§Legal

Privacy policy

What data this website processes, for what purpose, on what legal basis, who is involved and how long we keep it. This is a translation for convenience; the German version is legally binding.

As of: 8 October 2026

Controller

The controller responsible for data processing on this website is:

headon
Owner: Onur Cirakoglu
Am Vogelsberg 8
97922 Lauda-Königshofen
Germany

Email: hallo@headon.pro
Phone: +49 176 63040241

You can reach us at these details for any questions about data protection and to exercise your rights.

Summary

We do not use cookies for analytics or advertising. In your browser we only store what you trigger yourself: your choice between light and dark design, a federal state chosen in the live excerpts of our products, the progress of the AI check from your first answer while the tab is open and the sign-in cookie of the KI-Pass team version.
Analytics run with Umami on our own server – without cookies and without recognising you across other websites. In parallel we are testing Rybbit, a second analytics tool on the same server – likewise without cookies.
Our server is in Nuremberg, our database in Frankfurt am Main. The website and the analytics are delivered directly from this server, with no service in between.
Enquiries are deleted automatically after one year.
The AI assistant “Ask headon” uses the language model Claude by Anthropic. What you enter there is transmitted to Anthropic for this purpose.

Hosting and delivery

Server

The website and our analytics instance run on a server operated by Hetzner Online GmbH in its Nuremberg data centre. Hetzner processes the data on our behalf. Transmission between your browser and the website is encrypted via TLS.

Purpose: Providing the website, operation and security
Data: All data arising from use: IP address, requested address, time, browser and device information, form input
Legal basis: Art. 6(1)(f) GDPR – legitimate interest in secure and reliable operation
Recipient: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as processor (Art. 28 GDPR)
Third country: No transfer

Logs

Our web server does not write access logs for this website. The application logs technical error messages so that we can fix faults; IP addresses are not recorded.

Retention: error logs are overwritten continuously once they reach 15 MB (three files of 5 MB each) and are deleted completely with every website update.

Abuse protection

To protect forms and the AI assistant against automated abuse, we count requests per IP address – at most five form submissions, 20 chat messages and 30 downloads from the policy generator per hour. The IP address is kept only in the server’s memory for this purpose, is not linked to other data and is deleted automatically after the 60-minute window. Forms also contain a field invisible to humans that helps us recognise automated input.

The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in keeping services available and preventing abuse.

Analytics with Umami

To understand which content is used and where the website falls short, we use the open-source software Umami, which we run ourselves on our Hetzner server (analytics.headon.pro); the data is not passed to any other provider.

Umami sets no cookies, stores nothing in your browser and does not recognise you across other websites. We load the analytics script only after you have been on the page for at least three seconds and interacted with it. If your browser sends the “Global Privacy Control” signal, we do not load it at all. No analytics run on the invitation pages and the verification pages for records of KI-Pass Team, because their address contains an invitation code or a record identifier.

Purpose: Statistical analysis of use, improvement of content and technology
Data: Pages viewed, referrer, browser, operating system, device type, the country (derived from the IP address; we do not record region, city, screen size or language), time of day and weekday, clicks on buttons and external links (domain and path only), views of and clicks on the live excerpts of our products (only which excerpt), scroll depth, time on page (calculated from the times of the page views), load-time metrics and the type of technical errors (for example “TypeError”, without the error text)
IP address: Processed only briefly to derive the approximate location and a pseudonymous, regularly changing session identifier; not stored.
Legal basis: Art. 6(1)(f) GDPR – legitimate interest in audience measurement and improving our offering
Recipient: None beyond Hetzner, which operates the server and is technically involved (see above)
Retention: 12 months; older analytics data is deleted by a monthly automatic run.

In parallel we are testing Rybbit, a second, likewise self-hosted analytics tool (rybbit.headon.pro, on the same server); this data is not passed to any other provider either. Rybbit receives the same data as Umami and, in addition, the network operator derived from the IP address (for example your internet provider). Only Rybbit additionally receives which link to an external website was clicked (its address only, without parameters) and, if a technical error occurs on the page, the error type, a shortened message, file and line – without address parameters and without anything you entered. We do not load Rybbit’s own script; our pages send the data themselves – without cookies and without storing anything in your browser. A visit is only counted once you move the mouse, tap the page or press a key, or the page has been visible for three seconds. Rybbit recognises a visit by a hash of IP address, browser identifier and a random value that changes daily. The IP address itself is not stored; to fend off automated access the server keeps it in memory for up to 24 hours. Requests identified as automated are not counted and are logged separately for up to three months. Raw data is deleted here too after 12 months at the latest. The legal basis is likewise Art. 6(1)(f) GDPR. If your browser sends the “Global Privacy Control” signal, nothing is sent to Rybbit either; Rybbit does not run on the invitation pages and the verification pages of KI-Pass Team either.

You can object to analytics at any time by enabling “Global Privacy Control” in your browser or by emailing us.

Fonts, images and videos

We serve fonts, images and videos from our own server. Fonts are embedded locally; no connection to Google Fonts or other font providers is made. Videos play without embedding services such as YouTube.

The load-time display at the bottom of each page is calculated in your browser only and is not transmitted.

Light or dark design

Without a choice of your own, the website follows your device setting (light or dark); nothing is stored. If you explicitly choose “Light” or “Dark” with the switch, your browser keeps this choice in local storage (localStorage, entry headon-thema with the value “hell” or “dunkel”) so that it applies on your next visit.

Purpose: Keep the appearance you chose
Data: Only the value “hell” (light) or “dunkel” (dark) – no personal data, no identifier
Storage location: Your browser only; the value is not transmitted to us or third parties
Legal basis: § 25(2) no. 2 TDDDG – strictly necessary for the setting you requested
Retention: Until you choose “System” (the entry is then deleted) or clear the site data in your browser

Live excerpts of our products

On the German page “Produkte” and in individual places on our other German pages we show live excerpts of our own products – for example the weather from Wetterzeile or the polling average from Wahllage – labelled “Zu Gast · aus unserem Haus” (a guest from our own house). The English pages do not show them. Our server fetches the data from the respective site of ours; your browser does not call any other domain for this. Only a fixed place – our office in Lauda-Königshofen as an example, or the town a regional page is about – or a federal state is passed along, nothing about you and never the location of your device. Fonts and styling of the excerpts are served from our own server.

What you enter in a mini calculator or tap in the sample questions stays in your browser and is not transmitted to us. If you open the full calculator from a mini calculator, your browser hands the entries over in the part of the address after the “#”; this part is not sent to any server.

Your browser loads some of the excerpts from headon.pro after the page has loaded: on the page “Produkte” the daily question of Die Nachtausgabe and the fuel rule of Tankzeile, so that they are correct at the time of your visit, and on the other pages every excerpt. At most the town of one of our regional pages is named in that request – nothing about you. We count anonymously with Umami and Rybbit how often an excerpt is seen and clicked (see “Analytics with Umami”) – without your entries.

Chosen federal state

If you choose another federal state in the Jahreszeile excerpt, your browser keeps the choice in local storage (localStorage, entry gast:land with the state’s abbreviation, for example “BY”) so that it applies on your next visit. The choice is not transmitted: your browser requests the school holidays and bridge days of all federal states from headon.pro at once and only picks your state on your device.

Purpose: Keep the federal state you chose
Data: Only the abbreviation of the federal state – no identifier
Storage location: Your browser only; the abbreviation is not transmitted to our server
Legal basis: § 25(2) no. 2 TDDDG – strictly necessary for the setting you requested
Retention: Until you clear the site data in your browser

Contact by email or phone

If you contact us by email or phone, we process your details to handle your request. Our mailbox is operated by Google (Google Workspace) on our behalf.

Purpose: Handling your request and communicating with you
Data: Name, contact details, content and time of your message
Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract; otherwise Art. 6(1)(f) GDPR – legitimate interest in answering enquiries
Recipient: Google (Google Workspace) as processor
Third country: Processing by Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
Retention: Until your request has been fully handled. Statutory retention obligations, in particular under commercial and tax law, remain unaffected.

Contact form and enquiries

You can send us an enquiry via the contact form. We process enquiries arising from the AI assistant or the free website checks in the same way (see below).

Purpose: Handling your enquiry, preparing a quote
Data: Name, email address, company (optional), topic and message; for enquiries via the AI assistant or the calculator possibly also phone number, project type, budget and timeframe; time and origin of the enquiry
Legal basis: Art. 6(1)(b) GDPR – pre-contractual measures at your request; Art. 6(1)(f) GDPR for internal organisation
Recipient: Supabase (storage), Resend (email notification to us and acknowledgement of receipt to you), Google Workspace (our mailbox) – details below
Retention: Automatic deletion after one year (daily deletion run), earlier on request. If a contract results, statutory retention periods apply.

Prioritisation

From details on project type, budget and timeframe we calculate an internal score that only determines the order of processing. There is no automated decision within the meaning of Art. 22 GDPR; a person reads every enquiry.

Storage with Supabase

We store enquiries in a database operated by Supabase in the Frankfurt am Main data centre. Supabase processes the data as a processor. If Supabase accesses the data from outside the EU in individual cases, for example for support, this is based on standard contractual clauses (Art. 46(2)(c) GDPR).

Email notification (Resend)

We also receive your enquiry as an email via the delivery service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). Resend is certified under the EU-US Data Privacy Framework (Art. 45 GDPR) and keeps delivery data for 30 days.

At the same time we send you an acknowledgement of receipt via Resend to the address you provided. It contains only the chosen topic, the response time and the next step, not your message.

Short notice via Telegram

So that we can respond quickly, we receive a short notice in our Telegram chat for each new enquiry. It only states that an enquiry has arrived and through which channel (such as the contact form) and contains no personal data. We read the enquiry itself in our mailbox and database.

AI assistant “Ask headon”

Via “Ask headon” in the page header or the shortcut ⌘K / Ctrl+K you can ask questions about our services.

You are talking to an AI system, not a person. The answers are generated automatically by the language model Claude by Anthropic. They may contain errors and are not binding; only our quotes are binding (notice under Art. 50(1) of the AI Act, Regulation (EU) 2024/1689).

Please do not enter sensitive data – such as health information, login credentials, bank details, trade secrets or personal data of third parties.

The conversation exists only in your open browser window and is gone after reloading. For each answer our server sends the conversation so far to Anthropic; we do not store it ourselves. If you give your name, email address and request in the conversation, the assistant creates an enquiry from it (name, email, short description and, where applicable, project type, budget and timeframe), which we treat like an enquiry via the contact form.

Purpose: Answering questions about our services; on request, creating an enquiry
Data: Your messages and the history of the current conversation
Legal basis: Art. 6(1)(f) GDPR – legitimate interest in answering questions quickly; Art. 6(1)(b) GDPR once you submit an enquiry via the assistant
Recipient: Anthropic Ireland, Limited, Dublin, Ireland, as processor; processing also takes place at Anthropic, PBC in the USA. According to Anthropic, content from the API is not used to train its models.
Third country: USA, based on standard contractual clauses (Art. 46(2)(c) GDPR)
Retention: We do not store the chat history. According to Anthropic, inputs and outputs are deleted within 30 days; in case of suspected policy violations Anthropic may keep them longer.

You do not have to use the assistant: you can reach us just as well by email or via the contact form.

Cost calculator

On some guide pages you can use a calculator to create a cost estimate and have it sent to you by email. Analytics (see “Analytics with Umami”) only records which step was reached, which project type is selected and that an enquiry was sent – no prices, no contact details, no other input.

Purpose: Creating and sending the cost estimate, handling your enquiry
Data: Name, email address, phone number, company and message (optional), your input in the calculator, the calculated estimate and an internal prioritisation score
Legal basis: Art. 6(1)(b) GDPR – pre-contractual measures at your request
Recipient: Supabase (storage), Resend (sending the estimate to you and the notification to us), Google Workspace (our mailbox) – see above
Retention: Automatic deletion after one year, earlier on request

Free website checks

For the AI visibility check and the SEO check you provide your website address, your email address and optionally your name and industry. This creates an enquiry like the contact form, with an acknowledgement of receipt to your address; we send you the results by email.

For the accessibility check our server retrieves the public source code of the given address and analyses it automatically; you see the result immediately. Data is stored only if you voluntarily provide your email address – we then create an enquiry with the address and the result.

Purpose: Carrying out and sending the analysis, follow-up questions if needed
Data: Website address, email address, name and industry (optional), analysis result
Legal basis: Art. 6(1)(b) GDPR – pre-contractual measures at your request
Recipient: As for the contact form (Supabase, Resend, Google Workspace)
Retention: Automatic deletion after one year, earlier on request

KI-Pass: AI check and policy generator

The AI check in the KI-Pass (German only) evaluates your answers in your browser. Unless you request a report, we do not receive your answers; from your first answer until you close the tab they are kept in your browser’s session storage (strictly necessary for the service you use, § 25(2) no. 2 TDDDG); “Neu beginnen” (start again) clears it. In the KI-Pass, analytics only records: that a check was started or finished (with maturity level and company size class), that a report was requested (whether sending worked and whether you asked to be contacted), that a policy was downloaded (Word or PDF) and that a link to a consulting service was clicked (which service) – no answers, no policy text, no email address, no name.

If you request the PDF report, you send us your email address, optionally your name and company, your answers and whether you would like us to contact you about an intro call. Our server creates the report, emails it to you and creates an enquiry like the contact form, including your result, company size, industry and AI tools used. We do not send newsletters.

With the policy generator, the text is created in your browser. To download it as Word or PDF, your browser sends the text to our server, which generates the file and returns it immediately. The text is not stored.

Purpose: Creating and sending the report, handling your enquiry and, on request, contacting you; generating the policy file
Data: Report: email address, name and company (optional), your answers, the result, your contact request, time. Policy: the text you download
Legal basis: Art. 6(1)(b) GDPR – sending the requested report and pre-contractual measures; Art. 6(1)(f) GDPR for internal organisation and generating the policy file
Recipient: Supabase (storage), Resend (sending the report and our notification), Google Workspace (our mailbox); the policy file is generated on our own server at Hetzner
Retention: Enquiry: automatic deletion after one year, earlier on request. Policy: not stored. Answers in the browser: until you close the tab

KI-Pass team version

In the team version of the KI-Pass (German only), a company creates an account and invites staff by link or QR code. Sign-in is passwordless: you receive a sign-in link by email via Supabase’s authentication service, sent through Resend. After signing in, your browser stores a strictly necessary session cookie (§ 25(2) no. 2 TDDDG).

The company is the controller for its staff data; we process it on its behalf (Art. 28 GDPR). Each company only sees its own data. The public verification page of a record shows company name, date, period, number of measures and people and the checksum – no names.

Purpose: Providing the team version: sign-in, training units, policy acknowledgement, AI tool register, records of AI literacy measures
Data: Sign-in account: email address and sign-in times. In the team: name, email address, role, date joined; completed training units with date, duration, topics and result; policy acknowledgements with timestamp; tool register entries with the reporting person; records and audit folders with participants’ names (without results); name of the person concluding the data processing agreement. For admins also: invitations created (the link stored only as a hash), published policies and, for paid tiers, plan and payment provider IDs
Legal basis: Art. 6(1)(b) GDPR – contract with the company or use at its invitation; staff data processed on behalf of the company (Art. 28 GDPR)
Recipient: Supabase (database and sign-in, Frankfurt am Main), Hetzner (server), Resend (sign-in email) – see above; the company you belong to. For paid tiers, Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom, as reseller (merchant of record) and independent controller for payment data (adequacy decision, Art. 45 GDPR)
Retention: As long as the company uses the KI-Pass. If an admin removes you, your access ends; your completions, acknowledgements and generated records remain stored for the company’s records. If an admin deletes the company, all of its data is deleted immediately. We delete your sign-in account (email address) on request.

Service providers at a glance

These service providers process personal data on our behalf or receive it from us:

Provider	Task	Third country
Hetzner Online GmbH	Server	None (Germany)
Supabase	Database (Frankfurt am Main)	Only for access from outside the EU – standard contractual clauses
Plus Five Five, Inc. (Resend)	Email delivery	USA – Data Privacy Framework
Google (Google Workspace)	Mailbox	USA – Data Privacy Framework
Anthropic	AI assistant	USA – standard contractual clauses
Paddle.com Market Limited	Payment for KI-Pass team (independent controller)	United Kingdom – adequacy decision

Providing your data is neither legally nor contractually required. Without the fields marked as mandatory, however, we cannot process an enquiry.

Client projects

Data that we process on behalf of our clients in client projects – for example in AI sprints or geodata analyses – is not covered by this policy; for this we conclude a data processing agreement with the respective client under Art. 28 GDPR.

Your rights

You have the right to

access the data stored about you (Art. 15 GDPR),
rectification of inaccurate data (Art. 16 GDPR),
erasure (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR).

Right to object: Where processing is based on Art. 6(1)(f) GDPR, you may object to it at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests.

An informal message to hallo@headon.pro is sufficient.

Complaint to the supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Heilbronner Straße 35, 70191 Stuttgart, Germany
Phone: +49 711 615541-0 · Email: poststelle@lfdi.bwl.de
www.baden-wuerttemberg.datenschutz.de

Changes

We update this policy when our services or the services we use change. The version published here applies.

As of: 8 October 2026

Provider details can be found in our legal notice.