1. Controller
The controller responsible for the processing of personal data on this website and its services is: Jakob Leibetseder, Leonhardstraße 74, 8010 Graz, Austria, email: office@pocketcorp.agency.
2. General information and legal bases
We process personal data only in accordance with the GDPR and Austrian data-protection law. Depending on the purpose, the legal basis is your consent (Art. 6(1)(a) GDPR), the performance of a contract or pre-contractual steps (Art. 6(1)(b)), compliance with a legal obligation (Art. 6(1)(c)) or our legitimate interests (Art. 6(1)(f)). Where we rely on legitimate interests, these are the secure, stable and efficient provision of our website and services.
3. Hosting and server log files
When you visit the website, our hosting provider automatically collects information that your browser transmits and stores it in server log files: IP address, date and time of the request, the page or file requested, browser type and version, operating system and referrer URL. This is necessary to deliver the site reliably and securely and to detect and prevent misuse. Legal basis: Art. 6(1)(f) GDPR. Log data is deleted or anonymised after a short period.
3a. Page-load statistics (without cookies)
To know how many people use the site, our own server counts every page load, without cookies and without storing anything in your browser. For each page load we record the page path, the host of the referring website and, if the link contained them, its campaign parameters (utm_source, utm_medium, utm_campaign, src). To count unique visitors per day, the server forms a one-way hash from your IP address, your browser's user-agent string and a random value that is replaced every day; only this hash is stored, never the IP address. The random value of a day is deleted when the day ends, after which the hash can no longer be linked to you. The statistics are used only by us, in aggregate, to see how the site is used; we build no profiles and do no cross-site tracking, and requests identified as bots are not counted. Legal basis: our legitimate interest in measuring the reach of our website (Art. 6(1)(f) GDPR). You can object at any time: if your browser sends a Global Privacy Control or Do Not Track signal, your page loads are not counted at all. The consent banner (sections 4a and 4b) does not affect this count.
4. Cookies and local storage
We use technically necessary cookies and browser storage that do not require consent: a session cookie to keep you logged in, a "pc-locale" cookie for your language preference, "pc-theme" in local storage for your light/dark theme, and a session flag so the intro animation is shown only once. Legal basis: Art. 6(1)(f) GDPR and § 165(3) TKG 2021 for storage strictly necessary to provide the service you requested. Only if you accept our consent banner do we additionally store an analytics visitor identifier (see section 4a). We do not use advertising cookies or cross-site tracking. You can delete this data at any time in your browser.
4a. Visitor analytics (with consent)
To understand how many people visit, we use privacy-friendly, first-party analytics — but only if you accept it in our consent banner. With your consent we store a random visitor identifier ("pc-visitor-id") in your browser and send only the page path and the referrer to our own server; this lets us count unique visitors. We collect no other personal data, do not build profiles and do no cross-site tracking, and requests identified as bots are not recorded. Legal basis: your consent (Art. 6(1)(a) GDPR and § 165(3) TKG 2021). You can decline, and change or withdraw your consent at any time via “Analytics settings” in the footer of every page. If you consent, Google Analytics is loaded additionally (see section 4b).
4b. Google Analytics (with consent)
Only if you accept our consent banner, we additionally use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies and similar technologies to analyse how visitors use the site (pages viewed, session duration, approximate region derived from a truncated IP address). We have configured Google Analytics without advertising features: ad storage, ad user data and ad personalisation remain disabled, and IP addresses are anonymised. Google may transfer information to servers in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR and § 165(3) TKG 2021). You can change or withdraw your consent at any time via “Analytics settings” in the footer of every page; withdrawing deletes the Google Analytics cookies and no Google Analytics script is loaded afterwards.
5. Account and registration
To create and manage an account you provide an email address and a password, which we store only in hashed form. We use this data to authenticate you and to provide the Service. Legal basis: Art. 6(1)(b) GDPR.
6. Provision of the Service and the AI agent
To operate your server and AI agent, we process the configuration, instructions and content you provide. To generate responses and carry out tasks, content may be transmitted to AI model providers — in particular via the routing provider OpenRouter — and processed there. You decide what data you give to the agent. Legal basis: Art. 6(1)(b) GDPR. Some providers may process data outside the EU/EEA (see section 11).
7. Payment processing (Stripe)
Payments are processed by our payment provider Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA). When you pay, the data required for the transaction (e.g. name, email address, payment details) is processed by Stripe under its own privacy policy. We do not store complete payment-card data. Legal basis: Art. 6(1)(b) GDPR. More information: https://stripe.com/privacy.
8. Web fonts
This website uses the "Space Grotesk" and "JetBrains Mono" web fonts. They are hosted on our own server and loaded directly from there. No connection to Google or other third-party servers is established when the fonts load, and no data (such as your IP address) is transmitted to them for this purpose.
9. Contacting us
The support form on our website opens a message in your own email program; no data from the form is transmitted to our servers. If you contact us by email, we process the data you provide (e.g. name, email address and the content of your message) in order to handle your request. Legal basis: Art. 6(1)(b) or (f) GDPR.
10. Recipients and processors
We pass personal data to service providers who process it on our behalf as processors under Art. 28 GDPR, in particular for hosting, payment processing and the operation of the AI agent. These providers are contractually bound to process data only on our instructions and to protect it. We disclose data only where necessary for the purposes described or where legally required.
11. International data transfers
Some of our providers (in particular the payment and AI model providers) may process personal data outside the EU/EEA, including in the USA. In such cases we ensure an adequate level of protection through appropriate safeguards, such as EU Standard Contractual Clauses or an adequacy decision of the European Commission.
12. Retention
We store personal data only for as long as necessary for the purposes described or as required by statutory retention obligations — for example, accounting records must be kept for seven years under Austrian law. Once the purpose ceases and no retention obligation applies, the data is deleted.
13. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise your rights, contact us at office@pocketcorp.agency.
14. Right to lodge a complaint
If you believe the processing of your personal data infringes data-protection law, you have the right to lodge a complaint with a supervisory authority. In Austria this is the Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at).
15. Data security
We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, including TLS encryption of data transmitted through the website.
16. Automated decision-making
We do not carry out automated decision-making producing legal effects concerning you within the meaning of Art. 22 GDPR. Outputs of the AI agent are tools operated under your control and on your instructions.
17. Changes to this policy
We may update this Privacy Policy to reflect changes to our services or the legal framework. The current version is always available on this page.
This English version is a convenience translation; the German version is legally binding.