Privacy

Overview

This privacy notice explains what personal data arises when you visit this website, how you can contact me, and which optional analytics feature is used. The controller responsible for the processing described here is the provider of this website named in the legal notice.

Below you will find information on contacting me by email and phone, on the analytics solution Umami, on the cookie settings used, and on further services used for processing, organization, and accounting.

Simply visiting this page does not trigger any transfer of content to Google, Notion, AI providers, or Composio. Confirming the cookie notice is not an authorization for the internal sharing of data, which is explained separately below.

Controller

The controller responsible for data processing is Nimblean GmbH, Marienburger Straße 74, 53340 Meckenheim, Germany, represented by Managing Director Florian Georg Ulrich.

Contact: florian@nimblean.de, phone +49 176 19253865.

Contact

Right now, project inquiries reach me directly by email or phone; no contact form is embedded on this website. If you email or call me, you voluntarily share your name, contact details, and information about your project.

I use this information to process and respond to your inquiry — and, in the event of later collaboration, also for contract handling and accounting, as described elsewhere in this privacy notice.

For processing, I use Google Workspace (Gmail, Drive, Docs, Sheets, Meet) as well as Notion and Composio to organize my work. AI-assisted systems from OpenAI and Anthropic may support the drafting of texts and replies. These services are used independently of the cookie consent on this website, since they relate to the direct handling of your contact request, not to visiting the website itself.

Analytics with Umami

If you consent, I use the analytics software Umami on nimblean.de and www.nimblean.de. I run Umami on my own instance at https://umami.allbound-solutions.com on my own server at Hetzner; I do not use any Umami cloud service. Visiting the website alone does not transmit any data to internal services such as Google, Notion, Composio, or the AI systems in use.

Page views of the defined paths (/, /datenschutz, /impressum, /bildnachweise, /en, /en/privacy, /en/legal-notice, /en/credits) are recorded along with fixed page titles, the referring domain of known public search and profile sites (Google, Bing, and LinkedIn) without paths or parameters, and general information on browser, device, and language settings. Other referrer addresses are discarded. There is no tracking of form entries; no names, email addresses, or project content are recorded; no URL parameters or fragments are evaluated; and no marketing services are integrated. Umami operates without analytics cookies.

When the tracking script is technically loaded and statistics data is transmitted, your IP address is briefly processed for system reasons. According to the Umami documentation, Umami does not permanently store IP addresses, but derives from them, among other things, country or region as well as rotating, hashed session identifiers.

If Do-Not-Track or Global Privacy Control is enabled in your browser, no analytics collection takes place even if consent has been given. You can withdraw your consent at any time via the cookie settings; this stops further collection, but data already collected is not automatically deleted as a result. A fixed deletion period is not currently configured; deletion takes place once the purpose of the analytics no longer applies; your statutory rights remain unaffected.

The legal basis for analytics collection is your consent under Art. 6(1)(a) GDPR, where applicable in conjunction with Section 25(1) TDDDG. Storing your cookie preference itself is based on Section 25(2) No. 2 TDDDG or Art. 6(1)(f) GDPR.

Categories of Personal Data

In the context of inquiries and collaboration, the following may be processed: name, company, job function, and contact details; the content of inquiries, emails, and their attachments; briefings, project requirements, documents, code, and notes; contract-, service-, invoice-, and payment-related data; as well as technical access data and a locally stored cookie preference.

This affects prospective clients, customers, contact persons, and individuals named in project documents provided. Special categories of personal data are not requested, and no automated decision-making with legal effect or similarly significant impact takes place.

Source of the Data

Data originates from direct contact with prospective clients and customers, from authorized contact persons or agencies, and from project documents provided in the course of a collaboration.

Google Workspace (Gmail, Drive, Docs, Sheets, Meet)

For communication and project work, we use Google Workspace with Gmail, Drive, Docs, Sheets, and Meet. Through Gmail, we process sender, recipient, subject, email content, and attachments. Drive holds project files, proposals, briefings, and documentation. Docs and Sheets are used for shared project and contact documents. For Meet appointments, we process names, participation and connection data, as well as video and audio during participation. Call recording or transcription is not part of this website. According to our Workspace invoice, the provider is Google Cloud EMEA Limited.

Notion (Notion Labs, Inc.)

We use Notion for project organization. There, we process names, business contact details, project information, tasks and notes, as well as documentation on ongoing projects. Notion is not integrated into the website and does not serve as a blanket CRM for all contacts; it is used on a project-by-project basis.

Composio (Sampark Inc.)

Composio connects authorized apps with AI and work processes, for example with Google Workspace. Depending on the function used, contacts, email content and attachments, file and project information, connection identifiers, authorization tokens, and execution metadata may be transmitted. The data flow depends on the respective function and runs through Composio to the target service or the AI; not every process copies all data. No visitor tracking takes place.

According to Composio (as of 17 October 2026), payload logs are generally stored for up to one year; Zero Data Retention only applies if the respective calls and the chosen configuration are demonstrably covered by it — this has not yet been conclusively verified by us. According to Composio, the data processing agreement only becomes binding after acceptance in the dashboard, and we have not yet reviewed it. Composio does not describe a blanket zero-retention or no-training commitment for all data flows.

OpenAI (ChatGPT, Codex, API)

For analysis, conception, programming, and documentation, we use OpenAI products such as ChatGPT, Codex, and the API. In doing so, we process task-specific text, file, and code inputs — including any contact and project information they contain — the resulting outputs, and technical usage data. According to OpenAI, OpenAI Ireland Limited is the data controller for consumer accounts in the EEA; different contractual terms may apply for business or API use. We do not treat Pro, Codex, and API access as identical contracts, and we cannot guarantee that no training takes place, that data is deleted immediately, or that an enterprise data processing agreement is in place.

Anthropic Claude

We also use Anthropic Claude for the same purposes, with data types, attachments, and outputs comparable to those described for OpenAI. According to Anthropic, Anthropic Ireland Limited is the data controller for consumer accounts in the EEA; a business contract may differ from this. Actual use takes place via the Claude CLI under a Max subscription, not under an enterprise or API contract. As with other tools, we cannot guarantee that no training occurs or that data retention is zero.

Hetzner Online GmbH

Hetzner Online GmbH operates internal servers and backups for us, which hold project files, communication content, documentation, and technical server data. This infrastructure is not used to host this website.

Lexware Office (Haufe Service Center GmbH)

For invoicing and accounting, we use Lexware Office from Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, Germany. There, we process customers' name, company, and address, contact details, tax information, the service provided, amounts, payment status, and receipts. Lexware's website tracking is not integrated into our site.

Finom and Tax Advisory

We use Finom for payment processing; for ongoing bookkeeping and tax obligations, we work with a tax advisory firm. This involves processing payment and transaction data, invoices, receipts, as well as contact and master data. For banking and tax advisory services, we cannot guarantee blanket data processing arrangements, since the respective party may also have its own independent responsibility.

Cloudflare, Inc.

This website is served through Cloudflare Workers and Static Assets, operated by Cloudflare, Inc., under the domain nimblean.de. When you visit this site, Cloudflare's infrastructure processes the technical connection data needed to deliver it.

This includes your IP address, the requested URL, the time of access, and HTTP headers sent by your browser, which are also processed through a security and error-diagnosis platform. Worker Observability is disabled for this project, but Cloudflare's default responses still instruct your browser to automatically report only failed connection attempts back to Cloudflare — successful visits are not reported this way.

The purpose of this processing is to deliver the site, keep it running technically, and support security and error diagnosis. The legal basis currently under consideration is legitimate interest under Art. 6(1)(f) GDPR, as a preliminary assessment. The exact contractual arrangement with Cloudflare and specific retention periods have not yet been conclusively reviewed — I cannot make blanket promises about zero logging, EU-only processing, or fixed deletion periods at this stage. A dedicated data-protection review is still pending.

Legal Bases

Depending on the purpose, we rely on different legal bases: Art. 6(1)(b) GDPR for the initiation and performance of a contract, where the data subject is or is to become a party to that contract; Art. 6(1)(f) GDPR for business contact persons, organized project communication, and secure and efficient work organization including abuse prevention, in each case following a balancing of interests; Art. 6(1)(c) GDPR for accounting and tax obligations.

Not every use of AI services is strictly necessary under a contract; it may also be based on the balancing of interests under lit. f. Where data is provided to us as part of a client assignment for processing under instructions, this is handled separately from our own contact and contractual purposes, where applicable under Art. 28 GDPR with the tools agreed for that purpose. Which specific tools and legal bases apply in an individual case depends on the respective project.

Retention Period

In ongoing operations, the retention period depends on the respective purpose, the duration of a contractual relationship, and statutory retention and limitation periods.

Specific retention and backup periods of the providers used, such as Google, Notion, Composio, OpenAI, Anthropic, Cloudflare, and Hetzner, have not been conclusively confirmed. When using Google Workspace, Notion, Composio, OpenAI, Anthropic, and Cloudflare, data may also be transferred to the USA; whether and to what extent data processing agreements, standard contractual clauses, or adequacy decisions are fully in place for this has not yet been conclusively reviewed.

Your Rights

Subject to the statutory requirements, you have the right to access, rectification, erasure, restriction of processing, data portability, and objection, as well as — where processing is based on consent — the right to withdraw that consent at any time. You may also lodge a complaint with a data protection supervisory authority; the competent authority for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

Cookies and Local Storage

The software CookieConsent, version 3.1, is used to manage your cookie settings. It is integrated locally into this website; loading the banner does not send any request to the provider of CookieConsent.

There are two categories: "Necessary" is permanently active and cannot be deselected; "Statistics" is optional and disabled by default. Using the buttons "Necessary cookies only" and "Accept all cookies", you decide whether the Umami analytics feature is additionally activated. Since Umami operates without analytics cookies, your decision also affects this form of optional, cookie-less traffic measurement.

Using "Cookie details", you can view and adjust the categories individually; using "Save preferences", you confirm your selection; using "Close", you leave the dialog without making changes. You can revisit and change your selection at any time via the "Cookie settings" link.

After deliberate confirmation, your browser stores the selected category, a revision number, the language, the timestamps of your decision, a randomly generated identifier, and an expiry date under the key nimblean_consent in local storage (localStorage, not a cookie). The preference is valid for 180 days; after expiry, the notice is shown again, and in the event of a substantive content change, we increase the revision and also show the notice again.

This identifier exists exclusively in your browser; the website code does not transmit it to our server or to third parties. If you clear your browser's local storage, the preference is removed. Without JavaScript enabled, no notice is shown and no preference is stored; the legal text and the page remain accessible regardless, and no optional services are loaded.

The legal basis for storing the desired setting is Section 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR. Confirming the notice is not an authorization for the internal sharing of data with the services named above.