Privacy Policy

In short

• This website sets no cookies and uses no tracking, analytics or advertising services.
• The fonts are served by this website itself. No connection to Google Fonts is made when you visit.
• I process personal data only as far as needed to run the website, when you submit a form, use the AI chat or contact me directly. The details are in the following sections.

1. Controller

Ioan Serban, trading as Ranklokal
Iglinger Str. 10, 86899 Landsberg am Lech, Germany
Email: serban@ranklokal.de · Phone: +49 152 09474584

I have not appointed a data protection officer, because there is no legal obligation to do so.

2. Visiting the website: hosting and delivery

When you visit this website, the following services process technically necessary connection data: your IP address, date and time, the page requested, the page visited before (referrer), browser and operating system (user agent), the status code and the amount of data transferred.

Cloudflare

Cloudflare delivers the website, manages the domain (DNS) and protects the website against attacks and overload. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare processes the data on my behalf on the basis of a data processing agreement. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR); the EU Standard Contractual Clauses also apply. Cloudflare stores connection data only as long as needed for security and operation. More in Cloudflare’s privacy policy.

Railway

The website itself is delivered by Cloudflare (see above). Only my server for the forms and the AI chat runs at Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA. The servers are located in the EU (region “EU West”, Amsterdam, Netherlands). Railway processes the data on my behalf on the basis of a data processing agreement. Because Railway is a US company, access from the USA cannot be ruled out; the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) apply. Railway stores access logs of this server with the data named above and deletes them automatically after 30 days at the latest. More in Railway’s privacy policy.

The purpose is delivering the website, its stability and security and defending against attacks. The legal basis is Art. 6 (1) (f) GDPR. My legitimate interest is a secure and working operation of the website.

3. Cookies and browser storage

This website sets no cookies and does not itself store any data in your browser. The exceptions are the AI chat (section 6) and the spam protection on the form pages (section 4), which creates an entry in your browser storage for this purpose.

The AI chat (section 6) runs in its own sealed-off window of my chat server. Only when you open the chat and confirm the privacy notice does it store the following entries in your browser’s session storage. All of them are deleted when you close the tab:

• chat-widget-notice: remembers that you confirmed the chat’s privacy notice.
• chat-widget-messages: your chat history so far, so that it is kept when you change pages. It exists only in your browser.
• chat-widget-visitor-id: a random identifier with no link to your name (use: see section 6). A new identifier is created on every new visit.

The legal basis for storing and reading these entries is § 25 (2) no. 2 TDDDG, because they are required for the chat to work. Further processing is based on Art. 6 (1) (f) GDPR. You can delete the entries at any time in your browser settings.

4. Spam protection with Cloudflare Turnstile

To protect the forms against automated requests (spam, bots), I use Cloudflare Turnstile (provider: Cloudflare, see section 2). The Turnstile script is loaded only on pages with a form (Contact and Website Check); the check itself runs as soon as the form is shown. Cloudflare processes your IP address, information about browser and device (including user agent and TLS fingerprint) and the result of the check.

Cloudflare processes this data on my behalf to detect bots and, according to its own statements, additionally under its own responsibility to improve Turnstile. The legal basis is Art. 6 (1) (f) GDPR (protection against misuse of the forms); for access to information in your browser § 25 (2) no. 2 TDDDG. More in Cloudflare’s Turnstile privacy notice.

5. Contact forms

This website has two forms: the contact inquiry with the optional price calculator, and the free website check. With the contact inquiry you send me your name, your email address and your message and, if you use the price calculator, your entries in it (for example type of website, number of pages, languages, desired feature, AI Chatbot). With the website check you send me your email address, the address of your website and, if given, a message.

Your browser sends the data encrypted to my server at Railway (section 2). There the spam check (section 4) is confirmed, and the inquiry reaches my mailbox as an email through the email delivery service Brevo (section 7). The data is not stored on the server itself.

Brevo is a service of Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. Brevo processes the data on my behalf on the basis of a data processing agreement and stores delivery logs for a limited period. More in Brevo’s privacy policy.

The purpose is handling your inquiry. The legal basis is Art. 6 (1) (b) GDPR if your inquiry aims at a contract, otherwise Art. 6 (1) (f) GDPR. My legitimate interest is being able to answer inquiries. I need the required details (for the contact inquiry your name, email address and message; for the website check your email address and website) to be able to reply to you; all other details are voluntary. How long I keep inquiries is stated in section 7.

6. AI chat

Loading the chat

The chat button is loaded on every page from my chat server at Railway (ranklokal-ai.up.railway.app and ai-plugin-production.up.railway.app). As a result, this server receives your IP address and the technical data from section 2 on every page view, even if you do not open the chat. The chat loads the chat icon and the logo from Cloudflare’s storage service R2 (section 2); Cloudflare therefore also receives this connection data. The legal basis is Art. 6 (1) (f) GDPR. My legitimate interest is being able to answer questions about my services directly on the website.

Notice before the first chat

Before you chat, the chat points out that you are writing with an AI assistant and should not enter personal data. When you confirm the notice, my server stores proof of it: your IP address, the random identifier from section 3, the version of the notice and the time of confirmation, but no message content. The purpose is proof that the notice was shown and confirmed (Art. 6 (1) (f) in conjunction with Art. 5 (2) GDPR). I delete this proof as soon as it is no longer needed for that.

Your messages

Your messages go to my server together with the conversation so far and the random identifier. From there the messages are sent to Google’s Gemini interface (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or Google LLC, USA), which produces the answer. Google does not receive your IP address, because your browser only communicates with my server.

I use the paid interface. Google processes the data for it as a processor, does not use it to train its models according to its terms, and stores it for up to 55 days to detect abuse. Processing outside the EU, including in the USA, is possible; Google LLC is certified under the EU-US Data Privacy Framework.

My server does not store your messages. The conversation is only in your browser’s session storage until you close the tab (section 3).

The legal basis is Art. 6 (1) (f) GDPR, for questions about a possible order Art. 6 (1) (b) GDPR. The answers are generated by an AI; they may contain errors and are not binding. No automated decision within the meaning of Art. 22 GDPR takes place. Please do not enter personal data in the chat, in particular no health data.

7. Email, phone and retention of inquiries

If you write to me by email or call me, I process your details (for example name, email address, phone number and the content of your inquiry) to handle your request. The legal bases are the same as for the contact forms (section 5).

I receive and store emails, including those from the forms, in the email service Gmail of Google Ireland Limited (address see section 6). Emails to serban@ranklokal.de are forwarded to this inbox by Cloudflare (Email Routing, provider see section 2). Google may also process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework. More in Google’s privacy policy.

I delete inquiries once they are finally handled and no order results from them. If an order is placed, I keep the business correspondence for as long as legal retention obligations require, in particular under commercial and tax law. The legal basis for that is Art. 6 (1) (c) GDPR.

8. Transfer to countries outside the EU

Some of the providers named are based in the USA or may process data there: Cloudflare and Google are certified under the EU-US Data Privacy Framework (Art. 45 GDPR); for Railway the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) apply. Despite these safeguards, access by US authorities cannot be ruled out completely.

9. Your rights

You have the right to:

• information about your stored data (Art. 15 GDPR)
• rectification of incorrect data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR, see section 10)
• withdraw consent you have given, with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, an email to serban@ranklokal.de or a letter to the address in section 1 is enough.

You can also complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You can also contact the supervisory authority where you live.

10. Right to object

Where I process data on the basis of Art. 6 (1) (f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). I will then no longer process the data, unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

11. Changes

As of: September 2026. I adapt this policy when the data processing on this website changes.