Privacy Policy

1. Controller
Kerem Önal, ÖNALTECH
Drygalski-Allee 117
81477 München, Germany
Email: kontakt@oenaltech.de · Phone: 0173 5668773

2. Summary
This website sets no cookies, uses no analytics or marketing services and loads no content from third-party servers when you visit it. We only process personal data as far as necessary to deliver the website, for the AI chat ÖNAI, the contact form or communication by email. A consent banner is therefore not required.

3. Hosting and delivery (Cloudflare)
The website and its server functions run on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary connection data such as IP address, time, requested address, browser and device information in order to deliver the pages and protect them against attacks. The legal basis is our legitimate interest in providing the website securely and quickly (Art. 6(1)(f) GDPR). We have a data processing agreement with Cloudflare. For transfers to the USA, Cloudflare relies on the EU-U.S. Data Privacy Framework and additionally on the European Commission’s Standard Contractual Clauses.

4. AI chat “ÖNAI”
Only if you actively use the chat do we send your messages, the conversation so far (at most the last 20 messages) and the page language to the AI provider Anthropic to generate a reply. Our contractual partner is Anthropic Ireland, Limited (Ireland); processing may also take place through Anthropic, PBC in the USA. According to its terms, Anthropic does not use this data to train its models. The transfer to the USA is based on Anthropic’s data processing addendum with Standard Contractual Clauses. We do not store the conversations ourselves; the history is kept only in your browser’s memory and is gone when you close or reload the page. Please do not enter sensitive data in the chat. ÖNAI is an AI and can make mistakes.
To limit misuse and costs, we count chat messages per day. For this, we store a pseudonymized hash value at Cloudflare for 24 hours, derived from your IP address, the date and a secret key. The IP address itself is not stored.
The legal basis is Art. 6(1)(b) GDPR insofar as you are finding out about our services or preparing an inquiry, and otherwise our legitimate interest in answering questions and preventing misuse (Art. 6(1)(f) GDPR). The “Send inquiry by email” button only opens your own email program; nothing is sent until you click send yourself.

5. Contact form
If you use the contact form, we process your name, email address and message and, if you provide them, your company and the service you are interested in. Technically, the page language and the time taken to fill in the form are added. The data is transmitted via our host Cloudflare to the email delivery service Resend (Plus Five Five, Inc., USA), which delivers it as an email to our mailbox. The content is not stored on the website itself. We have a data processing agreement with Resend; for transfers to the USA, Resend is certified under the EU-U.S. Data Privacy Framework.
To prevent spam, we check whether a field invisible to humans has been filled in and how quickly the form was submitted. We also limit the number of inquiries per day; for this, we store a pseudonymized hash value of IP address, date and a secret key for 24 hours, not the IP address itself.
The legal basis is Art. 6(1)(b) GDPR (inquiry and pre-contractual measures), and otherwise our legitimate interest in replying and preventing misuse (Art. 6(1)(f) GDPR).

6. Contact by email or phone
If you contact us by email or phone, we process your details to handle your inquiry (Art. 6(1)(b) or (f) GDPR). Our mailbox is operated by checkdomain GmbH in Lübeck, Germany, with whom we have a data processing agreement.

7. Retention
We delete inquiries made via the form, email or phone once they have been fully handled, unless statutory retention obligations (for example under commercial or tax law if an order results) prevent this. The counters for the daily limits of the chat and the form expire automatically after 24 hours.

8. Fonts
All fonts are hosted on our own server. No connection to Google or other font providers is established when you visit the website.

9. Link to Instagram
We link to our Instagram profile. We do not embed any content from Instagram; data is only transferred to Meta once you click the link and leave our website. Meta’s privacy policy then applies.

10. Encryption
The website is delivered exclusively over an encrypted connection (HTTPS).

11. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). To exercise them, simply write to kontakt@oenaltech.de. You can also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us, the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

12. Obligation to provide data
You are not obliged to provide us with any data. Without the required fields in the form, however, we cannot accept your inquiry there; you can always reach us by email instead. No automated decision-making within the meaning of Art. 22 GDPR takes place.

13. Last updated
October 2026. We update this policy when the website or the services used change.

Note: The German version of this privacy policy is the legally binding one; this English text is a convenience translation.