Privacy notice

1. Controller

The controller responsible for data processing on this website is:

Name

Malte Poppensieker

Address

96 Kingly Building London N4 2GQ United Kingdom

Email

malte@aiproductconsultant.com

2. What this site does not do

Stated first because it removes most of the usual questions:

• No cookies are set by this website.
• No advertising or tracking pixels, and no tag manager. Visits are counted by a cookieless analytics service that stores nothing on your device — see section 3.
• Fonts are served from this site’s own domain, so no request is made to any font provider.
• No social media plugins or embeds. Links to external profiles are ordinary links and transmit nothing until you click them.
• No user accounts, and no newsletter.

Alongside the analytics script in section 3, every page loads the Cloudflare Web Analytics measurement script (static.cloudflareinsights.com). It sets no cookies and stores nothing on your device; it records load times and technical characteristics of the page view, not you. Legal basis: Art. 6 (1) (f) UK GDPR — the legitimate interest is monitoring how well the site is delivered. Cloudflare acts as processor, see section 4.

Beyond that, your browser makes no connection to any third-party server on account of this site unless you open the chat assistant.

3. Reach measurement (Umami)

Every page of this site loads Umami (Umami Software, Inc.), a privacy-focused analytics service used in its hosted form, Umami Cloud, to count visits. What it records:

• The page viewed and the referrer.
• Browser, operating system and device type.
• Country of the request — no city, no precise location.

The service works without cookies: nothing is stored on your device. Visits are distinguished by a pseudonymous hash that is discarded daily, so no profile forms across two days and nothing can be traced back to you as a person. Your IP address necessarily reaches Umami’s server with each request, but is used only to derive the country and that short-lived hash — it is not stored. The resulting statistics cannot be linked back to you as a person, and cannot be tied to a chat conversation.

Legal basis: Art. 6 (1) (f) UK GDPR. The legitimate interest is understanding which pages are read.

Umami Software, Inc. acts as processor under a data processing agreement. The workspace in use is set up in Umami Cloud’s EU region, and the statistics are stored there. Where support or administration may involve access from the US, that transfer is covered by the European Commission’s Standard Contractual Clauses.

4. Hosting and server log data

The site is hosted on Cloudflare’s network (Cloudflare, Inc.). Delivering a page necessarily means your IP address is processed by the hosting infrastructure, together with the usual request metadata: date and time, the page requested, referrer, browser and operating system identifiers, and the country the request came from.

Legal basis: Art. 6 (1) (f) UK GDPR. The legitimate interest is the secure, stable and performant delivery of the website and the defence against attacks.

Cloudflare acts as a processor under a data processing agreement. Transfers out of the United Kingdom are covered by the UK International Data Transfer Addendum.

Application logs written by this site deliberately contain no message content, no names and no email addresses, and store only a keyed hash of the IP address rather than the address itself. They are retained by Cloudflare for a few days and are not used to build any profile.

5. The chat assistant

The site offers an AI chat assistant ("Mini-Malte"). It loads nothing and processes nothing until you open it. Everything in this section applies only from that point.

What is processed when you use it:

• The messages you type, and the assistant’s replies.
• Your name and email address — only if you choose to give them so that a message can be passed on.
• A randomly generated session identifier.
• The language and domain you are using, and the country your request came from.
• A keyed hash of your IP address. The IP address itself is never stored.
• Technical metadata: timestamps, number of turns, and the estimated model cost of the conversation.

Purposes and legal basis: answering your questions about the services offered, and passing on a message if you ask for one. Where your enquiry relates to a possible engagement, the legal basis is Art. 6 (1) (b) UK GDPR (steps taken at your request prior to entering into a contract). Otherwise it is Art. 6 (1) (f) UK GDPR, the legitimate interest being to answer enquiries about the services offered and to protect the service from misuse.

Providing any of this is entirely voluntary. You are not required to use the assistant, and you can ask everything by email instead.

Recipients:

Cloudflare

Hosting, and storage of the conversation. Conversations are stored in a Cloudflare D1 database created with EU jurisdiction, so the data is held within the European Union.

Cal.com

If you ask the assistant to book a call, your name, email address and time zone are sent to Cal.com (United States) to create the appointment. See section 8.

Postmark

If you ask for a message to be passed on, the name, email address and message you gave are sent through Postmark (ActiveCampaign, LLC, United States) to deliver it as an email. Postmark receives nothing unless you use that feature. Transfers out of the United Kingdom are covered by the UK International Data Transfer Addendum.

OpenAI

The conversation, together with the assistant’s instructions, is sent to OpenAI to generate each reply. Storage on OpenAI’s side is switched off by this site for every request. OpenAI may still retain API content briefly for abuse monitoring under its own policy. OpenAI is based in the United States; transfers are covered by Standard Contractual Clauses.

Retention: conversations are kept for 24 months after the last message and then deleted automatically. The period exists so that a later follow-up can be matched to an earlier enquiry. If you would prefer yours deleted sooner, write to the address in section 1 — giving the email address you used in the conversation is enough to identify it — and it will be erased.

Only the technical metadata listed above, never the content of your messages, is used to improve the assistant. The legal basis for that is Art. 6 (1) (f) UK GDPR, the legitimate interest being to make the assistant more reliable.

The assistant is an automated system and can be wrong. It makes no decisions about you: it produces no automated decision with legal or similarly significant effect within the meaning of Art. 22 UK GDPR, and no profiling is carried out.

6. Spam protection (Cloudflare Turnstile)

Opening the chat loads Cloudflare Turnstile, a bot check, from challenges.cloudflare.com. It is used to stop the assistant being driven automatically at the site owner’s expense.

Legal basis: Art. 6 (1) (f) UK GDPR, the legitimate interest being protection against automated misuse.

Turnstile sets no cookie on this domain. It may set a cookie named __cf_bm in the context of challenges.cloudflare.com; Cloudflare classifies this as strictly necessary for its security function. Turnstile processes technical signals from your browser to distinguish humans from bots.

This is loaded only when you open the chat, never on an ordinary page view.

7. Contact by email

If you write by email, your address and the content of your message are processed in order to answer it. Legal basis: Art. 6 (1) (b) UK GDPR where the enquiry concerns a possible engagement, otherwise Art. 6 (1) (f) UK GDPR.

Email is handled through Google Workspace (Google Ireland Limited) as a processor. Messages passed on by the chat assistant are delivered through Postmark to the same mailbox — see section 5.

Correspondence is retained for as long as needed to deal with the matter, and thereafter where statutory retention periods require it.

8. Booking a call

Scheduling runs on Cal.com (Cal.com, Inc., United States). There are two ways it is used, and they differ:

• The booking links on the page are ordinary links. Nothing is transmitted to Cal.com until you click one, and no Cal.com embed or script is included in this site.
• The chat assistant can also look up free times and make a booking for you. If you ask it to, this site sends Cal.com the name, email address and time zone you gave it, in order to create the appointment — Cal.com then emails you the invitation. Nothing is sent unless you ask for a booking.

Legal basis for a booking made through the assistant: Art. 6 (1) (b) UK GDPR, since it is a step taken at your request. Cal.com processes data in the United States, relying on Standard Contractual Clauses or the EU-US Data Privacy Framework, and has appointed a representative in the EU under Art. 27. Its own privacy notice governs what happens to the appointment after that.

9. External links

This site links to external destinations, including LinkedIn and a CV file. Following any of them transmits data to the operator of that destination, governed by their own privacy notices. No responsibility is accepted for their content or their data handling.

10. Your rights

You also have the right to:

• access the personal data held about you (Art. 15 UK GDPR),
• have inaccurate data corrected (Art. 16 UK GDPR),
• have your data erased (Art. 17 UK GDPR),
• have processing restricted (Art. 18 UK GDPR),
• receive your data in a portable format (Art. 20 UK GDPR),
• object to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21 UK GDPR),
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these, write to the contact details in section 1. For a chat conversation, quoting the email address you used is enough to locate it.

11. Complaints

You may lodge a complaint with a supervisory authority, in particular in the country of your habitual residence, place of work, or the place of the alleged infringement.

If you are in Germany, that is the data protection authority of your federal state; in other EU member states, the supervisory authority responsible there. The controller is established in the United Kingdom, where the Information Commissioner’s Office is additionally competent (ico.org.uk).

12. Changes to this notice

This notice is updated whenever the site changes in a way that affects data processing. The version in force is the one published here.