Information under Article 13 GDPR

Privacy policy

Last updated: 30 October 2026

This is an English translation of the German original. In case of any discrepancy, please refer to the German version.

1. Controller

2. Hosting and server logs

This website is hosted by Host Europe GmbH, c/o Spaces, Gertrudenstraße 30–36, 50667 Cologne, Germany. Technically necessary server logs may be generated when the website is accessed. These may include your IP address, date and time, requested file, referrer, browser identifier, operating system and amount of data transferred.

Processing serves to ensure the secure and stable operation of the website. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the technical provision of the website, error analysis and prevention of misuse. According to Host Europe's technical information, access logs are rotated daily and retained for 14 days. Error logs are retained for 7 days.

3. Process scanner

Purpose and input: When you select “Analyse process”, the description of a business process that you voluntarily enter is transmitted to pauderer.de using TLS encryption and forwarded on the server side to the AI service displayed immediately before submission. The purpose is to provide the automated process assessment you have requested. The description you enter and the connection and usage data technically required for processing are processed.

pauderer.de does not permanently store the process description or the AI-generated result, nor does it use them for advertising or profiling. Neither the process description nor the AI-generated result is recorded in its own technical error and abuse logs. Technical rate-limiting data is retained only for the applicable protection period.

Prior information and provider changes: The active AI service, the configured model and any technically approved fallback service are shown in the scanner before the first possible transmission. If this information cannot be loaded or the backend configuration changes between display and submission, submission is blocked and no input is sent to an AI service. The service actually used is identified again alongside the result.

Legal basis: Article 6(1)(b) GDPR, insofar as the analysis initiated by the visitor serves to prepare for a possible business relationship; Article 6(1)(f) GDPR applies to other use. The legitimate interest consists of providing an expressly requested, non-binding initial process assessment with human oversight.

Possible recipients and retention: Only the following services can be selected in the protected backend. The details applicable to a specific request also depend on the account, model, plan and data options enabled there:

• EUrouter B.V., Amsterdam, Netherlands, and the model hosting provider selected through EUrouter: If EUrouter is used in the scanner, it forwards the request to the selected model host. In the event of a failure, EUrouter may internally switch to another suitable model host; this is not a separately configured fallback AI service on pauderer.de. Internal fallback attempts are also subject to the requested routing conditions, provided a suitable model host is available; otherwise, the request may not be processed. The scanner requests processing within the EU (data_residency: eu), no retention by the model provider (max_retention_days: 0), and no use for model training (data_collection: deny) through routing parameters. These settings do not replace verification of the providers actually used and their contractual commitments. EUrouter states that, by default, it does not retain request content after completion; technical usage and security metadata may be processed. The applicable data processing agreement and list of subprocessors must be checked before use. Privacy policy · Routing and data controls · EUrouter data processing agreement
• OpenAI Ireland Limited, Dublin, Ireland: With direct use of the OpenAI API, abuse monitoring logs are generally retained for up to 30 days by default; shorter or zero retention requires an organisation setting approved for that purpose. Business API content is not used to train models by default. Enterprise privacy · Data processing addendum
• Anthropic Ireland, Limited, Dublin, Ireland (contracting entity for EEA customers under the Commercial Terms; verify the applicable account agreement): Retention is governed by the applicable commercial contract and organisation settings; zero data retention requires a separately approved agreement. Processing outside the EEA by subprocessors is possible. According to the provider, inputs and outputs from commercial API products are not used for training by default. Privacy policy · Commercial Terms · Data processing addendum
• OpenRouter, Inc., USA, and the respective model provider: According to OpenRouter, it does not store prompt or response content by default. Exceptions apply if optional logging or data sharing is enabled, as well as when reviewing reported abusive content or retaining it as required by law. Usage metadata is recorded separately. The downstream model provider may apply its own retention, training and transfer rules; the specific model host and its data policy must be checked before activation. Privacy policy · Data collection · Provider logging
• Google Cloud EMEA Limited, Dublin, Ireland: According to the provider's terms, requirements for Paid Services apply to Gemini API applications publicly accessible in the EEA. Google may retain prompts, context and responses for abuse monitoring for 55 days independently of project logs. In addition, requests and responses may be stored in project logs for paid projects. For new Generate Content API projects, such logging has been enabled by default since 26 October 2026. The retention window can be set to 7, 14, 28 or 55 days; logs stored in datasets may persist longer. Billing, logs, datasets and permissions for data sharing must be checked against the project configuration actually used before use. Abuse monitoring · Project logs · Gemini API terms · Data processing addendum

Transfers to third countries: Direct use of OpenAI, Anthropic or Google may involve subprocessors outside the EEA. Their respective commercial data processing addenda provide for EU standard contractual clauses for relevant transfers to third countries; their applicability to the account actually used must be checked against the respective agreement. With OpenRouter, the processing location and legal transfer mechanism additionally depend on the selected model provider. According to the provider, EUrouter offers routing options within the EU/EEA; the specific model hosts, subprocessors and contractual retention commitments must also be checked. Information on safeguards applicable to the account actually used can be requested at info@pauderer.de.

Restrictions on content: The scanner is intended for abstract business processes. Do not enter personal, confidential, business-critical or otherwise sensitive information, including trade secrets. If a previously disclosed AI service is technically unavailable, only a local, rules-based preliminary assessment may be displayed in the browser.

Optional voice input

Voice input starts only after you actively select it and grant microphone permission in your browser. Speech recognition is provided by the browser you use. Depending on the browser and operating system, the respective provider may process audio data. pauderer.de does not receive an audio file, only the text returned by the browser to the input field. You can always use text input instead.

4. Contact form and email

When you make an inquiry, we process your email address, the message text, optionally your name and company, and the time of submission. The sole purpose is to handle and respond to your inquiry. The contact form first transmits this information to the pauderer.de server using TLS encryption; subsequent delivery takes place through the SMTP account configured in the protected backend.

The legal basis is Article 6(1)(b) GDPR, where the inquiry concerns entering into or performing a contract. For other business inquiries, Article 6(1)(f) GDPR is the legal basis; the legitimate interest consists of handling and responding to business communications. Consent is not required for ordinary contact requests.

We delete data processed in connection with an inquiry once it has been fully handled, provided no statutory retention requirements or other legitimate grounds for further storage apply. Recipients may include Host Europe GmbH as the hosting provider and the email service provider used for the SMTP account.

5. Technically necessary sessions

Separate, technically necessary PHP sessions with random security tokens are used to protect the contact form and process scanner. The session cookies apply only to the same website, cannot be accessed by JavaScript and expire at the end of the browser session. They are not used for analytics or advertising.

6. No analytics or marketing services

This website release does not embed external web fonts, tracking services, advertising networks, social media pixels or marketing cookies.

7. Your rights

Subject to the GDPR's requirements, your rights include, in particular, access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent you have given at any time with effect for the future.

To exercise your rights, simply send a message to info@pauderer.de.

8. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. For non-public-sector organisations in Bavaria, the competent authority is generally the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

9. Automated decision-making

No automated decision-making within the meaning of Article 22 GDPR takes place. The output of the process scanner is a non-binding preliminary assessment.