Privacy notice

1. Controller

2. Website delivery and security logs

The site is delivered by Vercel Inc. Requests necessarily transmit technical data such as IP address, date and time, requested resource, referrer, browser/device information, and security or error metadata. This is processed to deliver the site, prevent abuse, diagnose failures, and maintain security.

The legal basis is Article 6(1)(f) GDPR. The legitimate interests are reliable, secure website operation and defence against misuse. On the current Pro plan, Vercel runtime logs are available for one day unless a different paid observability retention setting is enabled. Provider backups and service-generated data may follow Vercel's contractual retention rules.

3. Contact and support requests

Required fields are your email address and message. Name and subject are optional. The data is used only to route, review, and answer your request. Do not submit sensitive data that is not needed for the request.

The form sends the request to Convex for validation and server-side delivery into a separate private Discord channel. The contact payload is not stored in the a3.lol Convex database. Convex stores only the Discord message identifier and deletion deadline so the Discord copy can be deleted automatically after 90 days. Global, non-personal counters are used to limit abuse.

Discord messages are scheduled for deletion after 90 days. A shorter period applies when the request is resolved and deleted earlier; a longer period may apply only where required to establish, exercise, or defend legal claims.

For enquiries connected with a contract or steps before entering one, the legal basis is Article 6(1)(b) GDPR. For general correspondence, support, and abuse prevention, it is Article 6(1)(f) GDPR. The legitimate interest is answering genuine enquiries and operating a secure support channel.

4. Optional analytics and browser storage

PostHog analytics loads only after you accept it. The site sends anonymous page paths, broad link destinations, the page area where a link was selected, contact or support form start/success/failure outcomes, email-signup open/success/failure or withdrawal outcomes, the two selected-purpose booleans, and the analytics-consent acceptance event. It also measures clicks on links and non-form buttons, page-exit and scroll depth, rage or ineffective clicks, pointer positions for heatmaps, Core Web Vitals, coarse browser and device details, referrer origin, sanitized unhandled-error metadata, and masked session replays.

Forms and form controls are excluded from automatic clicks and blocked from replay. All input values are masked. Automatically captured text and element attributes, copied text, console logs, network bodies and headers, raw error messages, names, email addresses or hashes, consent evidence, messages, full mail or phone links, URL query strings, and fragments are not sent. Surveys, experiments, feature flags, and person profiles are disabled. PostHog stores a random anonymous identifier and session information in local storage after acceptance so visits can be counted together. Analytics events are retained for up to 12 months and session replays for 30 days under the current project settings. The project is hosted on PostHog Cloud EU.

The legal basis is your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. Your decision is stored locally in your browser for 180 days so the site can remember it. You may withdraw consent at any time with effect for the future. Withdrawal stops recording and resets the browser's anonymous PostHog state. See the cookies and storage page for full details.

5. Email updates and marketing consent

You may optionally provide an email address and separately choose a3.lol product updates and announcements or promotions for other Alec Schneider Solutions products. Neither choice is required to use the site. The legal basis for each selected purpose is your consent under Article 6(1)(a) GDPR.

Convex stores the normalized email address, current choices, product and publisher keys, consent-copy version, source, browser locale, unverified status, and grant or withdrawal timestamps. A separate audit history records only changes to each purpose. The address is not sent to PostHog, Discord, or an email provider.

Collection is active, but email delivery is not. A submission remains unverified and no marketing message is sent until a double-opt-in, purpose-aware sending, and unsubscribe system has been implemented. You may withdraw both choices through the form on the homepage or contact alec@a3.lol to change one choice, request access, or request deletion.

The current record and consent history are deleted automatically 12 months after the latest signup, preference change, or withdrawal, unless an earlier deletion request applies or retention is necessary to establish, exercise, or defend legal claims. Four records collected by an older form remain isolated as legacy records. They are not used for campaigns while their consent evidence is under review.

6. Recipients and international transfers

The processors and recipients used by this site are:

• Vercel Inc. for website delivery and logs;
• PostHog Inc. for consented product analytics in an EU-hosted project;
• Convex Inc. for the backend, abuse limits, delivery metadata, email contacts, current consent choices, and consent history; and
• Discord Inc. for private internal handling of contact messages.

PostHog analytics data is hosted in the European Union. Convex is configured in US East. Vercel, Convex, Discord, and PostHog's support or corporate operations may involve processing in the United States. The providers describe Data Privacy Framework participation and/or Standard Contractual Clauses in their privacy and contractual documentation. These mechanisms are intended to provide safeguards under Articles 45 and 46 GDPR.

7. Your rights

Subject to the legal requirements, you have rights to access, rectification, erasure, restriction, data portability, and objection. Where processing relies on consent, you may withdraw it at any time for the future. Where processing relies on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation.

Send requests to alec@a3.lol. You also have the right to complain to a supervisory authority. The competent local authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

8. Automated decisions and changes

This site does not use automated decision-making or profiling that produces legal or similarly significant effects. This notice will be updated when the processing setup materially changes.