Privacy

Draft. A legal advisor has not reviewed this text yet.

Last updated: 15 September 2026

This policy explains what personal data we process when you visit hn-ai.de, email us, or sign up for a session, and what rights you have.

In short

• This website sets no cookies and stores nothing on your device beyond what your browser needs to show the page.
• We use no analytics, no tracking, and no advertising.
• Every file on this website, including the fonts, comes from our own server. Your browser contacts no other service while you read it.
• Our web server keeps no access log of your visits.

Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

For anything about hn.ai, you can also write to heilbronn.ai@gmail.com. The same details are in our imprint.

Visiting this website

To send you a page, our server has to process your IP address and the technical details of your request: the requested address, date and time, and your browser's user agent. The server uses these data to deliver the page over an encrypted connection and keeps no access log.

For troubleshooting and to keep the server secure, the server's error log records failed connections, which can include your IP address. The server deletes log entries after 30 days.

Our server runs at netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. netcup processes data on our behalf under a data processing agreement (Art. 28 GDPR).

Legal basis: Art. 6(1)(f) GDPR. We have a legitimate interest in delivering this website securely and reliably.

Cookies and storage on your device

This website sets no cookies and reads no information from your device. Your browser may keep a copy of the pages in its cache and remember that the site uses an encrypted connection. Both are strictly necessary to show the page (§ 25(2) TDDDG). That is why it shows no consent banner.

Emailing us

Writing to us is voluntary. When you email us, we process your email address, your name if you give it, and the content of your message, to answer you. We delete your message once your enquiry is fully dealt with.

If you write to the controller's address at tum.de, the Technical University of Munich runs that mailbox. Our general mailbox runs on Gmail. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, provides the service and processes the emails as an independent controller under its own privacy policy. Google may process data in the United States. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection (Art. 45 GDPR).

Legal basis: Art. 6(1)(b) GDPR if your message concerns taking part in or working with hn.ai, otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in answering enquiries. We use Gmail based on our legitimate interest in a reliable mailbox that costs nothing (Art. 6(1)(f) GDPR).

Signing up for a session

The sign-up button takes you to Luma, an external event platform. Nothing is transferred to Luma before you click. On Luma's website, Luma's own privacy policy applies.

When you register for a session, we as the organiser receive the data you enter there, usually your name and email address. We use them to run the session and to tell you about changes to it. You need to register to take part in sessions that require registration.

TODO: Luma's legal entity and address, its role (our processor with a data processing agreement, or an independent controller), the basis for transfers outside the EU, the legal basis for our processing, and how long we keep registration data.

Our Instagram and LinkedIn profiles

Our links to Instagram and LinkedIn are plain links. This website does not embed either service, so neither receives any data before you click.

On our profiles, the providers process your data under their own privacy policies: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, for Instagram, and LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, for LinkedIn.

LinkedIn gives us aggregated statistics about visits to our page (Page Insights). LinkedIn Ireland and we are joint controllers for these statistics (Art. 26 GDPR). LinkedIn takes responsibility for providing them under its Page Insights Joint Controller Addendum. Legal basis: Art. 6(1)(f) GDPR, based on our legitimate interest in understanding how people find us. You can exercise your rights against LinkedIn or against us (Art. 26(3) GDPR); we pass requests about Page Insights on to LinkedIn.

Instagram also gives us aggregated statistics about our profile. TODO: state the role and legal basis for Instagram's statistics once the advisor has confirmed them.

Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR)
• have inaccurate data corrected (Art. 16 GDPR)
• have your data erased (Art. 17 GDPR)
• restrict processing (Art. 18 GDPR)
• receive your data in a portable format (Art. 20 GDPR)

Right to object: where we process your data based on legitimate interest (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation (Art. 21 GDPR). Write to heilbronn.ai@gmail.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work. The authority for the state where the controller lives is:

No obligation, no automated decisions

You do not have to give us personal data to read this website. Emailing us is voluntary, and registering is only needed to take part in a session that requires it. We make no automated decisions and do no profiling.

Changes

We update this policy when our website or our processing changes. The date at the top shows the current version.