// Privacy Policy
Manuel Heider, Im Steinig 9, 97877 Wertheim, Germany. Email: info@manuel-heider.com. Telephone: +49 151 29121482.
This notice covers website visits, enquiries, AI chat and the client area. Separate linked products have their own privacy notices.
Vercel Inc., USA, hosts this website. IP address, time, requested URL, browser and device information are processed to deliver the website and detect errors or attacks. The legal basis is Article 6(1)(f) GDPR: providing a secure and reliable service.
Technical logs are stored for the period required for their purpose. Providers outside the EEA may process international transfers, subject to Articles 44 et seq. GDPR and appropriate safeguards, in particular standard contractual clauses.
Submitting an enquiry provides your name, email address, optional company/project information and selected requirements. We use these to handle the enquiry, ask follow-up questions and prepare a quote. The legal basis is Article 6(1)(b) GDPR for pre-contractual enquiries, otherwise Article 6(1)(f) GDPR to respond to your message.
Enquiries may be stored in the internal client and enquiry system. Resend (Plus Five Five, Inc., USA) delivers confirmation and notification emails and receives sender, recipient and email content, including name and project information. If no contract follows, we delete the enquiry six months after handling is closed. The enquiry system checks unsuccessful closed enquiries against this deadline automatically each day. Related emails follow the same retention rule and are deleted separately. Contract and invoice records are exempt from this deadline where statutory retention duties apply.
Aria is an AI assistant providing initial guidance on Manuel’s services. Sending a message transmits your messages and the history needed for the answer server-side to Anthropic, PBC, USA. The website does not forward your visitor IP as a chat field; the API connection originates from our server.
The chat does not issue binding quotes, send emails or book appointments. Summaries appear in the chat. You submit enquiries through the contact form; appointments are completed in the external booking system.
For consultation and quality assurance, the bounded submitted history and displayed answer are stored in Supabase. Records include a pseudonymous session identifier, language, timestamps, message count, a brief description derived from messages and a simple sentiment classification. Contact details you enter form part of the message text. The identifier is not linked to a client account. New raw visitor IP addresses are not stored in these conversation records.
Supabase Pte. Ltd., Singapore, operates the database in the Ireland (EU) project region. This does not rule out provider or subprocessor access from other countries. Our conversation records become due for deletion 30 days after the last message and are removed by the daily cleanup. Technical maintenance does not extend this period. Backups follow the provider’s limited backup cycle; overdue deletions must be repeated after a restore.
Anthropic states that API inputs and outputs are normally deleted within 30 days. Suspected violations of usage policies or legal duties may result in longer provider retention. Deleting our Supabase records does not cause early deletion of these separate provider logs.
The legal basis is Article 6(1)(f) GDPR for providing and improving consultation, and Article 6(1)(b) GDPR for specific pre-contractual enquiries. Do not enter passwords, payment, health or other particularly sensitive data. AI answers can be incorrect.
For access, objection or deletion requests, email info@manuel-heider.com. If possible, provide the approximate time and topic to help identify the conversation. Statutory conditions and applicable retention duties remain relevant.
We use the existing Supabase database to limit automated AI chat requests. It stores an identifier derived server-side from the IP address using a secret key, a pseudonymous session identifier, request timestamps, and request and token counters. These protection records contain no chat text or raw IP addresses. Request windows cover up to one hour. An hourly cleanup removes expired identifiers, budget reservations after three days, and daily counters whose UTC date is more than three days old. Other forms may use IP-based identifiers for request limits. The legal basis is Article 6(1)(f) GDPR to prevent abuse, overload and disproportionate operating costs.
Supabase Auth processes login information and session tokens. We also process profile, project, support, document and invoice data for the working relationship. The legal basis is Article 6(1)(b) GDPR, and Article 6(1)(c) GDPR for statutory retention. Necessary authentication cookies maintain a secure session.
Payments use Stripe Payments Europe Ltd., Ireland, with possible processing by Stripe, Inc., USA. Necessary contact, billing, amount and payment data are processed there. You enter full card details with Stripe; this website does not receive them. The legal basis is Article 6(1)(b) GDPR.
Booking links lead to Cal.com or cal.eu. The provider processes your name, email address, appointment and optional details when booking. The chat’s server-side availability lookup does not send visitor messages to the calendar service. Appointment handling relies on Article 6(1)(b) GDPR.
Following the WhatsApp link leaves this website. WhatsApp’s privacy notice additionally applies to subsequent communication. Other external services have their own notices. Merely displaying a link does not send a message to these providers.
Your privacy choice is saved in local browser storage as cookieConsent. Language may be stored as a NEXT_LOCALE cookie. A sessionStorage entry remembers whether the chat introduction was dismissed. These necessary settings and authentication cookies serve requested functions (Section 25(2) TDDDG).
Google Analytics 4, Vercel Web Analytics and Vercel Speed Insights load only after consent. Change your choice using “Cookie Settings” in the footer. Declining after prior consent reloads the page to stop running analytics scripts and removes accessible Google analytics cookies for this site.
Google Analytics 4 is provided by Google Ireland Limited and processes usage, device and event data. It may set _ga and _ga_* cookies. Google states that GA4 does not log or store IP addresses; this does not make all other analytics data anonymous. Processing in the USA is possible.
Vercel Web Analytics and Speed Insights measure page views, browser/device information and loading performance. The provider states that Web Analytics uses no analytics cookies and uses short-lived derived identifiers. Both services require your consent here.
Optional analytics rely on Article 6(1)(a) GDPR and, where device access is involved, Section 25(1) TDDDG. Withdrawal applies going forward without affecting the lawfulness of earlier processing.
Subject to statutory conditions, you have rights of access, rectification, erasure, restriction and data portability. You may object to legitimate-interest processing for reasons relating to your particular situation. Consent can be withdrawn at any time for the future.
You may complain to a data protection authority, especially where you live or where an alleged infringement occurred. The authority responsible for the operator is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany. Contact us at info@manuel-heider.com.
Last updated: 13 October 2026
