§Legal

Privacy policy

What data this website processes, for what purpose, on what legal basis, who is involved and how long we keep it. This is a translation for convenience; the German version is legally binding.

As of: 27 October 2026

Controller

The controller responsible for data processing on this website is:

headon
Owner: Onur Cirakoglu
Am Vogelsberg 8
97922 Lauda-Königshofen
Germany

Email: hallo@headon.pro
Phone: +49 176 63040241

You can reach us at these details for any questions about data protection and to exercise your rights.

Summary

We do not use cookies for analytics or advertising. In your browser we only store what you trigger yourself: your choice between light and dark design, a federal state chosen in the live excerpts of our products, the progress of the AI check from your first answer while the tab is open and the sign-in cookie of the KI-Pass team version.
Analytics run with Rybbit on our own server – without cookies, without storing anything in your browser and without recognising you across other websites.
Our server is in Nuremberg, our database in Frankfurt am Main. The website and the analytics are delivered directly from this server, with no service in between.
Enquiries are deleted automatically after one year.
The AI assistant “Ask headon” uses the language model Claude by Anthropic. What you enter there is transmitted to Anthropic for this purpose.

Hosting and delivery

Server

The website and our analytics instance run on a server operated by Hetzner Online GmbH in its Nuremberg data centre. Hetzner processes the data on our behalf. Transmission between your browser and the website is encrypted via TLS.

Purpose: Providing the website, operation and security
Data: All data arising from use: IP address, requested address, time, browser and device information, form input
Legal basis: Art. 6(1)(f) GDPR – legitimate interest in secure and reliable operation
Recipient: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as processor (Art. 28 GDPR)
Third country: No transfer

Logs

Our web server does not write access logs for this website. The application logs technical error messages so that we can fix faults; IP addresses are not recorded.

Retention: error logs are overwritten continuously once they reach 15 MB (three files of 5 MB each) and are deleted completely with every website update.

Abuse protection

To protect forms and the AI assistant against automated abuse, we count requests per IP address – at most five form submissions, 20 chat messages and 30 downloads from the policy generator per hour. The IP address is kept only in the server’s memory for this purpose, is not linked to other data and is deleted automatically after the 60-minute window. Forms also contain a field invisible to humans that helps us recognise automated input.

The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in keeping services available and preventing abuse.

Analytics with Rybbit

To understand which content is used and where the website falls short, we use the analytics tool Rybbit, which we run ourselves on our Hetzner server (rybbit.headon.pro); the data is not passed to any other provider.

Rybbit sets no cookies. We do not load Rybbit’s own script; our pages send the data themselves and store nothing in your browser while doing so. A visit is only counted once you move the mouse, tap the page or press a key, or the page has been visible for three seconds. Rybbit recognises a visit by a hash of IP address, browser identifier and a random value that changes daily; this hash differs for each of our websites, so Rybbit does not recognise you across other websites. If your browser sends the “Global Privacy Control” signal, our pages send nothing to Rybbit. No analytics run on the invitation pages and the verification pages for records of KI-Pass Team, because their address contains an invitation code or a record identifier.

Purpose: Statistical analysis of use, improvement of content and technology
Data: Pages viewed (the address without the part after “#”; of the parameters only campaign details and the origin from one of our own websites) with page title, referrer, browser, operating system, device type, the country and the network operator (derived from the IP address, for example your internet provider; we do not record region, city, screen size or language), time of the views, clicks on buttons, that an enquiry was sent (only via which form, without its content), clicks on links to external websites (their address only, without parameters), views of and clicks on the live excerpts of our products (only which excerpt), scroll depth, time on page (calculated from the times of the page views), load-time metrics and technical errors on the page (error type, shortened message, file, line and column – without address parameters and without anything you entered)
IP address: Not stored. It is only used to derive country and network operator and to form the hash that recognises a visit; to fend off automated access the server keeps it in memory for up to 24 hours.
Legal basis: Art. 6(1)(f) GDPR – legitimate interest in audience measurement and improving our offering
Recipient: None beyond Hetzner, which operates the server and is technically involved (see above)
Third country: No transfer
Retention: An automatic run deletes raw data after 12 months at the latest; daily backup copies on the same server after 14 days. Requests identified as automated are not counted and are logged separately for up to three months.

To respect an opt-out, our analytics code only reads the entry umami.disabled in your browser’s local storage (localStorage); if it is set, nothing is sent. The code writes nothing there. The name of the entry dates from the time with Umami and still applies.

Until 23 October 2026 we also counted with Umami (self-hosted); we deleted its raw data on 24 October 2026.

You can object to analytics at any time by enabling “Global Privacy Control” in your browser or by emailing us.

Fonts, images and videos

We serve fonts, images and videos from our own server. Fonts are embedded locally; no connection to Google Fonts or other font providers is made. Videos play without embedding services such as YouTube.

The load-time display at the bottom of each page is calculated in your browser only and is not transmitted.

Light or dark design

Without a choice of your own, the website follows your device setting (light or dark); nothing is stored. If you explicitly choose “Light” or “Dark” with the switch, your browser keeps this choice in local storage (localStorage, entry headon-thema with the value “hell” or “dunkel”) so that it applies on your next visit.

Purpose: Keep the appearance you chose
Data: Only the value “hell” (light) or “dunkel” (dark) – no personal data, no identifier
Storage location: Your browser only; the value is not transmitted to us or third parties
Legal basis: § 25(2) no. 2 TDDDG – strictly necessary for the setting you requested
Retention: Until you choose “System” (the entry is then deleted) or clear the site data in your browser

Live excerpts of our products

On the German page “Produkte” and in individual places on our other German pages we show live excerpts of our own products – for example the weather from Wetterzeile or the polling average from Wahllage – labelled “Zu Gast · aus unserem Haus” (a guest from our own house). The English pages do not show them. Our server fetches the data from the respective site of ours; your browser does not call any other domain for this. Only a fixed place – our office in Lauda-Königshofen as an example, or the town a regional page is about – or a federal state is passed along, nothing about you and never the location of your device. Fonts and styling of the excerpts are served from our own server.

What you enter in a mini calculator or tap in the sample questions stays in your browser and is not transmitted to us. If you open the full calculator from a mini calculator, your browser hands the entries over in the part of the address after the “#”; this part is not sent to any server.

Your browser loads some of the excerpts from headon.pro after the page has loaded: on the page “Produkte” the daily question of Die Nachtausgabe and the fuel rule of Tankzeile, so that they are correct at the time of your visit, and on the other pages every excerpt. At most the town of one of our regional pages is named in that request – nothing about you. We count anonymously with Rybbit how often an excerpt is seen and clicked (see “Analytics with Rybbit”) – without your entries.

Chosen federal state

If you choose another federal state in the Jahreszeile excerpt, your browser keeps the choice in local storage (localStorage, entry gast:land with the state’s abbreviation, for example “BY”) so that it applies on your next visit. The choice is not transmitted: your browser requests the school holidays and bridge days of all federal states from headon.pro at once and only picks your state on your device.

Purpose: Keep the federal state you chose
Data: Only the abbreviation of the federal state – no identifier
Storage location: Your browser only; the abbreviation is not transmitted to our server
Legal basis: § 25(2) no. 2 TDDDG – strictly necessary for the setting you requested
Retention: Until you clear the site data in your browser

Lab: pieces to try out

The pieces in the Lab run in your browser. What you set there – place, date, point in time, dedication – is not stored; it only appears in the link after the # sign if you copy and share it. This part of the address is not sent to our server when the page loads.

In the “Urort” piece, the “My location” button asks your browser for your location. Your browser asks for your permission first. The location is only used on your device, rounded to about one kilometre, and not transmitted to us or third parties.

Data a piece loads later is fetched by our server: in “Stromatem” the latest electricity market data from the Bundesnetzagentur (SMARD), in “Birthday weather” a weather station’s measurements from our storage at Supabase.

In “Birthday weather” our server receives from your browser only the chosen station and the calendar day (day and month) – and, as with every request, your IP address, which we do not store. Supabase only receives our server’s request for that station’s file, nothing from your browser. The year and the place you enter do not leave your device.

Contact by email or phone

If you contact us by email or phone, we process your details to handle your request. Our mailbox is operated by Google (Google Workspace) on our behalf.

Purpose: Handling your request and communicating with you
Data: Name, contact details, content and time of your message
Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract; otherwise Art. 6(1)(f) GDPR – legitimate interest in answering enquiries
Recipient: Google (Google Workspace) as processor
Third country: Processing by Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
Retention: Until your request has been fully handled. Statutory retention obligations, in particular under commercial and tax law, remain unaffected.

Contact form and enquiries

You can send us an enquiry via the contact form. We process enquiries arising from the AI assistant or the free website checks in the same way (see below).

Purpose: Handling your enquiry, preparing a quote
Data: Name, email address, company (optional), topic and message; for enquiries via the AI assistant possibly also project type, budget and timeframe, via the cost calculator your input there (see below); time and origin of the enquiry
Legal basis: Art. 6(1)(b) GDPR – pre-contractual measures at your request; Art. 6(1)(f) GDPR for internal organisation
Recipient: Supabase (storage), Resend (email notification to us and acknowledgement of receipt to you), Google Workspace (our mailbox) – details below
Retention: Automatic deletion after one year (daily deletion run), earlier on request. If a contract results, statutory retention periods apply.

Prioritisation

From details on project type, budget and timeframe we calculate an internal score that only determines the order of processing. There is no automated decision within the meaning of Art. 22 GDPR; a person reads every enquiry.

Storage with Supabase

We store enquiries in a database operated by Supabase in the Frankfurt am Main data centre. Our contractual partner and processor is Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. Because Supabase is based in Singapore, the processing is covered by the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR); the data itself is stored in Frankfurt am Main.

Email notification (Resend)

We also receive your enquiry as an email via the delivery service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). Resend is certified under the EU-US Data Privacy Framework (Art. 45 GDPR) and keeps delivery data for 30 days.

At the same time we send you an acknowledgement of receipt via Resend to the address you provided. It contains only the chosen topic, the response time and the next step, not your message.

Short notice via Telegram

So that we can respond quickly, we receive a short notice in our Telegram chat for each new enquiry. It only states that an enquiry has arrived and through which channel (such as the contact form) and contains no personal data. We read the enquiry itself in our mailbox and database.

AI assistant “Ask headon”

Via “Ask headon” in the page header or the shortcut ⌘K / Ctrl+K you can ask questions about our services.

You are talking to an AI system, not a person. The answers are generated automatically by the language model Claude by Anthropic. They may contain errors and are not binding; only our quotes are binding (notice under Art. 50(1) of the AI Act, Regulation (EU) 2024/1689).

Please do not enter sensitive data – such as health information, login credentials, bank details, trade secrets or personal data of third parties.

The conversation exists only in your open browser window and is gone after reloading. For each answer our server sends the conversation so far to Anthropic; we do not store it ourselves. If you give your name, email address and request in the conversation, the assistant creates an enquiry from it (name, email, short description and, where applicable, project type, budget and timeframe), which we treat like an enquiry via the contact form.

Purpose: Answering questions about our services; on request, creating an enquiry
Data: Your messages and the history of the current conversation
Legal basis: Art. 6(1)(f) GDPR – legitimate interest in answering questions quickly; Art. 6(1)(b) GDPR once you submit an enquiry via the assistant
Recipient: Anthropic Ireland, Limited, Dublin, Ireland, as processor; processing also takes place at Anthropic, PBC in the USA. According to Anthropic, content from the API is not used to train its models.
Third country: USA, based on standard contractual clauses (Art. 46(2)(c) GDPR)
Retention: We do not store the chat history. According to Anthropic, inputs and outputs are deleted within 30 days; in case of suspected policy violations Anthropic may keep them longer.

You do not have to use the assistant: you can reach us just as well by email or via the contact form.

Cost calculator

On the guide pages you can use a calculator to create a cost estimate and have it sent to you by email. Analytics (see “Analytics with Rybbit”) only records which step was reached, which project type is selected and that an enquiry was sent – no prices, no contact details, no other input.

Purpose: Creating and sending the cost estimate, handling your enquiry
Data: Name and email address, company and message (optional); your input in the calculator: the project, the selected requirements (such as custom design, content management, login, interfaces, multiple languages, accessibility) and the desired start; the calculated range and an internal prioritisation score
Legal basis: Art. 6(1)(b) GDPR – pre-contractual measures at your request
Recipient: Supabase (storage), Resend (sending the estimate to you and the notification to us), Google Workspace (our mailbox) – see above
Retention: Automatic deletion after one year, earlier on request

Free website checks

For the AI visibility check you provide your website address, your email address and optionally your name and industry. This creates an enquiry like the contact form, with an acknowledgement of receipt to your address; we send you the results by email.

For the accessibility check our server retrieves the public source code of the given address and analyses it automatically; you see the result immediately. Data is stored only if you voluntarily provide your email address – we then create an enquiry with the address and the result.

Purpose: Carrying out and sending the analysis, follow-up questions if needed
Data: Website address, email address, name and industry (optional), analysis result
Legal basis: Art. 6(1)(b) GDPR – pre-contractual measures at your request
Recipient: As for the contact form (Supabase, Resend, Google Workspace)
Retention: Automatic deletion after one year, earlier on request

KI-Pass: AI check and policy generator

The AI check in the KI-Pass (German only) evaluates your answers in your browser. Unless you request a report, we do not receive your answers; from your first answer until you close the tab they are kept in your browser’s session storage (strictly necessary for the service you use, § 25(2) no. 2 TDDDG); “Neu beginnen” (start again) clears it. In the KI-Pass, analytics only records: that a check was started or finished (with maturity level and company size class), that a report was requested (whether sending worked and whether you asked to be contacted), that a policy was downloaded (Word or PDF) and that a link to a consulting service was clicked (which service) – no answers, no policy text, no email address, no name.

If you request the PDF report, you send us your email address, optionally your name and company, your answers and whether you would like us to contact you about an intro call. Our server creates the report, emails it to you and creates an enquiry like the contact form, including your result, company size, industry and AI tools used. We do not send newsletters.

With the policy generator, the text is created in your browser. To download it as Word or PDF, your browser sends the text to our server, which generates the file and returns it immediately. The text is not stored.

Purpose: Creating and sending the report, handling your enquiry and, on request, contacting you; generating the policy file
Data: Report: email address, name and company (optional), your answers, the result, your contact request, time. Policy: the text you download
Legal basis: Art. 6(1)(b) GDPR – sending the requested report and pre-contractual measures; Art. 6(1)(f) GDPR for internal organisation and generating the policy file
Recipient: Supabase (storage), Resend (sending the report and our notification), Google Workspace (our mailbox); the policy file is generated on our own server at Hetzner
Retention: Enquiry: automatic deletion after one year, earlier on request. Policy: not stored. Answers in the browser: until you close the tab

KI-Pass team version

In the team version of the KI-Pass (German only), a company creates an account and invites staff by link or QR code. Sign-in is passwordless: you receive a sign-in link by email via Supabase’s authentication service, sent through Resend. After signing in, your browser stores a strictly necessary sign-in cookie (§ 25(2) no. 2 TDDDG): sb-…-auth-token (split into parts ending in .0, .1 for long session data) holding your session. It lasts until you sign out, at most 400 days.

The company is the controller for its staff data; we process it on its behalf (Art. 28 GDPR). Each company only sees its own data. The public verification page of a record shows company name, date, period, number of measures and people and the checksum – no names.

Purpose: Providing the team version: sign-in, training units, policy acknowledgement, AI tool register, records of AI literacy measures
Data: Sign-in account: email address and sign-in times. In the team: name, email address, role, date joined; completed training units with date, duration, topics and result; policy acknowledgements with timestamp; tool register entries with the reporting person; records and audit folders with participants’ names (without results); name of the person concluding the data processing agreement. For admins also: invitations created (the link stored only as a hash), published policies and, for paid tiers, plan and payment provider IDs
Legal basis: Art. 6(1)(b) GDPR – contract with the company or use at its invitation; staff data processed on behalf of the company (Art. 28 GDPR)
Recipient: Supabase (database and sign-in, Frankfurt am Main), Hetzner (server), Resend (sign-in email) – see above; the company you belong to. For paid tiers, Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom, as reseller (merchant of record) and independent controller for payment data (adequacy decision, Art. 45 GDPR)
Retention: As long as the company uses the KI-Pass. If an admin removes you, your access ends; your completions, acknowledgements and generated records remain stored for the company’s records. If an admin deletes the company, all of its data is deleted immediately. We delete your sign-in account (email address) on request.

Service providers at a glance

These service providers process personal data on our behalf or receive it from us:

Provider	Task	Third country
Hetzner Online GmbH	Server	None (Germany)
Supabase Pte. Ltd. (Singapore)	Database and sign-in (stored in Frankfurt am Main)	Singapore – standard contractual clauses
Plus Five Five, Inc. (Resend)	Email delivery	USA – Data Privacy Framework
Google (Google Workspace)	Mailbox	USA – Data Privacy Framework
Anthropic	AI assistant	USA – standard contractual clauses
Paddle.com Market Limited	Payment for KI-Pass team (independent controller)	United Kingdom – adequacy decision

Providing your data is neither legally nor contractually required. Without the fields marked as mandatory, however, we cannot process an enquiry.

Client projects

Data that we process on behalf of our clients in client projects – for example in AI sprints or geodata analyses – is not covered by this policy; for this we conclude a data processing agreement with the respective client under Art. 28 GDPR.

Your rights

You have the right to

access the data stored about you (Art. 15 GDPR),
rectification of inaccurate data (Art. 16 GDPR),
erasure (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR).

Right to object: Where processing is based on Art. 6(1)(f) GDPR, you may object to it at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests.

An informal message to hallo@headon.pro is sufficient.

Complaint to the supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Heilbronner Straße 35, 70191 Stuttgart, Germany
Phone: +49 711 615541-0 · Email: poststelle@lfdi.bwl.de
www.baden-wuerttemberg.datenschutz.de

Changes

We update this policy when our services or the services we use change. The version published here applies.

As of: 27 October 2026

Provider details can be found in our legal notice.