Privacy Policy

1. Controller

The party responsible for data processing on this website is:

Creaminds GmbH
Lappischweg 6
93142 Maxhütte-Haidhof
Germany
Represented by: Dr. Martin Theis
Email: admin@creaminds.de

2. Data Protection Officer

Creaminds GmbH has not appointed a data protection officer because the requirements of Art. 37 GDPR and § 38 BDSG are not met (fewer than 20 people permanently engaged in automated processing, no processing of special categories of data as a core activity, no high-risk processing requiring a data protection impact assessment).

For data protection inquiries, please contact us at the address listed in section 1.

3. What data we collect

We collect as little personal data as possible. Specifically:

• Server logs (technically required): IP address, browser, date/time, requested page. Storage up to 7 days, legal basis Art. 6 (1) f GDPR (legitimate interest in operating the website).
• Reach measurement with Plausible Analytics: cookieless, anonymized (no cross-page tracking, no personal profiles). Only page views and referrers are recorded in aggregate. Legal basis Art. 6 (1)(f) GDPR; our legitimate interest lies in improving the website content and measuring the success of our public communications. No profiling or cross-page tracking takes place. Retention: aggregated analytics remain at Plausible for as long as we use the tool. Because Plausible uses a daily-rotating pseudonymous hash (derived from IP + user agent) that is discarded at the end of each session, no personal data persists beyond the session itself.
• Agent chat input: Your message to the agent is transmitted to our backend and processed there to generate a response for you. The conversation content is not persisted. After processing your inquiry, no personal conversation data remains. Within your browser session the conversation is cached locally in your browser (sessionStorage) for display and is automatically deleted when the tab is closed; it leaves your device only as context of the respective request.

Voluntariness of data provision: Use of the website is voluntary. Server logs are technically unavoidable — without them the website could not be delivered. Reach measurement (Plausible) and the agent chat are functional convenience layers that you are not required to use. Beyond the technically unavoidable server logs, no disadvantages arise from not providing further data — you can read the website content without restriction.

No automated decision-making: We do not make decisions with legal or similarly significant effects based solely on automated processing (Art. 22 GDPR). The language model used by the agent chat generates text-based responses; it does not score, sort, or reject anything with consequences for you.

4. Who has access

Processors:

• Hosting: Google Cloud Platform (Cloud Run, EU location). Data processing agreement in place.
• Reach measurement: Plausible Insights B.V., Netherlands. EU hosting, no data transfer to third countries.
• Language model for agent chat: Requests are forwarded via our concierge service to Google Vertex AI (region europe-west1, Belgium — processing within the EU). Models used: gemini-2.5-flash for response generation and text-embedding-005 for knowledge-base search. Google is certified under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023). A data processing agreement is in place with Google (Google Cloud Data Processing and Security Terms). According to Google's contractual commitments, customer input in Vertex AI is not used to train the models. Conversation content is not persisted after response generation. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in providing a chat assistant).

5. Cookies

This website does not set tracking cookies or advertising cookies. Only technically necessary session data is used, which expires when the browser is closed. Because access to such strictly necessary information is permitted without consent under § 25 (2) No. 2 TDDDG (German Telecommunications-Digital-Services Privacy Act), no cookie banner is shown.

6. Your rights

You have the following rights against us regarding the personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification or erasure (Art. 16 and 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

The supervisory authority responsible for Creaminds GmbH is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de. Alternatively, you may contact the supervisory authority of your federal state of residence.

Note on the right to withdraw consent and to object: Our processing is based exclusively on legitimate interest (Art. 6 (1)(f) GDPR). The right to withdraw consent (Art. 7 (3) GDPR) is not applicable since we do not collect consent. You may object to the processing at any time pursuant to Art. 21 GDPR. Practical effect by data category:

• Server logs are technically unavoidable for delivering the website. An effective objection is therefore only possible by not using the website.
• You can prevent the Plausible reach measurement by blocking the analytics script — for example via a content blocker (such as uBlock Origin) or your browser's tracking-protection settings. Plausible works without cookies and without personal profiles; when the script is blocked, no measurement data is collected.
• The agent chat can simply be left unused — no processing takes place without input.

For information or requests, please contact our data protection contact above.

7. SSL/TLS encryption

This website uses SSL/TLS encryption (recognizable by "https" in the address bar and the lock icon). Data transmission between your browser and our server is encrypted.