Privacy information

hello@obholz.solutions

Delivering and securing this website involves processing technical connection data, including your IP address, request time, requested address, browser information and protocol data. The basis is our legitimate interest in an available, secure website (Article 6(1)(f) GDPR).

We run this website on a server provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Continuous logging of every page request is not enabled for this website. Technical errors and security events may appear in diagnostic logs. Host system logs have a configured retention limit of one month; separate web-server diagnostic logs rotate by size and are deleted after 14 days at the latest. Data on the server, including EVA's conversation notes, is backed up daily. Backups are kept on the server and, additionally, encrypted in the R2 storage service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; only we hold the key to decrypt them. The transfer is based on the adequacy decision for the EU-U.S. Data Privacy Framework, under which Cloudflare is certified. Backups are deleted after 30 days at the latest. The conversation, consent and enquiry periods below apply to the active website service; backups may contain data for up to 30 days longer.

This website does not embed analytics, advertising or social-media tracking services. Only after your explicit EVA activation is a technically necessary session cookie set for up to 30 minutes. It is inaccessible to scripts and protects and associates your conversation (section 25(2)(2) TDDDG). Optional device memory is explained separately below. Fonts, images, 3D files and video examples are served from the same website.

When you deliberately switch language using EN or DE, we store only that language choice in this browser’s Local Storage (key obholz.website.language.v1) until you clear the website’s browser data. It selects the language on your next neutral entry; explicit language URLs still take precedence. Automatically detected browser languages are not stored. This preference does not store an EVA conversation or enable optional EVA memory. Both language versions remain accessible if storage is blocked.

Sound is enabled only after your deliberate activation. You can disable 3D motion in settings. Video examples start through your interaction and do not play audio automatically. No YouTube, Vimeo or similar third-party player is embedded.

EVA is an AI assistant. Using it is optional and based on your consent (Article 6(1)(a) GDPR). Before you start EVA, send text or upload files, we inform you about the processing. The conversation service is activated only when you choose “Start EVA”. The website and email contact remain available without this consent. You are asked again after a fresh page load. To document your choice, we keep a separate protected consent receipt containing a random reference, notice version, processing scope and server timestamps for consent and any withdrawal. Technical association uses only hashes of random session and conversation identifiers. Conversation contents, contact details, IP addresses, audio and files are not part of this receipt. Receipts are removed 90 days after the original consent at the next scheduled sweep within six hours while the service and storage operate normally; after an interruption cleanup occurs when the store next opens. Withdrawal does not extend this period. This limited record supports our accountability and consent-evidence obligations (Articles 5(2) and 7(1) GDPR).

You can use EVA by text without microphone access. Text is sent when you choose Send; files are uploaded only after your selection. Voice additionally requires your deliberate activation and microphone permission. The live voice uses GPT Live and the AI voice Marin. Audio and technical connection data are sent to OpenAI only after voice activation.

While you use EVA, the assistant receives a fixed identifier for the website area currently open; it is updated when you change areas. Full URLs, query parameters, page text and any previously stored browsing history are not sent for this purpose. Project clarification and image interpretation take place in a separate visitor conversation. Submitted text, relevant voice transcripts and checked attachment contents are processed on our server and sent through an external OpenAI model connection to generate replies. Text replies are generated by our existing EVA assistant through the official OpenAI API. The public conversation channel is isolated from internal tools and memories. The conversation provides no access to internal memories, other customer conversations or company tools and does not itself submit an enquiry, place an order or send an external message.

Files are temporarily quarantined outside the website, checked for malware and processed separately. Images are decoded and re-encoded; PDF and text contents are extracted as untrusted reference material. Unsupported, encrypted, executable or unsafe files are rejected. Source files are removed after checking. Sanitized contents remain in memory for about 30 minutes; conversation data is removed after about 30 minutes without activity. The website service creates no permanent audio or conversation archive. The separate local memory option is an exception.

Conversation notes: during the conversation EVA keeps a project brief on your plans, for example building blocks, existing systems, timeline, budget and open points. It is created from your texts and speech transcripts via the OpenAI API (store: false). Names, e-mail addresses, phone numbers and credentials are not included and are additionally filtered out automatically. The brief ensures that EVA does not ask for the same thing twice and helps us follow up on your enquiry. We store it on our server in an area that only the EVA service and the controller can access, and delete it automatically 90 days after the conversation started, in a regular deletion run at most six hours later. Withdrawing your EVA consent deletes the notes of your current session immediately; for earlier conversations an e-mail with the date and approximate time to hello@obholz.solutions is sufficient. The legal basis is your consent (Art. 6(1)(a) GDPR).

You can withdraw your EVA consent at any time for future processing through the EVA controls. This stops the microphone, deletes the local conversation excerpt and requests closure of the active provider session. Your associated active conversations, sanitized attachments and conversation notes of this session are removed. This does not promise deletion of any security or abuse-monitoring logs held by the model provider. Clear view alone removes only the visible local history.

We use the official OpenAI API for live voice and substantive text replies. Under OpenAI’s published Data Processing Addendum, OpenAI Ireland Ltd., Ireland, is the contracting party for customers in the European Economic Area. OpenAI describes potential transfers outside the EEA under Standard Contractual Clauses or adequacy decisions. Data processing is governed by the Data Processing Addendum incorporated into the OpenAI business terms. Exclusively European processing is not promised for our connection. You can read the provider’s Data Processing Addendum.

Storage for the GPT Live session is disabled, and substantive API calls use store: false. This does not promise zero retention. OpenAI states that abuse-monitoring and security logs may normally be retained for up to 30 days, or longer where legally required or in the security cases described by the provider. Model- and feature-specific technical caches and image-screening exceptions can also apply. Special approval for Zero Data Retention has not been established for our connection. Details and current exceptions: OpenAI data controls. Please do not provide passwords, payment details, third-party personal data or confidential documents.

Under ⓘ › “Privacy and options”, the option “Remember an excerpt on this device for 30 days” is initially off. Only after your separate affirmative choice do we store the latest up to six text contributions, with a total limit of 4,000 characters, in this browser’s Local Storage. The purpose is to resume your conversation on a later visit. The basis is your separate consent (Article 6(1)(a) GDPR and section 25(1) TDDDG). Audio files, original attachments and access keys are not stored there.

The 30-day period is extended only by actual conversation activity. Expired excerpts are detected and deleted when you next open the EVA controls; we cannot trigger deletion at a specific time on an unused device. You or your browser may delete browser data sooner. On shared devices, others using the same browser profile may see the excerpt. You can turn the option off and delete the excerpt at any time.

On a later visit, the excerpt is sent to the conversation service only after a new explicit EVA activation. It is used only as conversation context provided by you and does not become an internal memory of the company system.

Talking to EVA alone does not submit a business enquiry. “Send enquiry” opens a separate draft with your name, email and an editable summary. Only after you review, confirm and send it do we store those details to handle your request and, where applicable, take steps towards a contract (Article 6(1)(b) GDPR). The full transcript, audio and original attachments are not included. Saving these confirmed details does not call a language model.

A reference is issued only after the enquiry has been durably saved in OBHOLZ SOLUTIONS’ protected website inbox. Its displayed status separately explains internal forwarding. After saving, our server uses the OpenAI API to create an anonymous project brief from your summary – without your name or email address. Only this brief is passed to our internal team to prepare an offer. Your name and email address stay in the protected website inbox and are used only to send you the offer. AI tools help us prepare it (see “AI tools in our work”).

Stored information includes the confirmed contact details and summary, reference, receipt and confirmation time, confirmation version, privacy-notice version, language and website-area identifier. The protected technical ownership record contains a hash of the session, not its raw cookie identifier. This is server-side storage, separate from optional browser memory. Inbox entries older than 90 days are removed at the next scheduled sweep within six hours while the service and storage operate normally; after an interruption cleanup occurs when the inbox next opens.

Withdrawing optional EVA consent ends the conversation but does not erase a business enquiry you separately submitted earlier. To request access, correction or erasure, contact hello@obholz.solutions with your reference. Later independent contract handling may be subject to other statutory retention duties.

Our business email service is provided by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Sender and recipient addresses, message contents, attachments and technical delivery data are processed for this purpose. The specific product contract and inclusion of its Data Processing Agreement are still being checked.

An email link opens your email application. We receive your details only when you send the message. They are used to handle your enquiry and, where applicable, prepare a contract (Article 6(1)(b) GDPR); other correspondence is based on our legitimate interest in communication (Article 6(1)(f) GDPR).

Enquiry data is needed only as long as necessary to handle the enquiry, any subsequent work or statutory retention duties. Please do not send passwords or confidential documents in your initial message.

We use AI tools when handling it (see “AI tools in our work”).

We work with AI tools. When you contact or commission us as a business, we also process your business details and those of your contact persons with services from these providers:

• OpenAI Ireland Ltd, Dublin, Ireland (ChatGPT, Codex),
• Anthropic Ireland, Limited, Dublin, Ireland (Claude).

This covers names, business contact details and the content of enquiries, offers, invoices and projects. The providers process the data under their own privacy policies; processing in the USA is possible. We have switched off the use of data for training their models in our accounts.

The legal basis is handling your enquiry and performing the contract (Article 6(1)(b) GDPR) and, for contact persons, our legitimate interest in handling business enquiries and assignments quickly (Article 6(1)(f) GDPR).

We do not enter into these tools:

• special categories of personal data, such as health data,
• data we process on your behalf, such as data of your customers or employees,
• access credentials and identity documents.

If you do not want this, please tell us before work begins. You may also object at any time to processing based on legitimate interests (see “Your rights”).

Further recipients in this context:

• OpenAI Ireland Ltd (ChatGPT, Codex): independent controller; business details, contact persons; Ireland, processing in the USA possible.
• Anthropic Ireland, Limited (Claude): independent controller; business details, contact persons; Ireland, processing in the USA possible.

For internal coordination we use the messenger Telegram (Telegram Messenger Inc., Road Town, Tortola, British Virgin Islands; EU representative: EDPO, Brussels). Names and the content of business matters may be transmitted. According to Telegram, the data is stored in data centres in the Netherlands, and transfers within the Telegram group rely on EU Standard Contractual Clauses.

Further recipients in this context:

• Telegram Messenger Inc.: independent controller (internal coordination); names and content of business matters; stored in the Netherlands, group transfers under Standard Contractual Clauses.
• sevDesk GmbH, Offenburg: processor (accounting); invoice and receipt data; Germany.

Links to project websites open a new tab. You leave this website only when opening the link. The respective provider’s privacy information applies there.

Subject to the legal conditions, you may request access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests and withdraw consent for future processing. Contact hello@obholz.solutions.

You may also complain to a data protection authority, such as the Bavarian State Office for Data Protection Supervision.