Privacy policy

Controller

The controller responsible for processing your data within the meaning of the General Data Protection Regulation (GDPR) is:

Webcodic
Owner: Kevin Blecha
Sauerweg 7
70563 Stuttgart
Email: hello@webcodic.de
Phone: +49 151 401 803 27

Hosting and visiting the website

These pages are delivered via the platform of Cloudflare (Cloudflare, Inc., USA). With every request, Cloudflare processes technically necessary access data: your IP address, date and time, the requested address, technical information from your browser (e.g. user agent) and information derived from it such as the approximate country. The purpose is to deliver the pages, operate them securely and fend off attacks and abuse.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and functional provision of the pages.

For the server functions of this website (AI assistant, forwarding to Kevin, contact form), logs at Cloudflare (Workers Logs) are enabled. They contain technical information about these requests. Our code does not write questions, messages, names or email addresses to these logs, only error messages and metrics (e.g. the similarity score when matching frequently asked questions, or the language model's usage).

Cloudflare keeps these logs for 7 days.

We have concluded a data processing agreement with Cloudflare pursuant to Art. 28 GDPR.

For transfers to third countries, see Third countries.

Cookies, browser storage and analytics

According to our code, this website does not set cookies and does not store anything in your browser's local or session storage. We do not use any tools for audience measurement, analytics or advertising. We serve fonts, images and videos ourselves; no content is loaded from third-party servers when you visit the pages.

According to our configuration, Cloudflare does not set cookies either.

Links to other services (e.g. WhatsApp, Google Business Profile, social networks) are plain links. Only when you click such a link do you leave this website; the privacy notices of the respective provider apply there.

Contact by email or phone

If you contact us by email or phone, we process your details (e.g. name, email address, phone number and the content of your message) in order to handle and answer your enquiry.

We receive and send emails via Google Workspace (Gmail) from Google (Google Cloud EMEA Limited, Dublin, Irland).

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry is aimed at concluding a contract. In other cases, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is answering enquiries.

For storage periods, see Storage period.

Contact form

You can send us a message using the form on the contact page. Name, email address and message are required; the subject is optional. The language of the page is also transmitted.

If you reached the website via a link with a campaign tag (parameters such as utm_source in the address), the website adds these tags to its links and sends them with the form; we note them with the entry to evaluate through which channels enquiries reach us. Nothing is stored in your browser for this. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in focusing our advertising on effective channels).

Your details are sent to our server at Cloudflare and from there to our internal management system (Business OS). There we store them as an entry in our inbox; the database is operated by Supabase (Supabase Pte. Ltd., Singapur) in Frankfurt am Main, Germany (region eu-central-1). A push notification on our own devices with up to the first 120 characters of the subject or message informs us of the new entry (see Recipients). We use the details to reply to you by email.

To protect against abuse, we limit the number of requests per visitor. For this we derive a shortened checksum (SHA-256) from your IP address and do not store the address itself. The checksum is pseudonymous, not anonymous: anyone who knows your IP address can match it to the same checksum. The per-minute limit is handled by Cloudflare (rate limiting). The daily counters are kept in storage at Cloudflare (Durable Object); they are deleted as soon as the next request arrives after a new day (UTC) has begun. Until then, the previous day's counters remain stored.

The legal basis is Art. 6(1)(b) GDPR insofar as your message is aimed at concluding a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). For abuse protection, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure form that is not misused).

Website self-check

In the website check (self-check) you answer a few questions about your online presence. If you want the detailed evaluation, you enter your name and email address so that we can send it to you. Industry, location, your website address, company and phone number as well as a callback request are optional. The details go via our server at Cloudflare to our management system (Business OS), which calculates the assessment.

If you enter a website address, our system fetches the home page right away and has it measured by the Google PageSpeed Insights service of Google Ireland Limited (speed and mobile view). Google receives the website address, no details about you. The measurement and score you see before entering your email address are calculated by our system without storing them; data is only stored once you request the evaluation by email.

We create a prospect record in our management system, note the answers and result, and send you the evaluation by email via Google Workspace (Gmail). The email contains a personal link to the result page that is valid for 90 days; we can see whether and how often the page was opened. A push notification informs us about new self-checks. We delete the stored answers and the result automatically after 6 months; the prospect record follows the same rules as enquiries without an order.

If you request the detailed analysis on the result page, we look up your business by company name and location in Google and Google Maps via the DataForSEO service and retrieve publicly visible information (business profile, number and average of reviews without reviewers' names or texts, ranking in your area, three competitors). We send you the report by email as a link that is valid for 30 days.

We only send marketing emails (occasional tips and offers) if you tick the box for this and then confirm via the button in the email. For this we store your email address, the text shown, and the time of the request and of the confirmation. You can withdraw your consent at any time via the link in every email or by writing to us; we record the withdrawal so that we do not contact your address again and delete this record 3 years later. Unconfirmed requests are deleted after 30 days.

To see at which point visitors leave the self-check, we count per day how often each step was shown. Nothing about you is stored, only the total.

To protect against abuse, we limit the number of requests per visitor. For this we derive a shortened checksum (SHA-256) from your IP address and do not store the address itself. The checksum is pseudonymous, not anonymous: anyone who knows your IP address can match it to the same checksum. The per-minute limit is handled by Cloudflare (rate limiting). The daily counters are kept in storage at Cloudflare (Durable Object); they are deleted as soon as the next request arrives after a new day (UTC) has begun. Until then, the previous day's counters remain stored.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request: evaluation, callback, analysis); for measuring the website, counting the steps and abuse protection Art. 6(1)(f) GDPR (legitimate interest in a meaningful assessment, an understandable process and a service that is not misused); for marketing emails your consent under Art. 6(1)(a) GDPR and § 7(2) no. 2 UWG; for keeping proof of consent and withdrawal Art. 6(1)(c) and (f) GDPR.

AI assistant

Our AI assistant answers questions about Webcodic. When you send a message, your question and a limited conversation history (at most the last eight messages) are transmitted to our server at Cloudflare. To answer, we use Cloudflare Workers AI. Depending on the request, an AI model is used to generate the answer (Llama 3.3 70B) or to match it against prepared answers (embedding model bge-m3). If your question matches a prepared question word for word, no model is used. The answers are based on the content of this website.

The history in our chat interface is kept in the working memory of the open page and is gone when you reload or close the page. During normal chat use, it is not stored as an enquiry in our management system. If you choose to forward your question to Kevin, we store an excerpt for personal handling (see Question to Kevin). Technical security data is processed independently of this (see below and Hosting).

Cloudflare states that it does not use Workers AI inputs and outputs to train AI models or to improve its own or third-party services unless it has received explicit consent (Cloudflare's information, retrieved 2026-10-13). This is not a promise that no data whatsoever is stored.

To protect against abuse, we limit the number of requests per visitor. For this we derive a shortened checksum (SHA-256) from your IP address and do not store the address itself. The checksum is pseudonymous, not anonymous: anyone who knows your IP address can match it to the same checksum. The per-minute limit is handled by Cloudflare (rate limiting). The daily counters are kept in storage at Cloudflare (Durable Object); they are deleted as soon as the next request arrives after a new day (UTC) has begun. Until then, the previous day's counters remain stored. Questions answered with a prepared answer do not count towards the daily limit.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is answering questions about our services quickly and protecting the service from abuse. Please do not enter personal or confidential data in the chat.

Question to Kevin

If you send your question to Kevin, we transmit your question, your email address, your optional name and the last up to six chat messages to our internal management system. There the details are stored for handling your enquiry. Kevin uses them to reply to you personally.

Question and email address are required. An entry is stored in our inbox (database at Supabase (Supabase Pte. Ltd., Singapur) in Frankfurt am Main, Germany (region eu-central-1)). A push notification on our own devices with up to the first 120 characters of your question informs us of the new entry. The number of forwarded questions per visitor and day is limited; the checksum described under AI assistant is used for this.

The legal basis is Art. 6(1)(b) GDPR insofar as your question is aimed at concluding a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

WhatsApp

This website links to WhatsApp. The link is a plain link; no data is transferred to WhatsApp when you visit the website. Only when you open the link does WhatsApp Ireland Limited process your data under its own terms; transfers to third countries, in particular the USA, are possible.

If you write to us on WhatsApp, we process your phone number, profile name and messages in order to reply to you there. We do not use an automated bot for this. The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry is aimed at a contract, otherwise Art. 6(1)(f) GDPR. If you do not want this, please use email, phone or the contact form.

Booking an appointment

For an intro call, we link to our own booking page termin.webcodic.de. What happens to your data there is described in the privacy policy of the booking page.

Recipients and service providers

Your data is only received by the service providers we use for the purposes described:

• Cloudflare (Cloudflare, Inc., USA) (processor): delivery of the website, server functions, Workers AI, abuse protection and logs (Hosting, AI assistant).
• Supabase (Supabase Pte. Ltd., Singapur) (processor): database of our management system in Frankfurt am Main, Germany (region eu-central-1) (Contact form, Question to Kevin).
• Google (Google Cloud EMEA Limited, Dublin, Irland) (processor): email inbox (Google Workspace) for replies to your enquiries (Contact).
• DataForSEO (DataForSEO OU, Estland) (processor): retrieval of public information from Google and Google Maps for the detailed analysis on request (Website self-check).
• Push services of device manufacturers (Apple, Google, Mozilla or Microsoft, depending on our device): they deliver the notification about new enquiries to our own devices. The content is end-to-end encrypted (Web Push) and cannot be read by the push service; technical delivery information is processed.

We have concluded a data processing agreement with Supabase pursuant to Art. 28 GDPR.

We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR.

We have concluded a data processing agreement with DataForSEO pursuant to Art. 28 GDPR.

Third countries

Cloudflare, Supabase and Google are companies headquartered in, or with parent companies in, the USA. It is therefore possible that data is processed in the USA or other countries outside the EU, or accessed from there. The database is located in Frankfurt am Main, Germany (region eu-central-1); this does not rule out access by the provider from third countries, for example for operations and support.

Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR). Standard contractual clauses of the European Commission have been agreed with Cloudflare (Art. 46(2)(c) GDPR).

Standard contractual clauses of the European Commission have been agreed with Supabase (Art. 46(2)(c) GDPR).

Google is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR). Standard contractual clauses of the European Commission have been agreed with Google (Art. 46(2)(c) GDPR).

DataForSEO is based in Estonia (EU) but, according to its own information, uses subprocessors in the USA among other countries (e.g. for data centres). For transfers to these subprocessors, DataForSEO states that it uses standard contractual clauses of the European Commission or adequacy decisions (Art. 45, 46(2)(c) GDPR).

Storage period

We only store data for as long as necessary for the respective purpose:

• AI assistant conversation history: only in the working memory of the open page until you reload or close it.
• Checksums for abuse protection: until the first request after a new day (UTC) begins, see AI assistant.
• Logs at Cloudflare (Workers Logs): 7 days.
• Messages from the contact form and questions forwarded to Kevin are deleted automatically by our management system six months after receipt.
• We delete emails about your enquiry six months after the last contact if no engagement results.
• According to Supabase, it makes daily backups of the database. Deleted data may remain in these backups until they are overwritten; on our plan we have no access to these backups.
• If your enquiry leads to an engagement, we keep the data as part of the business relationship. Statutory retention periods of up to ten years apply to business letters, quotes, contracts and invoices (including section 147 AO, section 257 HGB). No later than three years after the last contact or after the end of the project and maintenance, we anonymise your data; exceptions are records such as approvals and scope confirmations, and documents subject to the statutory periods mentioned.

Your rights

Under the GDPR, subject to the conditions set out there, you have the following rights:

• access to the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR), unless a legal retention obligation applies,
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR) for data you have provided to us and that we process by automated means on the basis of a contract or consent.

Right to object (Art. 21 GDPR)

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR). We do not currently ask for consent on these pages.

To exercise your rights, simply send an email to hello@webcodic.de.

Complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Germany).

Obligation to provide data

You are not legally or contractually obliged to provide us with data. However, the website cannot be delivered without the technical access data. In the contact form and for the question to Kevin, we need the details marked as required in order to reply; without them the form cannot be sent. You can use the AI assistant without providing personal details.

AI and automated decisions

The AI assistant generates answers to your questions automatically. These answers are non-binding; quotes, prices and commitments are made by Kevin personally. The only other automated step is limiting the number of requests to protect against abuse; you can still reach us via the other contact channels. In our assessment, this does not involve a decision that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).