Privacy Policy — Karim Belarbi

The controller responsible for data processing on this website within the meaning of Art. 4 No. 7 GDPR is: Karim Belarbi, Alte Karlsruher Straße 38, 76227 Karlsruhe, Germany. Email: E-Mail.

Hosting: This website is hosted on a virtual private server (VPS) operated by Strato AG, Pascalstraße 10, 10587 Berlin, Germany. All processing of the website itself takes place exclusively on servers located in the EU.

Content Delivery Network & Security (Cloudflare): The hosting origin sits behind a CDN operated by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare proxies incoming requests, accelerates delivery of static assets and protects against attacks (DDoS, bot filtering, Web Application Firewall). For this purpose Cloudflare processes technical connection data such as IP address, user agent, requested URL and timestamp.

As Cloudflare is based in the USA, Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR apply, together with a Data Processing Agreement under Art. 28 GDPR. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and performant operation of the website). See Cloudflare's privacy policy.

Server logs: On each request, the web server automatically writes a log entry containing: anonymized or shortened IP address, date and time of the request, the requested URL, HTTP status code, referrer, user agent (browser and operating system). These logs are used exclusively to ensure the technical operation, troubleshoot errors and defend against attacks. They are deleted automatically after no more than 14 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable and secure operation).

When you use the contact form, the data you enter (name, email, optional company, optional budget range, message) is processed exclusively to handle your inquiry and any follow-up.

For email delivery we use Resend (Drei Plus One Labs, Inc.), 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend acts as a processor under Art. 28 GDPR. As Resend may transfer data to the USA, Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR are in place.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures / performance of contract) for the content of the inquiry; Art. 6(1)(f) GDPR for the use of Resend as the technical delivery channel. Inquiry data is stored until the matter is concluded; tax-relevant correspondence is retained for the statutory periods (6 / 10 years per § 257 HGB, § 147 AO). See Resend's privacy policy.

On the page /website-checker you can request a free analysis of your own website. The following data is processed for this purpose: name, email, optional phone number, industry and the URL to be analyzed.

Processing steps:

• —The URL you submitted is technically retrieved and analyzed (see Section 5 — AI Processing).
• —The resulting report is sent to you by email via Resend (see Section 3).
• —Your contact details and the analysis summary are transferred to our CRM system (see Section 6 — Odoo CRM) so we can follow up.

Legal basis: Art. 6(1)(a) GDPR (your explicit consent given by submitting the form) and Art. 6(1)(b) GDPR (pre-contractual measure on your request). You may withdraw your consent at any time by emailing E-Mail; this does not affect the lawfulness of processing carried out before withdrawal.

The website analysis described in Section 4 is generated by a large language model operated by Anthropic PBC, 548 Market Street PMB 90375, San Francisco, CA 94104, USA. The URL you submitted (and content publicly retrievable from it) is transmitted to Anthropic; your personal contact details (name, email, phone) are not transmitted.

As Anthropic is located in the USA, Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR apply. Anthropic does not use input or output for model training by default. Legal basis: Art. 6(1)(b) GDPR (performance of the analysis you requested). See Anthropic's privacy policy.

Contact requests and Website-Checker submissions are stored in an Odoo CRM instance hosted on our own server within the European Union. No data is transferred to Odoo S.A. or other third parties through this. The CRM records contain: name, email, optional phone, optional company, type of inquiry, internal notes.

Legal basis: Art. 6(1)(b) GDPR (handling of the inquiry) and Art. 6(1)(f) GDPR (legitimate interest in structured customer relationship management). Records are deleted once the underlying inquiry is concluded and no statutory retention periods apply.

At /tools/website-speed-check we offer a free online tool that lets you measure the load performance of any publicly accessible website. The URL you enter is transmitted server-side to the Google PageSpeed Insights API operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA). Google runs a Lighthouse analysis in the background and returns the resulting metrics (Performance, Accessibility, Best Practices, SEO, as well as LCP, FCP, CLS and TBT).

The transmission to Google takes place exclusively server-to-server; your IP address is not disclosed to Google in this process. Only the URL you submitted is sent. For transfers to the USA, Google uses Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR. The PageSpeed Insights API does not set cookies on your device.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a free, useful analysis tool) and, in addition, Art. 6(1)(b) GDPR insofar as you actively requested the analysis. See PageSpeed Insights API documentation and Google's privacy policy.

This website uses Google Analytics 4, a web analytics service by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA). Google Analytics uses cookies to analyze website usage. The data generated (anonymized IP address, device and browser data, referrer, page views, events) is generally transmitted to a Google server and stored there.

IP anonymization is enabled (anonymize_ip: true), so your IP is truncated before transmission within the EU/EEA. For transfers to the USA, Google uses Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.

Google Analytics is only loaded after you have given explicit consent via our cookie banner. Legal basis: Art. 6(1)(a) GDPR (consent) and § 25(1) TDDDG (formerly TTDSG). You may withdraw consent at any time by clearing your browser's site data or by clicking "Decline" on a subsequent visit. See Google's privacy policy.

Form content transmission: If you have given consent, we additionally transmit certain submitted form fields to Google Analytics as custom events of type form_submit. Transmitted are: (a) URLs or domains you enter into the online tools (Speed-Check, Tracker-Check, Email-Security-Check, Security-Headers-Check, Accessibility-Check, AI-Crawler-Check, Tech-Stack-Check, Website-Audit, KI-Readiness-Check), (b) the inputs from the Website-Checker (name, industry, URL, plus the email as a pseudonymized SHA-256 hash) and (c) the inputs from the contact form (name, optional company, service, optional budget, a 30-character preview of the message together with its total length, plus the email as a pseudonymized SHA-256 hash). The full message text, your phone number and any other fields beyond those listed are not transmitted to Google. The email address is hashed in your browser before transmission, so Google does not receive its plain value. Withdraw consent at any time via "Cookie settings" in the footer; the analytics opt-out (ga-disable) is applied immediately. This data is sent to Google in the USA. Without your consent no such transmission occurs.

Legal basis for form-content transmission: Art. 6(1)(a) GDPR (your consent via the cookie banner). You may withdraw consent at any time with effect for the future.

This website stores the following information in your browser:

• —Local Storage — key cookie_consent stores your consent choice ("all" or "none") so the banner is not shown again. Strictly necessary. Legal basis: § 25(2) No. 2 TDDDG.
• —Cloudflare cookie (__cf_bm) — short-lived cookie (approx. 30 minutes) used by the CDN to detect automated bot traffic. Required for secure operation. Legal basis: § 25(2) No. 2 TDDDG, Art. 6(1)(f) GDPR.
• —Google Analytics cookies (_ga, _ga_*) — only set after you accept analytics. Lifetime up to 24 months. Legal basis: § 25(1) TDDDG, Art. 6(1)(a) GDPR.

The contact page provides a WhatsApp link. When you click this link, you are forwarded to WhatsApp; data processing is then carried out by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, in accordance with WhatsApp's privacy policy. Use of WhatsApp is voluntary. Legal basis for the link integration: Art. 6(1)(f) GDPR (legitimate interest in offering a quick contact option).

This website uses the fonts Syne, Figtree and JetBrains Mono. They are automatically self-hosted via next/font and loaded by the browser directly from this domain. There is no connection to Google Fonts or any other external font service, and no data is transmitted to third parties.

We store personal data only as long as necessary for the purpose for which it was collected, or as long as required by statutory retention obligations (in particular § 257 HGB and § 147 AO — 6 or 10 years for tax-relevant correspondence and accounting records). Server logs are deleted after no more than 14 days; CRM records of inquiries that did not lead to a contract are deleted after 12 months at the latest.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21) regarding your personal data. Where processing is based on consent, you may withdraw that consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, please contact: E-Mail. You also have the right to lodge a complaint with a supervisory authority — typically the one in your member state of habitual residence or workplace. The authority competent for the controller is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

This website uses HTTPS (TLS) for encrypted transmission of all data. We take appropriate technical and organizational measures pursuant to Art. 32 GDPR to protect your personal data against unauthorized access, loss or destruction.

We reserve the right to update this privacy policy to comply with changes in legal requirements or to reflect changes in our services. The current version is always available at this URL.