Privacy notice

This notice tells you, in line with Articles 13 and 14 of the General Data Protection Regulation (GDPR), what personal data SPEKTRA processes, for what purpose, on what legal basis, who receives it and what rights you have. It covers the website spektra-sites.com and the work that follows an order.

1. Who is responsible

SPEKTRA — Raul Tatzber
Feldgasse 70/3, 2232 Deutsch-Wagram, Austria
Email: raultatzber@spektra-sites.com
A data protection officer is not required by law and none has been appointed.

2. Cookies and analytics

This website embeds no third-party analytics or advertising service — no Google Analytics, no pixels. How we measure ourselves is described further down in this section. Once you sign in, two technically necessary cookies are set: a session cookie holding a random key (__Host-spektra_session; we only keep a non-reversible check value of it) and a non-personal flag telling the interface that you are signed in (spektra_auth). Both expire after 30 days.

Security cookies around sign-in — all technically necessary, all limited to this domain: __Host-spektra_2fa remembers for at most ten minutes that your password was correct while you enter your second factor; __Host-spektra_webauthn protects a passkey sign-in or setup against replay for at most five minutes; __Host-spektra_admin_setup only exists while two-step sign-in is being set up in the admin area and lasts 15 minutes. __Host-spektra_geraet holds a random device identifier and recognises a device you have signed in on before (400 days). If you sign in from an unknown device, we send you a warning email so that you notice any access by someone else straight away. We only keep a non-reversible check value of the identifier, together with the date of the first and last sign-in; it is deleted with your account.

Two-step sign-in (optional; mandatory in the admin area): if you use a passkey, we store its public key, a counter and the name you gave it — the private key never leaves your device. If you use an authenticator app, we store the shared secret in encrypted form. Recovery codes are stored only as non-reversible check values. The purpose is to protect your account (Art. 6 (1) (b) and (f), Art. 32 GDPR); the data is deleted as soon as you remove the factor or delete your account.

There is also a language cookie (spektra_lang), set once you open a page in one of the languages or switch between German and English. It stores nothing but the value “de” or “en” — no personal reference, no identifier anyone could be recognised by. Without it you would land back on the German version on every visit even after switching to English. It expires after one year.

Without a cookie, directly in your browser (localStorageor sessionStorage), the site also only remembers display settings you choose yourself: whether you picked the light or dark appearance (spektra-theme), that you have already seen a usage hint (such as “Drag to turn” in the team section — only until you close the tab), and that you dismissed a hint in your account. These values contain no personal reference, never leave your device and can be deleted in your browser settings at any time.

When you look at one of our finished builds (case studies), one more cookie (spektra_vorbild) remembers for seven days which one — a value such as “charter” from our own list. No identifier, no random value, nothing anyone could be recognised by. If you order afterwards, we know which build to take our cue from for the first draft; if you do not, it simply expires. It never leaves our domain.

One case study, RASOLA, shows a fictional beer brand and therefore asks for your year of birth before you enter. The year is checked in your browser only and discarded at once. What is stored there (localStorage, key rasola:alter) is only that the question was passed, and until when — 30 days. The entry is never sent to us; you can delete it through your browser’s site data.

The STATIQ case study is a sample shop for a fictional fashion brand. So that the bag and wishlist survive as you click around, it stores in your browser (localStorage, key statiq:laden) the items you picked, the wishlist, the language and the number of the last simulated order. The checkout is only a demonstration: nothing is ordered, nothing is paid and nothing is sent to us or anyone else; an email address typed in there is not stored. You can delete the entry through your browser’s site data.

Legal basis for these cookies and the case-study entries (age check, bag): § 165 (3) of the Austrian Telecommunications Act 2021 (technically necessary for the service you asked for) and Art. 6 (1) (b) GDPR. No consent is needed for them. One more short-lived cookie appears only during a sign-in via Google (point 3 d), one when you use the assistant (point 7e) and one during a demo call with Mira (point 7i) — all three are described there.

Our own measurement — two levels

We want to know which pages are read, how far, where visitors leave, and at which point a form or chat is abandoned. We measure that ourselves, on our own servers, in two levels — both only with your consent:

• Level 1 — no cookie, no recognition. Your browser reports the page view, scroll depth (25/50/75/100 %), time on page, clicks on named buttons, whether a form or chat was started, completed or abandoned (only the name of the last field or phase, never any content), the language, a rough device class (phone / tablet / desktop) and the host of the page you came from (e.g. google.com, never the full address). Addresses carrying payment or invitation codes are turned into placeholders before reporting. The events of one visit are linked by a random key that lives only in your tab’s memory and is gone when you close it; nothing is stored on your device for this. For the report, however, your browser does read information from your device (window width as a rough class, referring site) — in the view of the European Data Protection Board this may fall within the notion of access under § 165 (3) of the Austrian Telecommunications Act 2021. Level 1 therefore only runs if you choose “Allow recognition” in the banner — with “Only what is necessary”, without a choice, or with Global Privacy Control set, we measure nothing at all. We do not store your IP address; we derive a check value from it that incorporates the calendar day, in order to count visitors per day. That value is a pseudonym, not an anonymous one: with our key, re-identification would be technically possible — we do not do it, and after 90 days the raw data is deleted. The legal basis is your consent (§ 165 (3) TKG 2021, Art. 6 (1) (a) GDPR), which you can withdraw at any time via “Cookie settings” in the footer. Level 1 also covers which step of the short Express request you reached (e.g. “step 2 of 4”, never the content of the fields), whether you opened the cancel dialog and — only while we are comparing two versions of a text, such as the wording of a button — which of the two versions was shown to you. Which version you see is random; without your consent nothing is measured or stored.
• Level 2 — only with your consent. If you choose “Allow recognition” in the banner, we set a cookie with a random identifier (spektra_besucher, 180 days). That lets us see whether you have been here before — nothing more: no name, no profile, no sharing. Legal basis: § 165 (3) TKG 2021 and Art. 6 (1) (a) GDPR. Your choice itself is stored in a cookie (spektra_messung, 180 days) so we do not ask again on every visit — that one is technically necessary. If you choose “Only what is necessary” or your browser sends the Global Privacy Control signal, we measure nothing — neither level 1 nor level 2. You can withdraw your consent at any time:

  You have not chosen yet — the banner appears on the next page load.

We delete the raw data of both levels after 90 days. Before that, we condense it into daily figures (views, visits, completions, abandonments per page) that no longer relate to a person, and only those go into our internal records. It is never merged with your customer account, even if you are signed in. We keep these daily, already condensed figures for up to two years in order to spot trends (for example whether a change to the site made a difference) — only as totals with no link to a person, never as raw data about individual visits.

On devices of our own team we additionally set the cookie spektra_intern (content just “1”, 2 years) so that our own visits are not counted. Visitors and customers do not receive it.

Anonymous counting of page views

In addition, our server counts, purely on the server side, how often a public page is delivered — without a cookie and without consent, because nothing is stored on your device or read from it in the process, and no personal data is stored. All that is stored is a single number per minute and page area (e.g. “/case-studies”: 4 views between 2:32 and 2:33 pm) — never your IP address, no device or browser identifier, no cookie and no session identifier. Attribution to a person or to a single visit is therefore not possible.

The server reads header fields of your request (such as the browser identifier) only at the moment of the request, so as not to count automated accesses (search-engine bots) and the browser’s own preload requests — they are not stored.

We do not count private areas this way: your account, payment and checkout pages, sign-in and registration, and the admin area.

The purpose is to see how much the website is used and how far it reaches. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure and efficient operation) — insofar as any personal data (your IP address) is briefly processed at all while delivering the page; only the anonymous figures named above are stored. Minute values are condensed into daily totals after 35 days.

Anonymous counting of landings by advertising source

If you reach the site through a link that carries a source label (for example from an Instagram ad, recognisable by “?quelle=…” in the address), our server only counts how often, on which day, from which source and in which page area someone landed — e.g. “26 Sep 2026, insta-dm, homepage: 12 landings”. On the request page we count in the same way how often each step of the request was reached and how often it was sent (e.g. “1 Oct 2026, meta-ad, step 2: 30”) — without your entries, without any identifier. Here too nothing is stored on your device or read from it, and no personal data is stored: no IP address, no device or browser identifier, no cookie, no session identifier. Attribution to a person or a single visit is not possible. The purpose is to see which advertising channels bring visitors; the legal basis is Art. 6 (1) (f) GDPR (legitimate interest in cost-effective advertising), insofar as any personal data is briefly processed while the page is delivered. We keep the daily figures for up to two years.

Anonymous counting of the homepage experiment

On the homepage we show one of several versions of the top section — which one is decided at random on every visit (versions that lead to a request more often are shown more often). Our server only counts on which day which version was delivered how often, how often the request was opened afterwards and how often it was sent, separated by the source label in the link (e.g. “?quelle=insta-bio”). Nothing is stored on your device or read from it and no personal data is stored: no cookie, no session or visitor identifier, no IP address, no device or browser identifier. Which version you saw only travels along as an invisible form field if you open the request yourself. The purpose is to keep improving the homepage so that it is clearer and brings more requests; the legal basis is Art. 6 (1) (f) GDPR, insofar as any personal data is briefly processed while the page is delivered. We keep the daily figures for up to two years. With your consent to measurement (above) we additionally see which version you saw within that measurement.

Anonymous counting of cancellation reasons

If someone cancels the short Express request and picks a reason with one click (e.g. “too expensive”), our server only counts how often each reason was picked on which day — and whether the person continued afterwards. Here too: nothing is stored on your device or read from it, and no personal data is stored, only a number per day and reason. The purpose is to improve the cancellation view. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a better, more honest request flow).

If you accept a one-time discount offer in doing so (section 7o), we additionally store normalised identifiers that are not readable as plain text (derived from your email address, company name, town/postcode, phone number) at your account, so that the same offer cannot arise a second time — more on that below.

This is different from our consent-based measurement further up in this section (levels 1 and 2): only that one shows “visits” — how many different people were there, not just how often a page was called up — and, as described there, it remains tied to your consent.

3. What we process and why

a) Visiting the site (server logs)

When you open a page, our hosting provider processes technically necessary access data (IP address, time, address requested, browser type). Purpose: secure and stable operation, and defence against attacks. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in running the website).

b) Your account

On registration: name, email address, optionally company and phone number, a password stored only as a hash (bcrypt), an automatically assigned customer number, and the time you accepted the terms and this privacy notice together with the version you accepted. We also process a time-limited confirmation code to verify your email address. Purpose: providing the account, protecting it from misuse, and being able to show that consent was given. Legal basis: Art. 6 (1) (b) GDPR (contract and pre-contractual steps); for misuse prevention, Art. 6 (1) (f) GDPR. Our offer is aimed at businesses and adults; you must be at least 14 years old to create an account (Section 4 (4) Austrian Data Protection Act); orders are governed by our terms.

c) Orders, payments and subscriptions

The services chosen, amounts, order number, status, payment and subscription data, and the time of every change you make yourself within the 30-minute editing window. Purpose: performing the contract, invoicing and bookkeeping. Legal basis: Art. 6 (1) (b) GDPR, and Art. 6 (1) (c) GDPR in conjunction with tax retention duties (§ 132 of the Austrian Federal Fiscal Code).

d) Project briefing

With every project enquiry (the chat at /start) and when you order a package, you answer questions about your project: your industry and what your business offers, the goal of the site, references you pick from our showcase, any existing website, the design direction you want, further references, content you already have, timing and budget range, plus — for Premium — the features you want, who will use them, systems to connect, data volume and what success looks like. Plus your optional personal message. Budget and timing are non-binding bands for orientation and optional on every enquiry. Purpose: building the first draft and quoting. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual steps and performance of the contract).

While you are filling in the form, your answers are kept locally in your browser only (sessionStorage), so that signing in halfway through does not lose them. They leave your device only when you submit, and are deleted from the browser afterwards.

The request form at /start adds one thing: while you fill it in, your entries are cached on your own device (localStorage) so that they survive reading the privacy notice, closing the tab, or coming back later. They stay with you, are never transmitted to us unless you submit, and are deleted immediately after submitting. A draft left behind expires by itself after 14 days.

The same applies to the order chat at /buy/chat, a chat interface equivalent to the configurator: your selection (package, extras, quantity, care plan), your briefing answers, your chosen contact method with the detail you gave for it, an optional note and any referral code you enter are cached on your device (localStorage) in the same way and discarded automatically after 14 days.

Your consent to this privacy notice is deliberately NOT restored — consent has to be given actively (Art. 4 (11) GDPR).

d2) Signing in and registering with Google

You can create an account either with an email address and password or through your Google account. If you choose Google, you are taken to Google and sign in THERE — we never see your Google password.

What reaches us: your email address, whether Google records it as verified, the name stored with Google, and a permanent identifier for your Google account. We request nothing beyond that — only the scopes “openid”, “email” and “profile”. Your contacts, calendar, files and photos stay out of reach.

What reaches Google: the fact that someone is trying to sign in to spektra-sites.com, along with your IP address and browser identifier. That is technically unavoidable the moment you ask Google to sign you in.

Legal basis: Art. 6 (1) (b) GDPR — contract or pre-contractual measure. Deliberately NOT consent: you want to sign in, and without this processing that would not work by the route you chose. Consent would be the wrong basis here, because you could withdraw it without the sign-in remaining possible.

Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Transfer to Google LLC in the USA cannot be ruled out; it is safeguarded by the standard contractual clauses and the EU-U.S. Data Privacy Framework (see section 8).

Retention: We store the identifier of your Google account for as long as your account exists — it is the key by which we recognise you next time. During the sign-in itself, one short-lived, signed cookie (__Host-spektra_google) sits on your device (protection against forged sign-ins); it expires after ten minutes and is deleted as soon as the process completes.

You can end the connection at any time by deleting your account (Account → Settings) or by writing to us. Independently of that, you can revoke access at Google itself, at myaccount.google.com/permissions.

e) How you want to be contacted

You choose how we get back to you: by email, by phone, by Zoom, or in person. Depending on your choice we process the detail needed for it:

• Phone: your phone number. If your profile does not have one yet, the number you give here is also saved to your account.
• Zoom call: the time window you prefer. We send the invitation by email; the meeting service itself is only used at the actual appointment, and its own privacy notice applies from then on.
• In person: the address where we meet. We only offer in-person appointments within roughly 20 km of Deutsch-Wagram. The address is used solely to arrange the appointment and get there, and is not passed to anyone else.

Legal basis: Art. 6 (1) (b) GDPR. These details are necessary for the route you chose — without them we cannot reach you that way. You can always choose email instead, which needs no additional data.

f) Enquiries through the forms

Name, email address, optionally phone and company, project details and your message. Purpose: answering and handling your enquiry. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual) or Art. 6 (1) (f) GDPR.

g) Outgoing email log

Every email the website sends you is logged before it goes out: recipient address, name, subject, text content, time, route and any error. Purpose: being able to trace what was sent and retry delivery when it fails. Legal basis: Art. 6 (1) (b) and (f) GDPR.

4. What flows where, and when

So that you can follow it concretely, here is what actually happens, in the order it happens:

• When you submit a form your entries travel over a TLS-encrypted connection to the hosting provider (Vercel) and are written straight into the database (Neon, EU region).
• Immediately afterwards (seconds) the website creates two records: an email in the outbox and an event for the backoffice.
• Within roughly 30 seconds the local backoffice (“SPEKTRA OS”) collects the outbox and sends the email to you — delivery runs through Google’s servers. If the controller’s computer is unavailable, the message stays in the website’s outbox until it can be delivered.
• Within roughly 3 minutes the backoffice collects the events. Your customer record, your order and a task are created or updated there — including customer number, preferred contact route, briefing and your message.
• In parallel a notification goes to the controller’s business address. It contains nothing but your customer number — no name, no address, no amount. The controller sees the details in the backoffice, not in an inbox.
• For an online payment you are taken to Stripe. We never enter or see payment credentials; Stripe returns only status, amount and reference numbers to us.
• For a payment in person the card is read through SumUp Tap to Pay. Card data is processed by SumUp alone; we receive amount, time and a transaction code.
• For a payment request you receive an email with a personal payment link. Clicking it opens a page showing the amount and the service; payment then runs through Stripe again (see section 7b).
• During ongoing work invoices, quotes and receipts are created in the backoffice. Those documents are stored in Google Drive, together with encrypted backups of the backoffice database.
• Only if the controller uses the AI assistant in the backoffice, the data queried for that purpose is transmitted to Anthropic (see section 6).

5. Where your data is stored

• Website database (account, orders, briefing, enquiries, outbox): Neon, data centre region inside the EU.
• Website operation and server logs: Vercel.
• Backoffice “SPEKTRA OS”: locally on a computer belonging to the controller in Deutsch-Wagram, Austria — not reachable from the public internet.
• Documents and encrypted backups: Google Drive.
• Business email and automated sending: the controller’s Google Workspace mailbox.
• Payment data: with Stripe (online) or SumUp (in person) only.
• Security counters (see section 7a): in the website database, for at most 48 hours.

6. Processing in the internal backoffice “SPEKTRA OS”

For managing orders, invoices and customers, your account, order and enquiry data is transferred automatically into SPEKTRA’s internal backoffice system (“SPEKTRA OS”). That system runs locally on a computer belonging to the controller in Austria and is not reachable from the public internet. Customer records, tasks, quotes, invoices and receipts are created there. Legal basis: Art. 6 (1) (b) and (c) GDPR.

If you delete your account on the website, the deletion is passed to the backoffice automatically and your personal data stored there is removed or — where retention duties apply — anonymised.

7. Recipients and processors

We pass data on only where it is necessary for the purposes named above. Data processing agreements under Art. 28 GDPR are in place, or being put in place, with the following providers:

• Vercel Inc. (USA) — hosting and delivery of the website. Data processed: access data and everything submitted through the site. In addition, a private file store (“Vercel Blob”, Frankfurt region) for files you upload or that we provide in your account (including invoices, agreements, photos and logos). The store is not publicly accessible; files are only delivered through your account or the backoffice after sign-in.
• Neon Inc. (USA, data held in the EU region) — running the database holding account, order and enquiry data.
• Stripe Payments Europe, Ltd. (Ireland) — handling online payments and subscriptions. Payment data such as card numbers is processed by Stripe alone and never reaches our servers. We offer card, Apple Pay, Google Pay, EPS bank transfer, SEPA Direct Debit and Link. If you choose Apple Pay or Google Pay, Apple or Google is also involved under their own privacy terms; with EPS the payment runs through your online banking. “Link” is Stripe’s fast checkout: only if you sign up for it yourself does Stripe store your payment details for future purchases, and Stripe is independently responsible for that. Stripe’s own privacy notice applies in addition.
• SumUp Limited (Ireland; technical processing by SumUp Payments Limited, United Kingdom) — handling card payments in person (Tap to Pay). Processed: amount, time, transaction code and the card data; the last of these is processed by SumUp alone and never reaches us. On request the receipt is sent to an email address or phone number you give. Legal basis: Art. 6 (1) (b) GDPR.
• Automated email sending — confirmation codes, welcome messages, acknowledgements, payment requests and payment or subscription confirmations are sent through the controller’s Google Workspace account (see Google Ireland Limited / Google LLC). Sending happens directly from the website’s server; the local backoffice does not need to be running. Transmitted: email address, name and the content of the message. No separate bulk-email provider is currently used.
• Google Ireland Limited / Google LLC — In the backoffice we use Google Drive to store business documents (invoices, receipts, agreements among others) and encrypted database backups. Those documents and backups may contain your name, contact details and order data. We also use Gmail to send business email to you and to read incoming messages. Legal basis: Art. 6 (1) (b) and (f) GDPR.
• Google Ireland Limited — signing in and registering through a Google account, if you choose that route (see section 3 d2). Transmitted: email address, name and an account identifier; only the scopes “openid”, “email” and “profile” are requested.
• Anthropic PBC (USA) — The backoffice offers an AI assistant that helps the controller with commercial analysis and drafting messages. When it is used, customer data (e.g. name, company, town, VAT ID), invoice and order data, and financial figures may be transmitted to Anthropic and processed there. Access runs through the business interface (API); according to the provider, data sent this way is not used to train AI models. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in running the business efficiently). You can object to this processing at any time (see section 11); we then handle your data without AI support.

Beyond that, data may go to tax advisers, authorities (in particular the tax office) and, in a dispute, to legal representatives, where the law requires it or it is necessary to enforce a claim.

7a. Protection against misuse (rate limiting)

To fend off automated attacks on accounts — password guessing, mass account creation, flooding someone else’s inbox with confirmation mails — the website counts failed attempts. In doing so, your IP address and the email address concerned are stored as a counter, along with the number of attempts and the time. No movement or usage profile results: all that is stored is that something failed, not what you looked at.

Legal basis: Art. 6 (1) (f) GDPR — a legitimate interest in the security of processing, which at the same time discharges the duty under Art. 32 GDPR. These counters are deleted after 48 hours at the latest.

7b. Personal payment links

For a payment request you may receive a personal link (an address of the form /pay/…). It contains a randomly generated secret and lets you pay without signing in. What sits on our servers is not the link itself but only a cryptographic checksum of it; the link cannot be reconstructed from what is stored. The page it opens deliberately shows only your first name, the amount and the service — no address, no phone number, no full email address. The link expires after 90 days; you can ask for a new one at any time, which invalidates the old one immediately.

7c. Enquiries through the case studies

If you pick a website from the case studies (/case-studies) or tap your industry there and start an enquiry from it, we process, in addition to your contact details: the industry you chose, the goals you ticked, and the website you liked. The sole purpose is to build the first draft to fit — without those details we would be starting from nothing. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual steps at your request).

There is no profiling: this information is not combined with other sources, not used to evaluate you as a person, and not passed to advertising networks.

7d. The agreement and your electronic signature

Before we start building, you sign an agreement in your account. In doing so we store:

• your typed full name and your drawn signature,
• the time of signing and which language version you signed,
• a checksum of the exact wording (SHA-256), so it stays provable later which version was in front of you,
• the three consents separately (use of your data, permission to show the work, early start under § 10 FAGG),
• IP address and browser identifier — for misuse prevention only, and only for 30 days. After that they are removed automatically; they are not needed to prove the signature.

Legal basis: Art. 6 (1) (b) GDPR (performing the contract) and Art. 6 (1) (c) GDPR (record-keeping duties). The permission to show the work is voluntary and rests on Art. 6 (1) (a) GDPR — you can withdraw it at any time with effect for the future, and it does not affect your website.

7e. The AI chat on the website

In the bottom corner of the website there is a chat bubble where you can ask questions about SPEKTRA — about what we offer, how we work, prices, payment or legal points. It is something DIFFERENT from the AI assistant in the backoffice described in section 7: this one is triggered by YOU, the visitor, with your own question.

Provider: Anthropic PBC (USA) — the same provider as in section 7, but reached through its own, separate technical connection here.

Only with an account and explicit consent. The chat can only be used once you have a SPEKTRA account and have confirmed there, once, that what you type may be sent to Anthropic to be answered. We record when you confirmed it and which version of this notice applied — that is the record required by Art. 7 (1) GDPR. The legal basis is your consent (Art. 6 (1) (a) GDPR; for transfers to the USA see section 8). You can withdraw it at any time with effect for the future; the chat is then closed to you, and nothing else about your account changes. If this notice changes, we ask again rather than carrying an old consent forward.

The chat marks itself as a machine — in the window header and above the input field. That is not politeness but Art. 50 of the EU AI Act (Regulation 2024/1689): anyone talking to an AI system has to know it.

What is transmitted: only the text you type into the chat field (and, if you keep asking, your earlier questions in the SAME conversation — the interface holds that history in your browser, not us). Plus a fixed, pre-written brief containing facts already public on this website (prices, process, legal text) — that is our own material, not data about you.

What is not transmitted: no name, no email address, no account data, no order history — even if you happen to be signed in, the chat does not know it. The request to Anthropic is sent directly from our own server; Anthropic sees OUR server’s address, not yours. No tracking link is created between your chat questions and the rest of your visit either — the signed cookie (spektra_ki_zaehler) that merely counts today’s questions (valid for at most two days, similar in kind to section 7a) stays on our server and is never passed on to Anthropic.

How long it is kept: we do not store the conversation itself in our database — neither the question nor the answer. The only thing kept is how many tokens were used in total per calendar month (a number, not text), to stay within a spending limit we set ourselves. How long Anthropic holds the transmitted text on its own side follows its own terms and privacy notice; according to the provider, data sent through this interface is not used to train AI models (as described for the backoffice assistant in section 7). If you choose to reach us directly through the follow-up form, the same rule applies as for any other enquiry (see section 3d and section 9) — that stores an email address and your message, with your express consent.

Legal basis: your consent when you open the chat (Art. 6 (1) (a) GDPR); without it nothing is sent to Anthropic. There is no automated decision-making within the meaning of Art. 22 GDPR: the chat makes no decision about you, concludes no contract and triggers no payment on its own — it answers questions, nothing more. And: the chat does not replace legal or tax advice. It summarises our own, already public legal text factually, but does not assess your individual situation — for a binding opinion, please consult a qualified professional.

7f. AI chatbots on our customers' websites

If you run an AI chatbot for your own website with us, we process your bot's settings (name, knowledge, behaviour, approved domains), your top-ups and the usage per bot and day in order to provide and bill the service (Art. 6 (1) (b) GDPR). You can only use the setup assistant and the preview after giving the consent described in section 7e; what you enter there is sent to Anthropic to be answered (section 7e).

For visitors to our customers' websites, the respective customer is the controller; we process their messages only on the customer's behalf (Art. 28 GDPR, see the data processing agreement). The privacy policy of the respective website applies. We do not store conversation content. To prevent abuse, we keep a non-reversible check value of the IP address that changes daily for no more than two days, plus only counts per bot and day (number of messages, tokens used, cost). The chat window sets no cookies; it remembers the conversation only for the current browser session in the browser's storage (sessionStorage), so the conversation is not lost when the visitor changes pages.

We keep top-ups and usage for as long as billing requires, and after that for as long as commercial and tax retention obligations require (usually seven years, § 132 BAO).

7g. Referral programme

If you take part in the referral programme (terms at /empfehlen/bedingungen), we additionally process for your account: your personal referral code, the time and version of your consent to the programme terms together with your confirmation that you are of age, your chosen payout method, optionally your bank details (IBAN and account holder), and for each referral its status, reward and payout. Purpose: running the programme and paying rewards (Art. 6 (1) (b) GDPR). We store the bank details encrypted and show them only shortened in your account. If the bank details change, we send you a confirmation email — without the number itself.

If the rewards paid to you exceed €900 in a calendar year, we additionally ask for your address and date of birth and store both encrypted: the address as a record of the payout (§ 132 of the Austrian Federal Fiscal Code), the date of birth for a report to the tax office under § 109a of the Austrian Income Tax Act, insofar as one is required for referral rewards — we pass it to the tax office only for that purpose (Art. 6 (1) (c) GDPR).

If someone referred you, we store on your account which code you came through, and the referral discount on your order (Art. 6 (1) (b) GDPR). The person who referred you learns nothing about you: for each referral they see only a number, its status (such as “ordered” or “paid”), the date and their reward — never your name, your contact details or what you ordered. We show you their first name on the referral page only if they have agreed to it.

To stop people referring themselves, when a reward becomes due we automatically compare the name, company, phone number and email address of the partner and the referred customer (Art. 6 (1) (f) GDPR — our legitimate interest in preventing abuse). A match decides nothing: it only means we check the referral personally before paying out (no automated decision within the meaning of Art. 22 GDPR). If a payment via Stripe is refunded in full, Stripe tells us; a reward not yet paid out then lapses.

We do not send invitations or promotional messages to anyone a partner names — the link is shared only by the partner themselves. Emails to partners contain no information about referred customers. For bookkeeping, we copy the partner's name, email address and code, the reward, the payout method and date into the internal back office (section 6), but not the bank details. We delete programme data together with your account; records of rewards paid out are kept as tax law requires (usually seven years, § 132 BAO).

7h. Course waitlist

If you join the waitlist for our (not-yet-finished) do-it-yourself course (the /kurs page), we process your email address, optionally your name, a personal invite code, where applicable the code you came through, and — for abuse prevention — your IP address. Purpose: to inform you by email about the course's progress (roughly every 100 sign-ups). The legal basis is your consent (Art. 6 (1) (a) GDPR), obtained by double opt-in — the sign-up only counts after you click the confirmation link in the email. You can unsubscribe at any time with one click at the foot of every email; we record your withdrawal in the consent ledger (point 7i). We delete the IP address after 30 days, and unconfirmed entries expire on their own. No sale and no payment takes place; the price shown is non-binding and cannot be bought today.

7k. Records of what you agreed to

Whenever you confirm something on this website — when registering, ordering, paying through a payment link, accepting your website, signing, using the AI assistant or the AI chatbot (including the data processing agreement), joining the referral programme, switching promotional emails on or off, and deleting your account — we record what you confirmed (the exact wording), when, which version of our legal texts applied, what it related to (such as the order number), and your name, email address and customer number at that time. We keep the IP address and browser identifier only for 30 days (misuse prevention); after that they are removed automatically. We also archive every version of our legal texts, so it remains provable which wording applied when.

Purpose: to be able to prove that contracts and consents were validly made (accountability under Art. 5 (2) and Art. 7 (1) GDPR) and to establish or defend legal claims. Legal basis: Art. 6 (1) (c) and (f) GDPR. A copy of each record is kept in our internal back office (section 6) and its backups (locally and in Google Drive). The records remain after your account is deleted for as long as claims can arise from them — at most seven years from the end of the year of the consent; after that we delete them (Art. 17 (3) (e) GDPR).

7i. Mira — the AI phone voice

Through the demo on this website you can call Mira, our AI phone voice, yourself (at most once a day, per browser). Businesses can also book Mira as a product for their own incoming calls; for that, the data processing agreement and section 8d of the terms apply in addition.

No recording. None. In Austria, recording a private conversation without consent is not only a data protection problem — it is a criminal offence under § 120 StGB. So it is built so that the question never comes up: the audio is turned into text as it passes through by your browser's speech recognition — depending on the browser, on the vendor's servers (Chrome: Google) — and then dropped; only text reaches us. There is nowhere in our system a recording could be kept.

What we keep from a call: How long it took, what it cost, and one sentence about what it was about — without names and without numbers. If you asked for a callback, we keep exactly what you gave us for that. Everything else is gone the moment you hang up.

Two separate legal bases: for the call itself — that it happens, is understood and answered — your consent is the legal basis (Art. 6 (1) (a) GDPR): before the first word, we show a box that is not pre-ticked, with the wording you agree to. If you expressly ask Mira for a callback, we process the details needed for that instead (name, callback number or email, business, what it is about, the time window you want) on the basis of a pre-contractual measure (Art. 6 (1) (b) GDPR) — the same as the contact preference in section 3e. The two are not mixed: without a callback request, nothing that could identify you is processed once you hang up.

Proof of consent: a demo call runs without an account. We still record that consent was given and to what: the time, which version of this text applied, the exact wording shown, and the server-side call identifier — deliberately without a name, an IP address or a browser identifier, because no account and no identity is needed for that (the record-keeping duty under Art. 7 (1) GDPR). If this text changes, an older consent no longer carries forward automatically — we ask again rather than reuse an old version.

Who helps process it: Anthropic (USA) for understanding and answering, ElevenLabs (USA) for the voice. Both act on our instructions under a data processing agreement and may not use the content for anything of their own. On the transfer to the USA, see section 8.

• Anthropic (USA) — language model
• ElevenLabs (USA) — voice output

Two further, independent brakes work against abuse. A daily counter per visitor (at most one call a day): only a non-reversible check value made from the IP address and a daily salt (HMAC) is stored for that, never the IP address itself. A signed cookie (spektra_mira_zaehler, valid for at most two days) additionally records that this limit has already been checked for this browser. Alongside it, a short-term brake against too many call attempts from the same address in a short time — the same general rate limit that also protects sign-ins and the AI chat (section 7a): here the IP address is stored for the length of that time window, not only as a check value.

Retention: Call data is deleted automatically after 30 days. Callback requests follow the retention of ordinary enquiries.

Your rights: You can hang up at any time — the button works immediately, not only at the end of a sentence. You can withdraw your consent at any time; it applies to future calls, since nothing is kept from past ones that there would be anything to withdraw. For access, correction or deletion relating to a specific call, write to us at the address in section 11, naming the time and roughly what it was about.

Mira makes no decision about you, concludes no contract and triggers no payment — nor any automated decision-making within the meaning of Art. 22 GDPR (see section 12). At most she arranges a callback appointment; a person decides whether and how SPEKTRA or a business follows up.

7j. Workshop — website changes with AI

When you describe a change to your website in your account, we process your request text, the files of your website needed for it (source code, no personal data of your visitors) and the result of the checks. The request text and the selected files are transmitted to Anthropic (USA, see section 8), which generates the change and pre-checks it legally; under its terms, Anthropic does not use this data for training. The change is stored in a branch of your website repository at GitHub, Inc. (USA) and built as a preview by Vercel, Inc. (USA). Legal basis: performance of the contract (Art. 6 (1) (b) GDPR). We log every publication with time, your customer number and the wording of your request (section 7k) — as proof of who approved which change. Editing jobs remain visible in the account for twelve months after completion — meaning after your decision, release or discarding — credit bookings for as long as the account exists (accounting); if you make no decision within 90 days, we discard the preview automatically. Preview branches are deleted when publishing or discarding.

7l. Appointment bookings on our customers' websites

If a customer uses the booking module on their own website with us, we process for them the appointment data that visitors to that website give when booking: name, phone number, optionally an email address, service address and location, vehicle details, chosen services, the appointment, and an optional message. To prevent abuse, we additionally keep a non-reversible check value of the IP address that changes daily (HMAC). The respective customer is the controller for this data; we process it only on their behalf (Art. 28 GDPR, see the data processing agreement). The privacy policy of the respective website applies.

Six months after the appointment we automatically delete or anonymise the personal fields (name, phone, email, address, vehicle details, message) — only the appointment data itself (date, time, services, status) remains for the customer's statistics. On their instruction we delete earlier. Calendar subscription links (webcal://…) are the customer's own secret — we do not pass them on.

7m. Free website preview (SPEKTRA Fabrik)

If you fill in the additional briefing in the enquiry chat and agree to the Fabrik consent, we automatically build a private, unpublished preview of your website from it, together with a trial AI assistant. For this we process your briefing details and the files you upload (logo, photos) and transmit them to Anthropic PBC (USA) to generate the text, design and the assistant (this may include personal details from the briefing, such as a name in the legal notice or a contact address), and to Cloudflare, Inc. (USA) and Vercel, Inc. (USA) to manage, build and serve the preview website. An AI image/3D service creates preview imagery from subject descriptions only — it explicitly receives no personal data and none of your uploaded files. The legal basis is your consent (Art. 6 (1) (a) GDPR; see section 8 for the transfer to the USA). The preview is not publicly advertised and not discoverable by search engines; it only lives in your account. The trial AI assistant answers questions about your business like an ordinary AI chatbot (section 7f) — SPEKTRA pays for it, not you.

As long as you make no decision, the preview remains for at most 90 days after delivery — after that we automatically delete it along with the briefing, uploaded files and assistant. You can withdraw at any time (a message through your account is enough); we then delete everything immediately. If you decide to keep the assistant, section 7f applies from then on, as for any purchased AI chatbot.

7n. Instagram, ads on Instagram and ManyChat

We are on Instagram and run ads there. Instagram is operated by Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland); what Meta does with your data when you use Instagram is governed by Meta’s terms and data policy. Meta shows our ads according to general criteria we choose (such as region and interests) — we only see aggregated figures such as reach and clicks, no names. This website itself still embeds no Meta pixel and no other tracker.

Messages to us on Instagram: if you write to us there — including via an ad — we answer with the help of ManyChat (ManyChat, Inc., USA) as our processor. ManyChat receives your Instagram name and username, the messages in that conversation and your answers to our multiple-choice questions (such as your line of business), and sends the automatic replies on our behalf. The legal basis is answering your enquiry (Art. 6 (1) (b) GDPR) or our legitimate interest in replying quickly (Art. 6 (1) (f) GDPR). If you then follow our link to this website, we only record for your enquiry which route it came through (e.g. “insta-dm”) — not your Instagram profile. We delete the conversation data at ManyChat once it is no longer needed for your enquiry and a possible order; you can request deletion at any time (section 11).

For the statistics Meta shows us about our Instagram presence (Insights), we are joint controllers with Meta (Art. 26 GDPR). Meta provides the agreement for this (“Page Insights Controller Addendum”); in it Meta takes primary responsibility, including for your data subject rights — but you can also exercise them with us. For the transfer to the USA (Meta Platforms, Inc.; ManyChat, Inc.) see section 8.

7o. One-time discount when cancelling

If you want to cancel the Express request, you can accept a one-time offer for the reason “too expensive” (30% off your first website package, see the terms, point 3, for details). If you accept it, we additionally store at your account: normalised identifiers computed from your email address, company name, town/postcode and phone number (not plain text, not reversible to the original value), the reason chosen, the timestamp, the validity period and the status of the offer.

The purpose is to grant and account for the discount correctly (Art. 6 (1) (b) GDPR — the discount is part of the later contract). The normalised identifiers additionally serve to prevent the same person or business — even through a second account or a second email address — from getting a second offer (Art. 6 (1) (f) GDPR, the same kind of check as the misuse brake against low-value requests and the referral programme, section 7g). A match does not decide anything in an automated way (not a case under Art. 22 GDPR): it only means that no further offer is created for that identity.

Retention: up to 12 months after the offer expires (60 days after it was secured) or is redeemed, then deleted — unless the identifiers are already part of an invoice we must retain (section 9).

7p. Reminders about your request and “Continue later”

Reminder about an unconfirmed request: if you sent a request via /start but have not yet confirmed your email address, we send you at most two reminders about it — after about one and after about three days. They concern only that request and contain no advertising. Legal basis: Art. 6 (1) (b) GDPR (steps taken at your request). The link “No more reminders” in each of these emails stops further reminders immediately; the request itself remains. We store whether and when we reminded you together with the request and delete it with the request.

“Continue later”: if you started a request but have not sent it yet, you can choose to have a link to your draft emailed to you. For this we store your email address and the draft (business, industry, location, desired services, style — no names, no phone number) and send you the link right away; if after two days you have neither used it nor sent a request, we remind you once, and only once. The legal basis is your consent via an unticked checkbox (Art. 6 (1) (a) GDPR, § 174 TKG 2021), which we record with its time. A click on “Unsubscribe” in the email deletes the address and the draft immediately; at the latest 30 days after your consent we delete both automatically.

8. Transfers outside the EU

Some of the providers named are based in the USA (Vercel, Neon, Anthropic — backoffice assistant, website chat, Mira, workshop and website preview, ElevenLabs — Mira, GitHub — workshop, Cloudflare — website preview, ManyChat — Instagram messages, partly Google and Meta) or the United Kingdom (SumUp Payments Limited, for which an EU Commission adequacy decision under Art. 45 GDPR exists). Data is therefore transferred outside the EU. Per provider: to our knowledge (September 2026) Vercel, Anthropic, Cloudflare, Google, Microsoft (GitHub), Meta, ManyChat and Stripe are certified under the EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023, Art. 45 GDPR); for all US providers — including Neon and ElevenLabs — the EU Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR) apply in addition as part of the data processing agreements. You can check the current certification status at dataprivacyframework.gov. Despite these safeguards, access by US authorities cannot be ruled out entirely.

9. How long we keep it

• Account data: for as long as your account exists. You can delete it yourself at any time (Account → Settings → “Delete account and data”): we send you a confirmation link. The link opens a page where you confirm the deletion with a button; only then do we delete or anonymise your name, contact details, enquiries, project briefs, appointment addresses, messages, change and workshop requests, our copies of earlier emails to you, uploaded photos and logos and any bank details from the referral programme, and end all sign-ins. Only what we must keep or need to defend claims remains: orders and invoices (seven years, § 132 BAO), a signed agreement and the records under section 7k. A website already paid for stays online until the end of the paid period — unless you choose “delete everything now” in the confirmation email.
• Confirmation codes: 15 minutes, after which they become invalid.
• Briefing and contact preference: for the duration of the project and, where they form part of the order documentation, for as long as retention duties require. If no order results, we delete them at the latest 12 months after the last contact.
• Address for an in-person appointment: until the project ends, then deleted — unless it is your billing address anyway.
• Outgoing email log: 12 months, then deleted.
• Delivered photos and logo files: 12 months from being uploaded to your account, after which they are deleted. You get an email reminder 30 days beforehand so you can save them in time. If people appear in the photos and you want them removed sooner, a message is enough.
• Browser draft storage: For the order briefing, until you submit or close the tab; for the request form, at most 14 days, after which the draft expires by itself. In both cases it lives on your device alone and is deleted after submitting.
• Invoice and accounting data: 7 years from the end of the calendar year (§ 132 of the Austrian Federal Fiscal Code), then deleted.
• Enquiries: until they are finally dealt with, then deleted or anonymised, at the latest 12 months after they were closed, unless a retention duty applies.
• Internal hand-over to the backoffice: The events through which the website informs our backoffice (section 6), for example about new accounts, enquiries, orders and payments, are kept ready for collection on the website for at most 90 days, then deleted there.
• Server logs: as set by the hosting provider, usually a few weeks.
• Mira calls: Call data is deleted automatically after 30 days. Callback requests follow the retention of ordinary enquiries. A callback you expressly asked for instead follows the retention of ordinary enquiries (see “Enquiries” above). Details in section 7i.
• Appointment bookings (our customers' websites): personal fields 6 months after the appointment, earlier on the customer's instruction. Details in section 7l.
• Free website preview (SPEKTRA Fabrik): until you withdraw or decide, at the latest 90 days after delivery without an order — after that briefing, uploaded files and trial assistant are deleted automatically. Details in section 7m.
• One-time discount when cancelling: up to 12 months after the offer expires (60 days after it was secured) or is redeemed, then the stored identifiers are deleted. Details in section 7o.
• “Continue later”: email address and draft until you unsubscribe, at the latest 30 days after your consent. Details in section 7p.

10. What you have to provide

Name and email address are necessary for an account and for performing the contract. Without them we cannot create an account or enter into a contract. To place an order, the briefing fields marked as required and your contact preference are also necessary — without them we can neither build a draft nor reach you. Everything else (company, phone, references, personal message) is voluntary and has no bearing on whether a contract is concluded.

11. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing based on a legitimate interest (Art. 21). Where processing rests on consent, you can withdraw that consent at any time with effect for the future.

Write to raultatzber@spektra-sites.com. You also have the right to lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, dsb.gv.at).

Objection (Art. 21 GDPR): You can object at any time to any processing based on a legitimate interest — by e-mail to the address in the imprint. We then stop that processing unless there are compelling legitimate grounds. Our measurement (section 2), by contrast, rests on your consent; the easiest way to withdraw it is “Cookie settings” in the footer.

12. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The AI assistant used in the backoffice makes no decisions about you; it only supports the controller, who makes every decision themselves. The same applies to the AI chat on the website (section 7e) and to Mira (section 7i): both answer questions or calls, but do not conclude a contract, do not evaluate you, and do not trigger any payment; Mira arranges at most a callback, and a person decides what happens with it. The workshop (section 7j) can automatically stop a requested change when its security or legal check triggers — that is not a decision with legal effect on you, and on request a person at SPEKTRA reviews it.

13. Data security

All transmission is encrypted (TLS). Passwords are stored only as a hash (bcrypt), session tokens only as an HMAC hash. Backoffice database backups are stored encrypted. Access to the backoffice is protected by a password and two-factor authentication, and restricted to the local network.

14. Changes to this notice

We update this notice when the processing changes. The version in force is marked with its date above. When you register, we record which version you accepted.