cloudflare processes your IP address, browser and device information (such as the type and version of your browser and operating system and language settings) and interaction signals (indications of whether the page is being used by a human). We ourselves only receive the result of the check. Cloudflare processes the data on our behalf and, according to its own information, partly also under its own responsibility in order to improve the detection of automated access.

Purpose and legal basis

The purpose is protection against automated requests and spam. The legal basis is our legitimate interest in protecting the contact form and our email address against misuse by bots (Art. 6(1)(f) GDPR). Reading the information required for this from your device is permitted without consent under Section 25(2) no. 2 of the German TDDDG, because it is strictly necessary for us to securely provide the service you have expressly requested (sending the form, showing the address or the booking link). The customer portal limits how often the address can be requested within a short time based on the IP address; this count is deleted after 15 minutes at the latest.

No cookies for advertising purposes

According to Cloudflare, Turnstile does not set any cookies for advertising purposes, and according to its own information Cloudflare does not use the data for advertising or to track you across websites.

Transfer to the USA

Cloudflare, Inc. is based in the USA. The transfer is based on the EU-US Data Privacy Framework, under which Cloudflare is certified (adequacy decision of the European Commission, Art. 45 GDPR); see also section 13.

Without JavaScript

Without JavaScript, Turnstile cannot run the check. In that case, the customer portal does not accept the contact form, and neither the email address nor the booking link is shown; you can always reach us by post at the address in our imprint.

More information: Cloudflare’s privacy policy and Turnstile privacy addendum.

7. Ordering and customer account

“Order now” takes you to the order page in our customer portal at dashboard.mein-hartmann.de. There you create a customer account or log in; you then continue to payment with Stripe.

Customer account

For the account we store your name, email address, a password (only as a salted hash, not in plain text) and whether you have confirmed your email address. In the account we manage your contracts, invoices and, where applicable, cloud servers. For logging in, the portal sets a technically necessary session cookie. Without this information we cannot conclude a contract with you. The legal basis is Art. 6(1)(b) GDPR.

Security log

To protect your account, we record logins, sign-up, the confirmation of your email address, changes to and resets of your password, requests for new confirmation or reset links, passkeys you add or remove, and payment methods you add, change or remove, each with the time and the IP address the request came from. This lets us detect and investigate misuse of your account. We delete the IP address after 90 days; we keep the entry without the IP address for the duration of the customer relationship. The legal basis is our legitimate interest in protecting customer accounts against unauthorised access (Art. 6(1)(f) GDPR).

Protection against automated requests (Cloudflare Turnstile)

To protect against automated requests, we use Cloudflare Turnstile on the order page and for sign-up and login (provider: Cloudflare, Inc.; see also section 6). Turnstile uses technical characteristics of your browser and your connection (including IP address and browser identifier) to check whether the request comes from a human. According to Cloudflare, Turnstile does not set any cookies for this. Cloudflare processes this data on our behalf and, according to its own information, partly also under its own responsibility in order to improve the detection of automated access. The legal basis is our legitimate interest in protecting accounts and orders against misuse (Art. 6(1)(f) GDPR).

Record of your order

When you start an order, we store your confirmations (terms and, if you request it, the start before the withdrawal period ends) with the time and the IP address as proof. The legal basis is our legitimate interest in being able to prove the conclusion of the contract and your declarations (Art. 6(1)(f) GDPR); for the storage period see section 14.

Payment with Stripe

Payment is processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, via Stripe Checkout. There you enter your billing address and payment details. Stripe Tax calculates the VAT based on your address. We receive your name, email address, address and payment information from Stripe, but not full card or account details. Stripe processes payment data partly under its own responsibility, for example for fraud prevention and to meet legal obligations; Stripe’s privacy policy applies to this. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and, for invoices and bookkeeping, our statutory retention obligations (Art. 6(1)(c) GDPR).

8. Customer portal and the content of your services

Log in and Sign up also lead to the customer portal. The processing required there (account, contracts, invoices, support requests, cloud servers, Intelligence) is carried out to perform the contract (Art. 6(1)(b) GDPR). We send the portal’s emails, for example to confirm your email address, via Cloudflare’s email service.

We process content that you store in your services (websites, emails, files in the cloud, data on cloud servers) only to provide these services. If you are a business and store personal data of third parties there, we process it on your behalf under our data processing agreement (Auftragsverarbeitungsvertrag, German). Locations: Web hosting and email on servers in Germany, with daily backups and spam protection. Sovereign Cloud (Nextcloud) on a server in Germany with daily backups. Cloud servers in ISO/IEC 27001 certified data centres in Falkenstein and Nuremberg (Germany) and Helsinki (Finland).

Passkeys

In the customer portal you can also log in with a passkey instead of your password. A passkey is a key pair created by your device or password manager (such as iCloud Keychain, Google Password Manager or Windows Hello). We store only the public key, the passkey’s ID, a random identifier for your account (also stored on the device), the passkey’s name (initially the provider or the date, which you can change), when it was added and last used for a login, whether it is synced between your devices, and technical details from the device (a login counter, the transport types and the model identifier). We never receive the private key, your biometric data (face, fingerprint) or your device PIN; this check takes place only on your device. If you remove a passkey in the settings, we delete it immediately; all passkeys are deleted together with your customer account. We keep the random identifier for your account, which says nothing about you on its own, until your customer account is deleted, even if you remove all passkeys; this way, a device on which you set up a passkey again replaces its old one instead of creating a second. We record adding and removing passkeys in the security log (section 7) and confirm it to you by email; the message about a new passkey also shows the IP address and, roughly, the browser of the request, so you can tell whether it was you. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Console of cloud servers

If you open the console of a cloud server in the customer portal (“Konsole öffnen”, open console), your browser connects directly to the console at the data centre operator (processor, see “Recipients”). The operator receives your IP address and transmits the screen and your input between your browser and the server; the customer portal does not relay this connection and stores neither the screen nor your input. We record every access to the console as proof, with the time, the server and the IP address. If our support opens the console (only in the cases of Section 10(3) of the AGB), we also record the reason given, and you can see the access in the server’s activity. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and, for the record, our legitimate interest in being able to trace and prove access to servers (Art. 6(1)(f) GDPR).

System log

For operation and troubleshooting, we store technical events of the customer portal (e.g. failed payment or email processes, disruptions of connected services, results of automated processes) in a system log. We store the time, type and origin of the event, a technical message, technical identifiers of the process (e.g. payment, invoice or order IDs, amounts) and shortened recipient addresses (e.g. m***@example.com), and, where the event relates to a customer account, its internal ID, and, where it arose during a request, the request ID (which links the entry to the technical logs at Cloudflare). Passwords, access keys, tokens and card numbers are removed before storage; we do not store the subject lines or contents of emails. Only our administrators have access; in the case of serious or repeated errors, they also receive the message by email. Entries in the system log are deleted automatically after 90 days.

Technical logs at Cloudflare

In addition, Cloudflare (section 3) stores technical messages of the customer portal (Workers Logs), such as error messages, each with the time and information about the request during which they arose (e.g. the address requested). The messages may contain technical identifiers of the process concerned (e.g. account, contract, payment or order IDs). No log of every individual request, for example with the IP address, is kept there. Cloudflare processes these logs as our processor and deletes them after 7 days.

The legal basis for the system log and the technical logs is our legitimate interest in the secure and error-free operation of the customer portal (Art. 6(1)(f) GDPR).

9. Plans and prices on this website

The server of this website fetches the descriptions and prices of our plans directly from the customer portal and builds them into the page. Your browser does not connect to any other service for this, and no data about you is transmitted to the customer portal.

10. Intelligence (AI chat in the customer portal)

What we process

When you use Intelligence, we process your inputs, the models’ answers, the titles of your conversations, the model you choose and your settings. For billing, we store the time, model, number of tokens and amount of each request, but no content. When you activate Intelligence, we store your confirmations (terms and prices, your responsibility for inputs and answers, immediate start) with their wording, the time and the IP address as proof.

How the processing works

To get an answer, the customer portal sends your message together with the conversation so far to Cloudflare Workers AI (Cloudflare, Inc.), where the chosen model processes it. Cloudflare acts as our processor. According to Cloudflare, inputs and outputs are not used to train models, not made available to other customers and not stored by Workers AI. The model makers receive no data. The place of processing is not limited to the EU; it can be in any Cloudflare data centre, including in the USA (section 13). The customer portal stores your conversations in its database at Cloudflare (primary location Western Europe).

Purpose and legal basis

Providing the chat and billing (Art. 6(1)(b) GDPR); keeping the billing data (Art. 6(1)(c) GDPR); limiting requests to protect against misuse and keeping proof of your confirmations at activation (Art. 6(1)(f) GDPR; our legitimate interest is secure operation and being able to prove the conclusion of the contract).

Storage period

Conversations until you delete them, at the latest after the period without activity you choose (1, 7, 30, 90 or 365 days; default 90 days), and 14 days after the end of the contract; beyond 1,000 conversations per customer, we automatically delete the oldest ones. Usage data without content for as long as invoices and accounting records; the confirmations given at activation like cancellations and withdrawals (section 14).

Notes

Do not enter special categories of personal data (such as health data), passwords or payment details. Answers are generated automatically; you are chatting with an AI. We do not make automated decisions about you within the meaning of Art. 22 GDPR with Intelligence. If, as a business, you store personal data of third parties in conversations, our data processing agreement (AVV, German) applies.

11. Appointment booking

For consultations we link to Cal.com (Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA); we show the link after the spam check described in section 6. Only when you book an appointment there does Cal.com process the data you enter (e.g. name, email address, preferred time) on our behalf. The legal basis is Art. 6(1)(b) GDPR. Cal.com’s privacy policy also applies.

12. Recipients

Your data is only received by the service providers we need for the respective purpose:

• Cloudflare, Inc.: delivery of this website, operation of the customer portal including its database and technical logs, sending the customer portal’s emails, Turnstile on this website (contact form, showing the email address) and in the customer portal, execution of the AI models for Intelligence (Workers AI) (processor; for Turnstile partly under its own responsibility).
• Stripe Payments Europe, Ltd.: payment processing and calculation of VAT (partly under its own responsibility).
• ALL-INKL.COM - Neue Medien Münnich: our mailboxes (processor).
• Cal.com, Inc.: appointment booking, only if you book an appointment (processor).
• Hosting service providers in Germany and Finland: data centres and servers on which the services you have booked run (processors).

Beyond that, we only pass on data if we are legally obliged to do so, for example to authorities.

13. Transfers to third countries

Some service providers are based in the USA or use facilities there:

• Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses also apply. This also covers the execution of the AI models for Intelligence, which may take place outside the EU (section 10).
• Stripe transfers data to Stripe, Inc. in the USA. According to its own information, Stripe complies with the EU-US Data Privacy Framework and also uses the EU Standard Contractual Clauses.
• Cal.com, Inc., according to its own information, bases transfers from the EU on the EU Standard Contractual Clauses.

Transfers based on the Data Privacy Framework are covered by the European Commission’s adequacy decision (Art. 45 GDPR); all other transfers by the Standard Contractual Clauses (Art. 46(2)(c) GDPR).

14. Storage period

We only store data for as long as we need it for the respective purpose or are legally required to keep it:

• Customer account and contracts: for the duration of the customer relationship; after that we delete them unless there is a retention obligation.
• Invoices and accounting records: for as long as commercial and tax law requires (up to ten years).
• Contact enquiries: at most three years after they have been dealt with.
• Cancellations, withdrawals and confirmations when ordering a cloud server or activating Intelligence (with time and IP address): three years from the end of the year in which the contract ended.
• Confirmations when starting an order for other products (with time and IP address): three years from the end of the year in which the contract ended.
• Access to the console of a cloud server (with time, server and IP address; for our support also the reason): three years from the end of the year in which the contract for the server ended.
• Security log of the customer account (logins and account changes, section 7): the IP address for 90 days, the entry without the IP address for the duration of the customer relationship.
• Intelligence conversations: until you delete them, at the latest after the period without activity you choose (default 90 days), and 14 days after the end of the contract; beyond 1,000 conversations per customer, the oldest ones.
• Intelligence usage data (without content): like invoices and accounting records.
• Emails to us: until they have been dealt with, unless there is a retention obligation.
• Counting for the contact form’s protection against misuse: currently 15 minutes.
• System log of the customer portal: 90 days.
• Technical logs of the customer portal at Cloudflare (Workers Logs): 7 days.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). Simply write to Show email address.

We do not make any decisions based solely on automated processing within the meaning of Art. 22 GDPR.

You can also lodge a complaint with a data protection supervisory authority, for example where you live or with the Estonian data protection authority responsible for us (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia).