Privacy Policy

intiKnows – Inti Supa Stölben

Elisabethenstraße 17, 70176 Stuttgart

Email: info@intiknows.de

When you use the contact form or the feedback form on this website, the following data is collected and processed:

• Name (contact form)
• Email address (optional in the feedback form)
• Message text; in the contact form also the service area, if you select one; in the feedback form also your rating (1 to 5) and the category
• Timestamp of submission

Purpose: Processing your request and responding to you (contact form); evaluating user feedback (feedback form). Both forms are protected against spam and abuse by a hidden honeypot field, a check of the time taken to fill in the form, a rate-limit cookie and Cloudflare Turnstile (see section 4).

Legal basis: Contact form: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in communication). Feedback form: Art. 6(1)(f) GDPR (legitimate interest in processing user feedback). Spam and abuse protection: Art. 6(1)(f) GDPR.

Retention period: Contact requests and feedback entries are automatically deleted after 6 months at the latest, unless statutory retention obligations apply. When a feedback form is submitted, we also log an anonymous event (event type, page path, time; no IP address, no user ID); it is deleted after 6 months as well. Notification emails in our mailbox are kept only as long as needed to handle your request.

Processor: Data is stored in a PostgreSQL database at Supabase (Supabase Inc., USA). The database server is located in Frankfurt am Main (eu-central-1, Germany). Because Supabase Inc. is based in the USA, access from there cannot be ruled out. Any transfer is based on the EU-US Data Privacy Framework or on EU Standard Contractual Clauses (Art. 45, 46 GDPR). More information: supabase.com/privacy

There is no public registration. The operator creates user accounts for the internal area (e.g. interactive apps) only. For an existing account, the following data is processed:

• Email address and password (stored only as a hash)
• Display name and time the account was created
• Login token (cookie sb-…-auth-token, strictly necessary, see section 4)

Purpose: Providing the personalized user area and maintaining the login session.

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

Retention period: Account data is stored until the user account is deleted. We delete accounts on request by email (see section 5). The login cookie is removed when you log out; otherwise it expires after 400 days at the latest.

Processor: Supabase Inc. (USA) — database server Frankfurt am Main (eu-central-1). Basis for any third-country transfer: see section 3.

The contact form and the feedback form each trigger a notification email to the website operator, containing the data you entered. Delivery is handled by Resend (Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). The emails are processed in Resend's EU region (Ireland).

Data processed: Contact form: name, email address, message. Feedback form: rating, category, feedback text and — if you provide it — your email address.

Legal basis: Contact form: Art. 6(1)(b) GDPR (responding to your enquiry and pre-contractual measures). Feedback form: Art. 6(1)(f) GDPR (legitimate interest in processing user feedback).

Third-country transfer: Sending runs through the EU region (Ireland). Resend Inc. is based in the USA, so access from the USA cannot be ruled out. The transfer is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). More information: resend.com/legal/privacy-policy

Strictly necessary (§ 25(2)(2) TDDDG, no consent required): (1) Cookie NEXT_LOCALE, 1 year, stores your language choice in the sign-in area only; the public pages carry the language in the web address (/de, /es) and set no cookie for it. (2) Cookies _rl_contact and _rl_feedback, 60 seconds, set after a successful submission to limit repeated submissions (abuse protection); they contain only a timestamp. (3) Cookie sb-…-auth-token (Supabase Auth), up to 400 days, set only after login; keeps you signed in until you log out. (4) Local storage entries ik_user and ik_admin, until logout, only while you are signed in; ik_user holds your Supabase user data (including email address and display name) so the page header renders without delay, ik_admin is a flag set only for the operator account. (5) Local storage entry analytics_consent, until you delete it; stores your consent choice with timestamp and banner version as proof of consent (Art. 7(1) GDPR). (6) Service worker /sw.js, registered on every visit; it forwards requests to the network unchanged, caches nothing and only displays notifications for the operator account. Visitors receive no push notifications.

Convenience settings (our legitimate interest in a usable website, Art. 6(1)(f) GDPR): the local storage entries cursorGlowDisabled (turns off the cursor glow effect) and sim-colors-… (your own colors in a simulation, one entry per simulation). They are written only when you change the setting yourself, contain no personal data and stay until you delete your browser data. Whether § 25(2)(2) TDDDG covers them is not clear-cut, so we list them separately and do not count them as strictly necessary.

All fonts and icons are self-hosted — no external services like Google Fonts CDN are included that would transfer data to third parties. Bot protection with Cloudflare Turnstile: pages with the contact or feedback form (home page, services page, feedback page) load Cloudflare Turnstile from challenges.cloudflare.com to tell people from automated bots. Turnstile loads only when you scroll close to a form or start filling it in, not when the page opens. From that moment your browser connects to Cloudflare and transmits technical data (IP address, browser and device information); Turnstile may store or read information on your device for the check. When you submit a form, our server sends only the Turnstile token and our secret key to Cloudflare for verification, not your IP address. Recipient: Cloudflare, Inc., USA. Purpose: protecting the forms against spam and bots. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the forms against abuse) and § 25(2)(2) TDDDG. Transfer to the USA: EU-US Data Privacy Framework or EU Standard Contractual Clauses. Turnstile is loaded for this security purpose, so it is not part of the consent banner. More information: cloudflare.com/privacypolicy.

Google Analytics 4 and Cloudflare Web Analytics are only loaded after your explicit consent via the consent banner (§ 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR). Without consent, no external analytics services are called. After consent, Google Analytics 4 sets its own cookies (e.g. _ga). You can revoke your consent at any time via "Cookie Settings" in the footer (Art. 7(3) GDPR).

This website uses Cloudflare Web Analytics for privacy-friendly measurement of page views. The service is operated by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Cloudflare Web Analytics sets no cookies and creates no user profiles. Only aggregated, anonymized metrics are collected (page views, referrers, country). IP addresses are not stored permanently.

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG. Cloudflare Web Analytics is only loaded after your consent via the consent banner.

Third-country transfer: Transfer to the USA based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Revocation: You can revoke your consent at any time via "Cookie Settings" in the footer (Art. 7(3) GDPR).

More information: cloudflare.com/privacypolicy

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Purpose: Reach measurement, analysis of user behavior, and optimization of the web offer. Google Analytics 4 is only loaded if you have actively consented via the consent banner.

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG.

Third-country transfer: Data may be transferred to Google LLC servers in the USA. Basis: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

IP anonymization: IP anonymization is enabled by default in Google Analytics 4. Full IP addresses are not stored permanently.

Revocation: You can revoke your consent at any time via "Cookie Settings" in the footer. Alternatively, install the browser add-on to disable Google Analytics: tools.google.com/dlpage/gaoptout

More information: policies.google.com/privacy