Privacy Policy

Provision of personal data

Certain technical data, particularly your IP address and the information needed to process your request, must be processed to deliver the requested content. Additional technical metadata may be processed for the security and troubleshooting purposes described below.

Entering the password for protected study materials is voluntary. Without a correct password, the protected area cannot be opened.

Providing information in emails is voluntary. Without a reachable means of contact and the information necessary to process your inquiry, we may be unable to answer it.

Consent to usage statistics and performance measurement is voluntary. If you refuse, the basic functions of the websites remain available.

4.1 Hosting via Vercel

The main pages at lanfermann.dev, neatpass.app, and their language versions are provided via Vercel.

The provider is:

Vercel Inc. 440 N Barranca Avenue #4133 Covina, CA 91723 USA

When a page is accessed, Vercel may process in particular the following data:

• IP address and approximate location information derived from it;
• date and time of the request;
• requested hostname, path, and any query parameters present;
• HTTP method and response status;
• browser, operating system, device type, and user agent;
• referrer, where transmitted by the browser;
• technical request, cache, security, regional, and error data;
• technical request and delivery identifiers.

The processing is necessary to deliver the websites, ensure their availability and security, investigate technical errors, and prevent misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests are the secure, stable, and efficient provision of our web offering.

For our Vercel Pro account, regular runtime logs are generally available for up to one day. We use neither Observability Plus nor Log Drains or other external log exports configured by us. Deployment and build logs may be stored together with the relevant deployment; they generally contain technical development and deployment information and are not used by us to create visitor profiles.

Under Vercel's data processing agreement for Pro customers, Vercel acts as a processor for customer data processed on our behalf. Vercel describes itself as a controller for certain service-generated data and contact data, where these are personal data. Its stated purposes for those categories include operating, supporting and improving its services, analytics, benchmarking and reporting, and marketing and service communications. The applicable categories, purposes and retention criteria are explained in the Vercel Data Processing Addendum and Privacy Notice.

Further information: Vercel Privacy Notice and Information on Vercel Runtime Logs.

4.2 Cloudflare

The provider is:

Cloudflare, Inc. 101 Townsend Street San Francisco, CA 94107 USA

Cloudflare provides the authoritative DNS services for our domains. Ordinary page views of the main pages at lanfermann.dev and neatpass.app are not routed through Cloudflare as a reverse proxy.

Cloudflare operates as a reverse proxy and content delivery service in particular for:

• cdn.lanfermann.dev, through which public and access-protected files are delivered.

For requests to these hosts, Cloudflare may process in particular the IP address, date and time, hostname, path and query parameters, HTTP method, headers, user agent, referrer, cookies or access tokens for the relevant host, and connection, routing, location, and security information.

The processing serves name resolution, secure forwarding, encrypted connections, caching of permitted content, availability, and the prevention of harmful requests. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable provision of the relevant services.

For the processes described, our current configuration has in particular not activated Turnstile, Waiting Room, Logpush, or optional bot or challenge functions. No Cloudflare cookies were set for ordinary, checked requests. If Cloudflare performs a security check in an exceptional case, it may set technically necessary security cookies for this purpose. Storage would then be strictly necessary for the secure provision of the expressly requested service (Section 25(2) no. 2 TDDDG).

We do not create our own Cloudflare Logpush export of visitor requests. Cloudflare may process operational and security-related data according to the criteria described in its privacy notices for as long as necessary to provide and secure the service or to comply with legal obligations.

Further information: Cloudflare Privacy Policy and Cloudflare information on strictly necessary cookies.

4.3 Amazon CloudFront and Amazon S3

Files at cdn.lanfermann.dev, including the access-protected study materials, are delivered via Cloudflare and then via Amazon CloudFront from Amazon S3 storage. CloudFront uses a global delivery network. The encrypted analytics backups described in section 8.3 are stored separately in a private S3 bucket in Frankfurt and are not delivered through this CDN.

The provider is:

Amazon Web Services EMEA SARL 38 Avenue John F. Kennedy L-1855 Luxembourg

CloudFront processes the technical request data required for delivery. For protected files, it also checks the technical access token transmitted by your browser with the request. The files themselves are study materials and, according to our current use, contain no personal data of website visitors.

The processing serves the fast, stable, and secure delivery of files and access control for non-public materials. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests are the efficient provision of the content and protecting non-public files from unauthorized access.

CloudFront standard access logs and real-time access logs are disabled for this delivery. Amazon may nevertheless process connection and security data required for the technical operation of its infrastructure.

Further information: AWS Privacy Notice and Information on CloudFront Logs.

7.1 Contact interface on the website

The information entered on the support or contact page is initially processed solely in your browser's working memory. Our website does not operate its own form server for this purpose and does not store the entered name or message text in a website database.

The website itself does not submit the entered message to us. Activating the send function creates a mailto: link and passes the draft to the email application or service configured on your device. That application or service may process or synchronize the draft under its own settings and privacy terms. We receive the message when you send it to us.

If you have previously consented to usage statistics, the website may transmit a minimized statistics event when you use the contact interface. This may contain the selected general contact category and information about whether the name and message fields were completed. The entered name, message text, email address, and attachments are not transmitted as a statistics event.

7.2 Processing of emails

When you send us an email, we process in particular:

• your email address and, where applicable, your name;
• recipient and sender details;
• subject, message text, and attachments;
• date, time, and technical email metadata;
• other information that you provide voluntarily.

The processing serves to handle and answer your inquiry. If your message relates to a contract or pre-contractual measures requested by you, the legal basis is Art. 6(1)(b) GDPR. In other cases, the processing is based on Art. 6(1)(f) GDPR; our legitimate interest is the proper handling of incoming inquiries and communication.

Providing the information is voluntary. Without a reachable means of contact and the information necessary to process your inquiry, we may be unable to answer it.

Email communication is stored for as long as necessary to process and appropriately follow up on the relevant matter. In making this assessment, we consider in particular the nature and content of the inquiry, any connection with a contract, outstanding questions, the need to document the communication, and possible legal claims. If further storage is no longer necessary for these purposes, we delete the correspondence. Longer storage takes place where statutory retention obligations apply or the data are needed to assert, exercise, or defend specific legal claims. In these cases, the legal bases are Art. 6(1)(c) and (f) GDPR.

7.3 Zoho Mail

We use Zoho Mail to receive and send emails.

The provider is:

Zoho Corporation B.V. Beneluxlaan 4B 3527 HT Utrecht Netherlands

Our account is assigned to Zoho's European data center region. Storage in that region does not exclude the support access described below.

Zoho processes email content, attachments, sender and recipient addresses, and technical email metadata on our behalf. In rare cases, limited support access may take place by appropriately authorized employees of the Zoho company in India. According to its own information, Zoho bases this access on standard contractual clauses, a transfer assessment, and supplementary measures.

Moving a message to Trash is separate from permanent deletion. Zoho describes automatic Trash cleanup according to the configured interval and the message's received date; supported intervals range from 5 to 180 days. After deletion from Trash, Zoho describes a further recovery period of up to 30 days. Any separately configured eDiscovery or archival retention follows its own rules. These provider stages do not replace our criteria for deciding when correspondence is no longer needed. Zoho's documented deletion and overwriting rules also apply to technical backup and recovery copies, which we do not use for ordinary email processing.

Further information: Zoho Privacy Notice, Zoho Privacy FAQ, and Zoho Mail Deletion and Retention Rules.

8.1 Vercel Web Analytics

If you consent to usage statistics, we use Vercel Web Analytics from Vercel Inc.

The service helps us understand which public pages are accessed, which general sources visits come from, and which browser and device categories are used. In particular, the following may be processed:

• time of the event;
• accessed public path and technical route;
• referrer, where available;
• country or region;
• browser and browser version;
• operating system and version;
• device type;
• version of the analytics script.

Our configuration removes query parameters and URL fragments from the analytics events sent to Vercel Web Analytics. The public URL path may remain part of the event. This cleaning applies only to analytics events; for an ordinary technical website request, Vercel may process existing paths and query parameters as the hosting provider.

According to the provider, Vercel Web Analytics does not use third-party cookies. For a daily visitor count, a technical identifier is derived from request data and discarded or newly generated after 24 hours. We do not use the data for cross-website tracking or account-related visitor profiles.

The 24-hour identifier is not the same as the retention period for statistics events. In our Vercel Pro plan without Web Analytics Plus, the reporting period available to us is generally up to twelve months. This reporting period is not a guarantee that Vercel deletes all underlying technical data immediately after it expires; Vercel's purpose-specific retention and deletion rules apply in addition.

Further information: Vercel Web Analytics, privacy and data fields and Vercel Web Analytics.

8.2 Vercel Speed Insights

If you consent to performance measurement, we use Vercel Speed Insights from Vercel Inc.

Speed Insights uses browser interfaces to measure the actual loading and rendering performance of public pages. In particular, the following may be processed:

• cleaned public path and technical route;
• measured performance value and technical attribution information;
• general network speed;
• browser, operating system, and device type;
• country;
• SDK or script version;
• time the measurement value was received.

Query parameters and URL fragments are removed before transmission by our configuration. The service is not used to reconstruct a cross-page session or identify individual visitors.

Vercel's reporting window depends on the Speed Insights tier: ordinary Speed Insights offers date ranges of up to seven days, while Speed Insights Plus on Pro includes 30 days. These dashboard windows describe access to reports, not a guaranteed complete deletion period for all underlying personal or technical provider data. Vercel's purpose-specific retention criteria apply separately.

Further information: Vercel Speed Insights, privacy and data fields and Vercel Speed Insights, limits and reporting periods.

8.3 Umami Analytics

If you consent to usage statistics, we use the open-source Umami Analytics software via analytics.lanfermann.dev.

We operate the Umami application and PostgreSQL database on a virtual server in Vienna, Austria, provided by netcup GmbH. The collection endpoint reaches our server directly over HTTPS. Cloudflare provides DNS for this endpoint and does not proxy its analytics requests.

The infrastructure provider is:

netcup GmbH Emmy-Noether-Straße 10 76131 Karlsruhe Germany

Our website client software is configured so that Umami is loaded only after your consent. Automatic page view tracking, automatic general click collection, performance measurement, session replay, heatmaps, and identification functions are disabled in our integration. Page views and selected interactions are transmitted deliberately after consent.

In particular, the following information may be processed:

• normalized public path, hostname, and page title;
• cleaned referrer;
• screen resolution and browser language;
• browser, operating system, and device type;
• approximate location at country, region, or city level;
• pseudonymous session and event identifiers;
• fixed event names and sparse event properties;
• standardized campaign parameters utm_source, utm_medium, utm_campaign, utm_content, and utm_term, where they meet the technical length and character limits of our website.

The IP address and full user agent are technically processed at the network and server level. Umami temporarily uses request characteristics to determine approximate location and create a pseudonymous session. The raw IP address is not written to the session or event records in our Umami analytics database. Umami instead stores derived, pseudonymous session identifiers and approximate location; this does not make the records anonymous. Technical server logs may contain request metadata. Container logs use size-based rotation with up to three 10 MB files per container; this is not a fixed time-based deletion period.

Our regular website is configured in particular as follows:

• Search events do not contain the entered search text, but only its length, the number of results, and the category of the highest-ranked result or the value "unmatched";
• Events from the contact interface contain at most the general contact category and information about whether the name and message were completed, but not the entered content;
• Scroll and conversion events contain only predefined event names and the sparse values intended for them;
• Other query parameters and URL fragments are removed before regular transmission.

These restrictions are implemented by the website client software we provide. We do not use the Umami endpoint to receive free-form content.

A daily deletion job removes analytics data older than 13 months from the active database. Daily backups are encrypted before upload to a private Amazon S3 bucket in Frankfurt (eu-central-1), with additional S3 server-side encryption. Backups become eligible for automatic deletion after 30 days; S3 performs deletion asynchronously. A backup can therefore temporarily retain data that has already been deleted from the active database. The retention purge runs before restored data is made available again. The backup decryption key is stored separately from the server. AWS processing and international transfers are described in sections 4.3 and 10.

A separate internal reporting system retains copies from our earlier analytics setup. Its detailed event and session records are configured to expire after 90 days. Raw import copies have separate expiry timestamps, generally 90 days after import or refresh, so these copies can outlast the detailed event view. Summary reports and reporting configuration are not covered by that detail-expiry rule. Deletion requests must therefore also be assessed against these separate copies.

Further information: Umami Documentation, netcup Privacy Policy, and Amazon S3 backup expiration.

Analytics preferences

Optional usage analytics and performance measurement are currently disabled.