privacy policy · datenschutzerklärung · política de privacidad

last updated · 2026-11-01

data controller · verantwortliche stelle · responsable del tratamiento

Caelith Labs, independent freelance work. Contact: julian@caelithlabs.com. Provider details: see the Legal notice.

scope · geltungsbereich · ámbito

This policy covers the website caelithlabs.com and any subdomain operated by Caelith Labs. It is written to comply with the EU GDPR (Regulation 2016/679), the German BDSG, and the Spanish LOPDGDD (LO 3/2018).

what I collect · welche daten · qué datos recopilamos

Caelith Labs runs no third-party analytics, no advertising trackers, no cookies, and no behavioural fingerprinting at this time. The only personal data processed:

Server logs (transient). When you visit the site, the hosting platform (Railway, EU region) records standard request metadata: IP address, user-agent string, requested path, response status, timestamp. Retention: ≤ 30 days.
Email contact. If you contact me via the mailto links on the site, your email address and message contents are stored in my mailbox at IONOS (EU-hosted) for as long as the operational conversation requires.
Lead-magnet form data. If you request a teardown, I process your email address, form source, campaign parameters, page path, timestamp, and delivery status so I can send the requested material and related follow-up emails. You can ask to be removed at any time.
Intake form data. If you send an intake request, I store your name, email, request, optional context, campaign tags, landing and referrer paths, and timestamp in my own database so I can review it and match it to a booking.
I use the intake details to reply about the requested work and arrange a call. A hashed IP is held temporarily to limit spam, and a notification may be sent to my inbox. If enabled, the form loads a Cloudflare spam check.
Checklist and update signup (double opt-in). If you sign up for the team AI audit checklist or the occasional email update, I process your email address, the language, the page and campaign parameters (UTM tags) you came from, the exact consent wording you accepted with its timestamp, your confirmation status, and a one-time confirmation token. I do not store your IP address for this. Purpose: to send you the checklist and, about every two weeks, a short update on AI in teams, and to prove your consent. Process: after you submit the form I send you one email with a confirmation link. Until you click it you are not subscribed and I send you nothing else. Retention: an unconfirmed signup is deleted automatically after 7 days. A confirmed subscription is kept until you withdraw. After you unsubscribe I keep only your address and the unsubscribe date, so that I do not email you again; write to me if you also want that deleted. Withdrawal: every email contains an unsubscribe link, and you can write to julian@caelithlabs.com at any time. Withdrawal does not affect the lawfulness of the processing before it.

fonts and assets · schriften und assets · fuentes y recursos

All fonts, images, and scripts are self-hosted on caelithlabs.com except the optional Cloudflare Turnstile spam check on the intake form. No requests are made to Google Fonts, Adobe Fonts, or gstatic.com.

legal basis · rechtsgrundlage · base jurídica

Server logs: legitimate interest in operating, securing, and debugging the site (Art. 6(1)(f) GDPR).
Email correspondence: pre-contractual / contractual measures or legitimate interest, depending on the conversation (Art. 6(1)(b) or (f) GDPR).
Lead-magnet delivery and follow-up: consent when you submit the form (Art. 6(1)(a) GDPR), plus legitimate interest in preventing abuse and keeping delivery records (Art. 6(1)(f) GDPR).
Checklist and update signup: your consent (Art. 6(1)(a) GDPR; section 7(2) no. 3 UWG for email marketing in Germany), given by ticking the consent box and confirming through the link I email you (double opt-in). I keep the record of your consent under Art. 6(1)(c) and (f) GDPR (accountability, Art. 7(1)).

website processors · auftragsverarbeiter · encargados (visitor data)

Railway Corp. - hosting infrastructure. EU region (europe-west4, Netherlands). Railway privacy policy.
Resend, Inc. - email delivery for requested lead magnets, signup confirmations and the email update. Resend privacy policy.
ManyChat, Inc. - social DM automation for keyword-based delivery when you request a teardown through Instagram or TikTok. ManyChat privacy policy.
IONOS SE - DNS, email hosting. Germany. IONOS privacy policy.
GitHub, Inc. - source code repository (no visitor data crosses GitHub). GitHub privacy.

No data is shared with advertising networks, social-media trackers, or analytics providers.

engagement sub-processors · auftragsverarbeiter im rahmen von engagements · subencargados durante contratos

For paid engagements (operations sprint · automation expansion · agent build), Caelith Labs acts as a processor for the client. The following sub-processors may be engaged depending on engagement scope. The full sub-processor list per engagement is enumerated in the engagement-specific DPA (Art. 28 GDPR), template at /artefacts/dpa-template.html.

Anthropic, PBC - Claude API (agent build engagements; LLM provider for production agents). USA, EU–US Data Privacy Framework certified. No model training on API inputs (Anthropic default). Anthropic privacy.
Attio Ltd. - CRM (operations sprint). EU-hosted. Attio privacy.
Calendly LLC - booking metadata (operations sprint). USA, SCCs. Calendly privacy.
Notion Labs, Inc. - project tracking. USA, SCCs. Notion privacy.
n8n GmbH - workflow automation (automation expansion). EU-hosted. n8n privacy.
Per-engagement vendor APIs (e.g., DATEV, Holded, Idealista, BiPRO, WhatsApp Business) - listed explicitly in the engagement-specific DPA before processing begins.

Visitors to caelithlabs.com are NOT processed by any of the engagement sub-processors above. They appear in this notice for full transparency about the provider's data-processing posture during paid engagements.

international transfers · datenübermittlung · transferencias internacionales

Hosting and database storage for the website are operated in the EU region. Some processors named above, including email-delivery, social-automation, and source-code providers, may process data in the United States under their published transfer safeguards, DPAs, SCCs, or applicable data-transfer frameworks. Lead-magnet email or social-DM data may be transferred to those processors when you request the material.

cookies · cookies · cookies

Caelith Labs uses zero cookies on this site. No first-party, no third-party, no analytics cookies, no consent banner. Should this ever change (e.g. if Plausible Analytics or similar is added), a consent layer compliant with the ePrivacy Directive and TTDSG will be deployed and this section updated.

your rights · ihre rechte · sus derechos

Under the GDPR you have the right to:

Access the data I hold about you (Art. 15)
Rectification of inaccurate data (Art. 16)
Erasure / "right to be forgotten" (Art. 17)
Restriction of processing (Art. 18)
Data portability (Art. 20)
Object to processing (Art. 21)
Withdraw consent at any time, where processing is based on consent (Art. 7(3))

To exercise any of these, write to julian@caelithlabs.com. I respond within 30 days.

complaint authority · beschwerdebehörde · autoridad de control

You have the right to lodge a complaint with the supervisory authority of your jurisdiction:

DE The data-protection authority of your federal state. Overview: BfDI · Landesbeauftragte.
ES Agencia Española de Protección de Datos: aepd.es.

changes to this policy · änderungen · cambios

Material changes will be reflected in the "last updated" date above. The site is small and the policy is stable; substantive updates are rare.

impressum · legal notice · aviso legal

Full operator and contact information: Legal notice.