Privacy Policy
This page describes, in plain terms, what happens with personal data when you visit anylai.eu or use the contact form, kept to what this site actually does.
Data controller
The data controller is Luiz Claudio Hogrefe, a private individual running AnyLAI, a non-commercial research and development project. To reach the controller, use the contact form linked on the Impressum page or the email address below.
Hosting
This site runs on our own server in the European Union, hosted with Hetzner Online GmbH, Germany. Hetzner processes the underlying infrastructure on the controller's behalf, as a data processor.
Server logs
Every request is logged by the hosting infrastructure with the usual technical fields: IP address, timestamp, requested path, status code, and user agent, kept for operational security and stability. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service). These logs are not merged with any other data set. They are held in a rolling buffer of at most 250 MB per service (five files of 50 MB), and the oldest entries are deleted automatically as new ones arrive, so how long a given entry survives depends on how much traffic follows it rather than on a fixed calendar period.
Cookies
This site sets exactly one cookie, NEXT_LOCALE, which stores your chosen language so the site remembers it on your next visit. Storing it on your device is strictly necessary to provide the service you requested in the language you selected, so no consent is required for it under § 25(2) no. 2 TDDDG. Insofar as the cookie or the processing around it involves personal data, that processing rests on Art. 6(1)(f) GDPR, our legitimate interest in serving the site in the language you chose. There is no tracking cookie, no analytics script, no advertising pixel, no third-party embed, and no external font on this site: every resource this page loads comes from anylai.eu itself.
Contact form
If you use the contact form, we store the name, email address and message you provide, together with a salted, one way hash of your IP address and, where available, your browser's user agent, used only to detect abuse patterns. Legal basis: Art. 6(1)(a) GDPR, your consent, given by ticking the consent box before sending, and Art. 6(1)(f) GDPR (legitimate interest in preventing abuse). You can withdraw that consent at any time, with effect for the future. The form accepts no file upload. Every submission is written to our own database first and read by a human in an internal, authenticated panel; nothing is routed through a third party mailer. Messages we archive are deleted 180 days later.
Public feedback form
If you use the public feedback form, we store your contribution, the page or article it refers to and the version you read, and, only if you provide them, a display name, an organisation, an email address and a reference link. No IP address is stored with a contribution. To limit abuse, the server counts recent submissions per connection in memory only, under a key that cannot be turned back into the address and is discarded when the server restarts. Every contribution is read by a moderator before anything is published. It is published only if you ticked the publication box, and then only with the identity you chose: anonymous, name, or name and organisation. Your email address is never published and is used only to reply to you or to ask a clarifying question. Legal basis: Art. 6(1)(a) GDPR, your consent, for publication and for the optional details you provide, and Art. 6(1)(f) GDPR (legitimate interest in moderating the contributions this site receives and in preventing abuse).
A published contribution remains part of the public review record of the page or article it addresses, together with its status and any response. Once published, it may be indexed or archived by third parties, which this site cannot undo. You can ask at any time, through the contact form, for your name, organisation or email address to be removed, for a contribution to be taken off this site, or for its attribution to be corrected; each request is handled by a person, not automatically. Contributions that are not published are kept only for the review record and are deleted on request. The moderator is alerted to a new contribution by an internal message that contains none of its text and none of your details.
Likes on articles
Under each article you can press Like, and press it again to undo it. When you do, the server stores which article was liked, when, and a one-way hash of a random key. Your browser keeps the key itself in its local storage, only so that the button shows your like on your next visit and so that you, and nobody else, can undo it. No IP address, no name and no cookie is stored with a like, and the key is not linked to an account or to any other visit. Abuse is limited in the same way as for the feedback form: recent requests are counted per connection in memory only, under a key that cannot be turned back into the address. The page shows only the number of likes. The key is stored on your device only when you press the button and is strictly necessary to provide the function you asked for, so no consent is required under § 25(2) no. 2 TDDDG; the processing rests on Art. 6(1)(f) GDPR, our legitimate interest in showing how many readers liked an article and in preventing abuse. You can remove the key by undoing your like, or by clearing this site's data in your browser; in the second case the like stays counted, because nothing is left that connects it to your browser.
Voice feature (Any assistant)
The Any assistant widget on this site includes an optional voice feature. If you click the microphone, your browser asks for permission and then records your voice; that recording is uploaded to and processed entirely on our own server in the EU, transcribed to text, and discarded as soon as the transcription returns. Playback of Any's spoken answers works the same way and is always opt-in, never automatic. You can always type instead of speaking.
- Purpose
- To turn what you say into text so the assistant can answer the question you asked, and to turn its written answer back into speech when you ask for playback.
- Data
- The audio stream while it is being processed, the resulting transcription, and technical metadata: the language selected, the size of the audio received and how long processing took. The transcription itself is not written to our logs.
- Legal basis
- Art. 6(1)(a) GDPR, your consent, given by granting your browser's microphone permission and clicking the microphone button. Nothing is recorded unless you do both, and you can withdraw that permission in your browser at any time.
- Retention
- The raw audio is never written to disk: it is decoded in memory and released the moment transcription returns, so there is nothing left to retain. The technical metadata sits in the same rolling application log described under Server logs above, capped at 250 MB per service, with the oldest entries deleted automatically as new ones arrive.
- Processors and third parties
- None. Speech recognition and speech synthesis both run in our own container on our own server in the EU. Your browser's built-in speech recognition is deliberately not used anywhere on this site, because in some browsers it sends audio to the browser vendor.
Read aloud
Every page of this site can be read aloud, and every image on it described aloud, with the listen buttons on the page. This is optional and starts only when you press one of them; no microphone is involved. The text being read, which is the page's own text or the image's description, is sent to our own server in the EU and turned into speech there, with the same voices as the assistant. The server keeps the generated audio in memory, indexed by a fingerprint of the text rather than the text itself, so that the next reader of the same paragraph does not wait for it again; that memory is emptied whenever the server restarts. The feature's own log line records the language, the length of the text, whether the audio was already in memory and how long generating it took. To limit how many new clips one visitor can request, the server counts recent requests per IP address, in memory only. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in making the site's text available as speech to whoever asks for it). The request itself is logged like any other, as described under Server logs.
Voice commands
Every page also accepts spoken commands, such as “read the page” or “go to the blog”, through the microphone button beside the listen button or the keyboard shortcut. This is optional and records only after you press it; there is no wake word and no listening in the background. The recording, a few seconds at most, is sent to our own server in the EU together with the page's own words (its menu entries and headings, to help recognition), transcribed there in memory and discarded the moment the text is returned; neither the recording nor the transcript is stored. The log line records the language, the size of the recording and how long transcription took. Legal basis: Art. 6(1)(a) GDPR, your consent, given by allowing the microphone in your browser and pressing the button. Your browser stores two small preferences on your device for this feature, whether you have already seen its one-line explanation and whether you want spoken answers; storing them is strictly necessary for the function you asked for (§ 25(2) no. 2 TDDDG), they never leave your device, and clearing this site's data removes them. Every command can also be typed instead of spoken.
International data transfer
This site's hosting, database, and the contact form's processing all stay on our own server in the European Union. No data described on this page is transferred to a country outside the EU/EEA.
Your rights
Under the GDPR you have the right to access, rectify, erase, or restrict the processing of your personal data, to data portability, and to object to processing based on legitimate interest. Use the contact form to exercise any of these rights. You also have the right to lodge a complaint with a data protection supervisory authority; the authority for this location is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).
Notice for data subjects in Brazil (LGPD)
AnyLAI processes export documents originating from Brazilian exporters. If you are a data subject in Brazil, Brazil's Lei Geral de Proteção de Dados (LGPD) applies where its own scope rules reach the processing, and gives you rights under Brazilian law, including confirmation that processing takes place, access to your data, correction of incomplete or inaccurate data, anonymisation, blocking or deletion of unnecessary or unlawfully processed data, portability, deletion of data processed on consent, information about sharing, and the right to withdraw consent. That document data is processed in the European Union, in line with the sovereignty design described on the AnyLAI homepage; use the contact form for any LGPD request.
If a translation and the German original disagree, the German version governs.