Privacy

1. Controller and contact

Saeed Moradtalab, Paul-Jäkel-Straße 46, 09113 Chemnitz, Germany, is responsible for operating SeniAI and his own offers. Contact: benmoradtalab@gmail.com, +49 174 3091841. If another account holder processes information for their project, they are responsible for that project’s processing purposes; SeniAI provides the platform. You may also contact the provider named on the relevant page.

2. Forms, projects and communication

Contact details, answers, callback preferences, messages and optional attachments are used solely to handle your enquiry, the relevant project and communication with you. The legal basis is GDPR Article 6(1)(b) for pre-contractual steps you request or contract performance; for business contacts, Article 6(1)(f) covers legitimate business communication. Without a separate lawful basis, information is not used for advertising or training general AI models. Required fields are necessary to process and submit the form.

3. Acknowledgements and technical evidence

Successful submissions record a server-side UTC timestamp, form reference, language, accepted terms and acknowledged privacy versions, and a checksum of submitted content. For abuse prevention and traceability, we also retain the IP address supplied by our trusted ingress proxy and broad browser, operating-system and device categories until 30 days have elapsed, with removal in the next daily cleanup. We do not fingerprint devices. These records do not prove a person’s identity. Evidence and abuse prevention rely on legitimate interests under GDPR Article 6(1)(f). Accepting terms and acknowledging this notice do not constitute blanket consent to additional processing.

4. Hosting and recipients

The SeniAI application and project database are hosted on servers in Germany with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. Hosting privacy information: https://www.hetzner.com/legal/privacy-policy/ . Access is limited to authorised account holders, permitted project participants and necessary technical service providers performing their duties. German hosting does not rule out separate overseas processing by services users connect.

5. AI and MCP access

Submitting a form alone does not automatically send answers to an external AI service. Account holders may connect their own AI agents or applications through MCP to read and edit project data within granted permissions. Depending on the provider, data may be processed outside Germany or the EEA. The account holder must ensure an appropriate legal basis, recipient information and, where required, safeguards for international transfers. Acknowledging this notice does not replace these requirements. Submitting a form does not trigger solely automated decisions with legal or similarly significant effects.

6. Optional GitHub sign-in

If you choose GitHub sign-in, SeniAI and GitHub exchange information necessary to authenticate and associate your account, including account identifiers, profile details and an available email address. This fulfils your sign-in request under GDPR Article 6(1)(b). GitHub may process data outside the EEA. Details: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement . The GitHub integration currently requests the “repo” permission in addition to profile and email access. Depending on GitHub permissions, this includes private repositories and supports repository features beyond sign-in. Using those features processes repository data and an access token. Review the GitHub authorisation dialog; revoke access in your GitHub application settings if needed. Email/password sign-in is an alternative. Public briefings do not require GitHub sign-in.

7. Stripe payments

For payments, Stripe processes information needed for payment, billing and fraud prevention. SeniAI receives information such as payment status and customer or transaction identifiers. Legal bases are GDPR Article 6(1)(b) and (c), and where applicable (f) for abuse prevention. Stripe Payments Europe Limited is involved in Europe; processing outside the EEA may occur. Recipient and safeguard information: https://stripe.com/privacy . Submitting a brief does not initiate payment.

8. Retention and deletion

Enquiry and project data are kept only while needed for the stated purposes or legal obligations. Deletion requests are reviewed against remaining obligations. Technical form attributes (IP address and device category) expire after 30 days. Other submission evidence is retained until the end of the third calendar year after submission and then automatically deleted. Legally required contract and billing records may have different retention periods. Backups may retain deleted data until their scheduled overwrite and are not used for ongoing business operations.

9. Sessions and your rights

Sign-in and protected portals use technically necessary session cookies (Section 25(2) TDDDG). Subject to statutory conditions, you may request access, correction, deletion, restriction and portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Any consent you actually give may be withdrawn for the future. Contact benmoradtalab@gmail.com. You may complain to a data-protection authority, including the Saxon authority: https://www.datenschutz.sachsen.de/ .

10. Website access, security and local settings

Website requests technically process IP address, time, requested URL, browser and connection information to deliver content, detect errors and prevent attacks. The basis is GDPR Article 6(1)(f), with the legitimate interest in secure, functioning operations. Operational and error logs serve those purposes, not advertising profiling. Necessary retention follows the error or security investigation and is separate from form submission evidence.

Protected briefings and customer portals set an access cookie after successful login for up to eight hours, limited by link expiry. Account login uses authentication and security cookies. Your chosen light/dark theme may remain in browser storage until you change it or clear storage. Storage necessary for expressly requested features relies on Section 25(2)(2) TDDDG. Blocking or clearing session cookies may require you to sign in again.

11. Account data, public profiles and sources

Account use processes name, email, account identifier, authentication data, permissions and any subscription status to provide the requested account under GDPR Article 6(1)(b), or administer business access under (f). Passwords are stored as verification hashes, not plain text.

Published profile text, images, offers and materials are public. Account holders can end publication; third-party copies and search caches are outside direct control. Submitting briefing answers does not make them public. Information comes from you or authorised project participants who may create contacts or provide project documents. Where information is not obtained from you, the relevant controller must also meet GDPR Article 14 information duties.

12. Project requirements, traceability and access

Structured responses are stored with request title, contact or recipient assignment, form version and server receipt time. Authorised project managers can view and compare them and use them for requirement drafts or assessments. Approved documents may enter project context packs. The purpose is traceable project coordination, on the bases in Section 2. Neither a recipient label nor an IP address establishes verified identity. You may request correction or an additional statement; treatment of earlier versions follows applicable law and necessary evidence purposes.

Customer access shows only released content. The account holder grants and can revoke read-only MCP access. Depending on the access granted, account holders have account-wide or project editing permissions.

13. Email communication and sensitive data

Direct contact processes sender details, message and attachments to handle the enquiry on the bases in Section 2. The published contact address uses Gmail, so emails sent to it are also processed by Google’s email service. Provider information: https://policies.google.com/privacy . This concerns direct email communication and does not mean every form answer is automatically forwarded by email.

Do not submit health data, identity documents, payment credentials or other particularly sensitive information in general forms unless specifically agreed for a lawful purpose. A required field does not require unnecessary sensitive information.

14. International transfers and separate responsibilities

GitHub, Stripe, email services and independently connected MCP applications may process data outside the EEA. In addition to a processing basis, transfers must meet GDPR Articles 44 onwards, for example an applicable adequacy decision or appropriate safeguards such as EU standard contractual clauses with additional measures where needed. Acknowledging this notice is not consent under Article 49. You may request information on applicable safeguards using the contact above. Other account holders must disclose additional recipients they select. German hosting does not guarantee that all subsequent processing takes place exclusively in Germany.

15. Retention criteria and exercising rights

Enquiry and project retention depends on processing status, ongoing cooperation, necessary contractual evidence and statutory obligations. Data must be deleted when the purpose ends and no other basis applies. The technical form evidence period covers IP address and broad device category; removal follows after 30 days in the next daily cleanup. Other submission evidence expires on 1 January of the fourth calendar year following submission and is removed in the next cleanup. This is not a blanket retention period for all project content.

Exercise rights by email or post. Identify the relevant project or contact where possible, without unnecessary identity documents. Necessary additional information may be requested if there are reasonable doubts about identity. You generally receive a response within one month; lawful extensions are explained. Portability is subject to GDPR Article 20. You may complain to a supervisory authority without contacting us first.

16. Objection and updates

You may object to processing based on GDPR Article 6(1)(f) on grounds relating to your particular situation. Processing will then cease unless legally prevailing grounds or the establishment, exercise or defence of legal claims justify continuing it. You may object to direct marketing at any time. Withdrawal of separately given consent does not affect earlier lawful processing.

This notice is updated when processing changes. The version acknowledged on submission remains available at its versioned address and in the submission record. Publication alone does not legitimise new purposes or changes requiring consent.