Legal

Privacy policy

This is a translation. The German Datenschutzerklärung is legally binding.

This privacy policy applies to echtlab.de and to the projects Design Studio (design.echtlab.de) and Ausschreibungskraken (kraken.echtlab.de).

At a glance: echtlab.de

• echtlab.de sets no cookies. Something is stored in your browser only if you opt out of the statistics.
• There are anonymous usage statistics on my own server – without cookies and without storing your IP address. There are no ads and no third-party analytics tools.
• All content, fonts included, comes from my own server; no data is sent to third parties such as Google.
• There is no sign-in on this site. The guestbook on the home page is a joke: entries only stay in the open browser window, are not sent anywhere and are gone after a reload.

What is different in the projects is described further down, project by project.

Controller

Hosting and server log files

echtlab.de and the projects run on the operator’s own server in Germany, delivered through a front server at STRATO (data centre in Berlin). When you open one of the sites, your browser transmits technically necessary data: IP address, date and time, the requested address, amount of data transferred, browser identifier (user agent) and, where applicable, the page you came from (referrer). This data is only processed to deliver the sites and keep them secure (defending against attacks, debugging).

The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest is the secure and stable delivery of the sites. The web server of echtlab.de itself does not log IP addresses.

The front server only handles the encrypted connection and forwards your request through an encrypted tunnel to the operator’s own server; it writes no access logs. On the operator’s own server, requests are logged without IP address and without browser identifier (time, requested address, status code, amount of data, duration). In rare cases, for example a failed connection attempt, an IP address can end up in an error log. All logs are limited in size and are overwritten continuously.

Usage statistics

To see how the sites are used, echtlab.de, the Design Studio and Ausschreibungskraken count visits with the open-source software Umami. It runs on my own server; no data is passed on to third parties.

• What is recorded: the page and its title, the previous page (referrer), browser, operating system, device type, screen size and language, plus country and region derived from the IP address. On echtlab.de also which projects and elements you click; in the Design Studio which designs you look at and for how long, which you save and what you export. In Ausschreibungskraken only page views are counted – no content, search terms or account data. Parameters in the address (everything after “?”) are never stored.
• No IP address, no cookies: your IP address is not stored. A key is derived from the IP address and the browser identifier with a secret value and changes every month. That way the number of different visitors can be counted without recognising you. No cookies are set, and nothing is stored in your browser for the statistics. Only your screen size and your browser’s language setting are read; the script also checks whether you have opted out (see Opting out).
• Legal basis is Art. 6(1)(f) GDPR; the legitimate interest is improving the sites based on how they are used.
• Retention: the data is deleted automatically after 25 months.

Opting out

If your browser sends “Do Not Track” or “Global Privacy Control”, you are not counted. You can also switch the statistics off here for all three sites: your browser briefly passes through design.echtlab.de and kraken.echtlab.de and comes back here. For your choice to stick, each of the three sites stores the entryumami.disabled in your browser’s local storage (Section 25(2) no. 2 TDDDG). If you clear the site data, you are counted again.

Switch statistics offSwitch back on

Contact by email

If you email me, I process your details to answer your request (Art. 6 (1) (b) or (f) GDPR). The mailbox is hosted by IONOS. The message is deleted once it has been dealt with and no statutory retention obligations apply.

If you use the contact form of the address service versteckmich.deinstead, the privacy policy of versteckmich.de applies to it.

Design Studio (design.echtlab.de)

• There is no account and there are no cookies. Which designs are viewed and exported is counted by the anonymous usage statistics.
• The directions you save are kept in your browser’s local storage and stay there until you remove them or clear the site data in your browser. They are not sent to the server. This storage is necessary for a function you use yourself (§ 25 (2) no. 2 TDDDG) and therefore needs no consent.
• What you enter in the export panel (brand, offer, audience) stays in your browser and only goes into the text you copy or download yourself.
• The designs are demonstrations for fictional clients. Their forms are dummies: nothing you enter there is sent or stored on the server. The only exception is the guestbook in the “GeoCities” design: entries and the visitor counter are kept in your browser’s local storage, are only visible on your device and stay there until you clear the site data.
• Camera: the “Mirror Cam” design only asks for access to your camera when you start the camera try-on. The image is processed in your browser only; it is neither stored nor transmitted. The camera stops as soon as you switch it off or leave the design.
• Motion sensors: some designs (Holo Foil, Labyrinth, Pinball) react to how you tilt or move your device. The readings are processed in your browser only; some devices ask for permission first.
• All fonts come from my own server; there is no connection to Google.
• Hosting and logs are the same as for echtlab.de (see above).

Ausschreibungskraken (kraken.echtlab.de)

The Ausschreibungskraken is a prototype in test operation. Access is only granted after manual approval.

• Registration and account: email address, display name and password; the password is stored only as a hash. Accounts are approved by hand. The legal basis is Art. 6 (1) (b) GDPR. Account data is kept until the account is deleted.
• IP address at registration: it is stored in the application’s audit log to detect abuse and protect the system (Art. 6 (1) (f) GDPR). There is currently no fixed deletion period; it is deleted on request.
• Login protection: failed sign-in attempts are counted per IP address in memory only and are not stored.
• Cookies: a sign-in cookie (valid for 8 hours and extended while you use the app; longer only if you choose “Angemeldet bleiben”, i.e. stay signed in) and a cookie that protects against forged requests (CSRF). Both are technically necessary (§ 25 (2) no. 2 TDDDG) and need no consent.
• Your content: search profiles, matches and ratings you create are stored with your account.
• Emails: notifications and account emails are sent through Mailjet (Mailjet SAS, based in the EU) as a processor, sender kraken@echtlab.de.
• Tender data: the tenders shown come from public procurement portals and can contain contact details of the contracting authorities (data from publicly accessible sources, Art. 6 (1) (f) GDPR).
• Usage statistics: only page views are counted, with no link to your account (seeusage statistics).
• No processing by AI services takes place.
• Deleting your account: send an email to echtlab@echtlersebastian.de; the account and its data will then be deleted.

Your rights

Under the GDPR you have the right to

• access the data stored about you (Art. 15),
• rectification (Art. 16) and erasure (Art. 17),
• restriction of processing (Art. 18) and data portability (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• lodge a complaint with a data protection supervisory authority (Art. 77).

For any request, an email to echtlab@echtlersebastian.de is enough.

Last updated: 3 November 2026