Privacy Policy

Last updated: 18 October 2026

Our philosophy

HausAI is built by the CEO, one accountable person, working with agents. We think that matters for your data: AI is not accountable, people are, and here that person is the CEO. The agents we build with act on rails the CEO sets, and the important decisions are written down. Not every override of a check is logged yet; we are building that. This policy covers what runs at hausai.eu today: the website, the founder-updates list and the contact form. If anything is unclear, write to us: a person answers, not a script.

1. Controller

The data controller responsible for your personal data is: SystemHaus.io Datenschutz und Digitalisierung e.K., Niederfeldstr. 69, 68199 Mannheim, Germany · Owner: C. Cetin · Commercial register: Amtsgericht Mannheim, HRA 708673 · VAT ID: DE324939139.

We operate this website (hausai.eu). We are committed to processing your data in full compliance with the EU General Data Protection Regulation (GDPR, EU 2016/679) and the German Federal Data Protection Act (BDSG). Privacy contact: privacy at hausai.eu · General contact: info at hausai.eu

2. What runs today

2a. Visiting our website. On hausai.eu we practice strict data minimization:

• No cookies are set, and nothing else is stored on your device either: no local storage, no session storage. When you view the landing page, our analytics record which page it was, the name of the website you came from and any campaign data in the link (UTM parameters); they also record when you first click or tab into one of the page's forms and when you start, complete or fail the sign-up. A random number generated for that one page view ties its events together (for example the page view and a later sign-up); it exists only in your browser's memory and is gone when you reload or open another page. We keep it with the events it ties together, but every new page view gets a new number, so the number cannot be used to recognise you across page views or visits. An event that came from a known automated tool, such as a test browser or a command-line client, is marked as such; this is worked out from the browser identifier (user-agent) your browser sends, and the identifier itself is not stored with the events.
• No fingerprinting or cross-site tracking of any kind.
• No third-party scripts: no Google Analytics, no Meta Pixel, no ad trackers.
• Our analytics events do not contain your IP address. Your IP address is held in memory until about an hour after your last request, to apply a rate limit against automated abuse. Outside the sign-up and the contact form (sections 2b and 2c), it is written down in three places, and, for the event log, in our database backups: the web server's access log, which records each request to the website (time, page requested, your IP address and the headers your browser sent, such as its user-agent), and which we also use to count how many different addresses reached the landing page in a week (a copy of it, made on 30 September 2026, is kept on our own backup storage until we delete it, by 30 October 2026 at the latest); our service log, when you hit a form's rate limit or fill in the hidden field that filters automated form submissions; and our event log in the database, when that hidden field is filled in on the sign-up form. We have not yet set a fixed retention period for these three.
• Country-level geolocation is derived from Cloudflare's country header, for aggregate analytics only.
• Browser language preference is recorded for locale optimization.

2b. Founder updates. When you leave your email address on our landing page for occasional founder updates ("Just want updates?"), we process: your email address; first and last name, if given; how you found us; your language setting; the fact that you consented and the source of that consent; the IP address and browser identifier (user-agent) the form was submitted with; and, if present, campaign data from the link you arrived through (referrer, UTM parameters, referral ID). We store the IP address and browser identifier as evidence of how and that your consent was given: Art. 7 GDPR requires us to be able to demonstrate valid consent if it is ever disputed. Signing up also triggers a self-notification email to us (your email address, first name, how you found us, language and consent source), a copy of which is kept in our internal event log. Legal basis: your consent (Art. 6(1)(a) GDPR), given actively when you submit the form; storing the IP address and browser identifier additionally rests on our obligation to demonstrate that consent (Art. 7(1)). Retention: your entry stays on the list for as long as you want the updates; write to us and we remove it by hand. We aim to strip personal data from the internal notification copy within 90 days of it being sent; that is not yet an automatic process, so ask and we act on it sooner if you want. Withdrawal: write to us. There is no automated unsubscribe link or preference centre today, so an email is the only mechanism, and we take you off the list by hand as soon as it arrives.

2c. The contact form. When you write to us through the "Tell us what you're automating" or "Ask about your data protection and security" options, we process: your name, email address, subject line and the content of your message; the language you used or that we detected; which of the two options you used; if present, campaign data from the link you arrived through (referrer, UTM parameters, referral ID); and the IP address and browser identifier (user-agent) the message was submitted with. Your message is kept as an internal ticket with an ID and a status so we can track it. We store the IP address and browser identifier as provenance for your enquiry, so we can reply to you reliably and lawfully — they are stored together with your message, not just transiently. Separately, incoming submissions are briefly checked against a rate limiter to block abuse; that check runs in memory; the only trace it leaves is the log line described in section 2a. Writing to us also triggers a self-notification email to us (your name, email address, which option you used, and roughly the first 500 characters of your message), a copy of which is kept in our internal event log. Legal basis: pre-contractual steps and fulfilling your request (Art. 6(1)(b) GDPR), together with our legitimate interest in reliably handling incoming enquiries (Art. 6(1)(f)) — unlike the founder-updates sign-up, this does not require separate consent. Retention: we aim to keep your enquiry for up to 12 months after the matter is closed, and to strip personal data from the internal notification copy within 90 days — neither runs automatically today; write to us (section 7) and we act on it by hand, sooner if you ask. Your rights: you can request access, correction or deletion at any time (see section 7).

3. Purposes and legal bases

What we do today: running the website and understanding how visitors use it, without identifying them — legitimate interest (Art. 6(1)(f) GDPR) · sending founder updates to people who asked for them — consent (Art. 6(1)(a)), with the IP address and browser identifier kept as proof of that consent (Art. 7(1)) · responding to messages sent through the contact form — Art. 6(1)(b) with our legitimate interest in handling enquiries reliably (Art. 6(1)(f)). Not on this list: advertising, selling data, building profiles for third parties, or training AI models on what you send us.

4. Hosting and transfers

Everything in section 2 is stored on our own infrastructure with an EU-based hosting provider, located in the European Union. Static assets and traffic filtering run through Cloudflare, Inc., which processes connection metadata (IP address, URL, user-agent); US-headquartered, routes via EU data centers; transfer basis: EU Standard Contractual Clauses plus the EU-US Data Privacy Framework (DPF); DPA: cloudflare.com/cloudflare-customer-dpa. The internal email notifying us of a new sign-up or message goes out through our own self-hosted mail server, not a third-party mail provider. We use no other processor for what runs today.

5. Security

Measures under Art. 32 GDPR for what runs today: encryption in transit — TLS, HTTP redirected to HTTPS · abuse protection — a per-IP rate limit, kept in memory (section 2a), on the forms and the analytics endpoint, plus a hidden field that filters automated form submissions before anything is stored · data minimization — no cookies, no fingerprinting, no third-party trackers; no IP address in the analytics events (section 2a) · regular backups of the database on EU infrastructure. No system is perfectly secure; we report any material breach within 72 hours to the supervisory authority (Art. 33) and notify affected people where Art. 34 requires it.

6. Retention

We don't hoard data. Today, most deletion happens on request rather than on a timer: write to privacy at hausai.eu (section 7) and we act within 30 days (Art. 17). Where a period below is a target we aim for, we say so plainly — none of them run as an automatic purge yet. Founder-updates sign-ups — kept until you withdraw; we remove your entry by hand as soon as you write to us (section 2b). · Internal notification copies (founder-updates sign-ups and contact-form messages) — we aim to strip personal data from these within 90 days of being sent; not yet automated, so write to us if you want it removed sooner. · Contact-form messages — we aim to keep these for up to 12 months after the matter is closed; not yet automated either. · Anonymous website analytics — we aim to purge these after 12 months; not yet automated. · Server logs (the web server's access log and our service log) and the honeypot entries in our event log (section 2a) — no fixed period is set yet. The copy of the access log made on 30 September 2026 is deleted by 30 October 2026 at the latest. · Any deletion request under Art. 17 is acted on within 30 days.

7. Your rights

Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), and a complaint to a supervisory authority — for Baden-Württemberg: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Königstr. 10a, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de. Write to privacy at hausai.eu; we respond within 30 days (Art. 12(3)).

8. Processors, today

EU-based hosting provider (hosting only; no application-level access) · Cloudflare, Inc. (CDN, DDoS protection, DNS, bot detection; basis as in section 4). The full Article 30 record on written request.

9. Changes to this policy

We update this policy when our practices or applicable law require it. Material changes (new categories of personal data, new processors, new transfer bases) that add or increase a data transfer or risk are announced by email to everyone signed up for founder updates at least 30 days before they take effect, with a right to object. A change that materially improves your data protection may take effect promptly, with notice given at the same time. Minor changes (typos, clarifications) are communicated with an updated "Last updated" date on this page.

10. Contact

privacy at hausai.eu · hausai.eu. A person answers: the CEO. The ticket number you see after writing to us is only our reference for your message.