Privacy policy

Phillipp Bertram Bristolring 50 49090 Osnabrück Germany

Email: me@phillippbertram.de

The controller is the individual who operates this website.

I process personal data only as necessary to operate this website, respond to inquiries, maintain technical security or improve the service.

The relevant legal bases are, in particular, Article 6(1)(b) GDPR where processing is necessary for pre-contractual measures or handling an inquiry, Article 6(1)(f) GDPR for legitimate interests in the secure and user-friendly operation of the website, and Article 6(1)(c) GDPR where legal obligations apply.

The website is hosted by Vercel. When you access it, technically necessary connection data is processed, such as your IP address, the date and time of access, the URL requested, referrer, browser and operating system information, and status and error messages.

This processing serves to deliver the website and maintain stability, error analysis and security. The legal basis is Article 6(1)(f) GDPR.

This website uses Vercel Web Analytics. According to the provider, page views and usage data are collected anonymously and without cookies. Analysis is aggregated and used to improve the website’s technology and content.

The chat also records anonymous events, such as starting a conversation, clicking a suggestion, submitting feedback or encountering an error. These do not contain message content, chat identifiers or IP addresses.

The legal basis is Article 6(1)(f) GDPR. My legitimate interest is in privacy-friendly usage analysis and improving the website.

When you use the chat, the messages you enter, a technical chat ID and the preceding conversation context are processed to generate a response and continue the conversation.

The conversation is held in your browser’s session storage (sessionStorage) so that it survives a page reload. It is deleted when you close the tab or start a new chat. With each message, your browser sends the recent conversation to the server, where the history is not cached.

The assistant keeps a project brief based on the information you share, such as your goal, the systems involved and your timeline. You can view, correct and clear it in the chat. It is also held only in your browser’s session storage, sent to the server and OpenAI with each message, and used in an inquiry draft. It is only saved as part of an inquiry that you send yourself.

Chat responses are generated using the OpenAI API and OpenAI Agents SDK. Your message and the included history are sent to OpenAI for this purpose, and to suggest possible follow-up questions beneath a response. Logs of these processes (traces) are stored in my OpenAI account for troubleshooting. Please do not enter confidential, particularly sensitive or legally protected information in the chat.

At your request, the assistant creates an inquiry draft from the conversation. The conversation history is also sent to OpenAI for this purpose. The draft is displayed only in your browser and is only sent if you submit it yourself (see ‘Inquiries through the chat’).

Depending on the inquiry, the legal basis is Article 6(1)(b) GDPR for pre-contractual communication or Article 6(1)(f) GDPR for providing a useful interaction on the website.

You can send Phillipp an inquiry directly through the chat. Your name, email address, optional company name, inquiry text and technical chat ID are processed to respond to it. It is only sent when you explicitly consent and click ‘Send to Phillipp’.

The inquiry is sent by email through Resend (Resend, Inc., USA) as a processor, using servers in the EU. Standard contractual clauses are in place for possible transfers to the USA. You will not receive an automatic confirmation email; Phillipp will reply personally.

The chat log in Airtable records only that an inquiry was sent for a chat ID, without your name or email address.

The legal basis is Article 6(1)(b) GDPR, as the inquiry is intended to initiate a working relationship. It remains in the mailbox for as long as necessary to handle it and possible follow-up inquiries, and is then deleted unless statutory retention obligations apply.

In the production environment, chat messages are stored in Airtable. In particular, the chat ID, message role, message content and technical environment context are stored.

If you rate a response as ‘Helpful’ or ‘Not helpful’, the rating, chat ID, a technical identifier for the response and a short excerpt of the rated response are also stored in Airtable.

Storage serves to handle and trace inquiries, assure quality and improve the chat. The legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.

To prevent automated abuse of the chat, Vercel BotID checks whether chat requests come from a real browser. Your browser solves an invisible challenge, during which Vercel analyses technical characteristics of your browser and device as well as your IP address. Its service provider Kasada also participates in the advanced check.

The number of chat requests per time period is also limited. A hash is derived from your IP address and stored with a counter at Upstash (Upstash, Inc.) in a database in the EU (Frankfurt). The IP address itself is not stored there. Entries expire within 24 hours at the latest.

The legal basis is Article 6(1)(f) GDPR. My legitimate interest is in operating the website securely and protecting the chat against abusive use and the costs it causes.

If you contact me by email, I process the data you provide to respond to your inquiry and handle possible follow-up questions.

Appointment booking links to Calendly. If you use this external service, Calendly processes the data you enter there, particularly contact details, appointment information and technical usage data. Calendly’s privacy information applies to processing on the Calendly website.

This website links to external services such as LinkedIn, GitHub and Calendly. When you open one of these links, the respective providers may process personal data. I have no control over that processing.

Personal data is deleted or restricted as soon as the purpose of processing no longer applies and no statutory retention obligations or legitimate interests require further storage.

Communication and chat data may be stored for as long as necessary to handle the inquiry, trace communication, assure quality or fulfil legal obligations.

The conversation history in your browser is deleted when you close the tab or start a new chat. Entries used to limit chat requests expire within 24 hours at the latest.

Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability and objection to certain processing. Where processing is based on consent, you may withdraw that consent at any time with effect for the future.

To exercise your rights, you can contact me@phillippbertram.de at any time.

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law. In Lower Saxony, the State Commissioner for Data Protection of Lower Saxony is a relevant authority.