Privacy policy
This is a courtesy translation. The German version of this policy is the legally binding one.
Controller
The controller under the GDPR is: Bavarian Studio, Owner: Jürgen Pesth, Schneewittchenstraße 14, 81739 Munich, Germany. Contact: hello@studio.bavarian.app — opens your email program.
The full provider identification is in the imprint.
The short version
This website is a static site. It sets no cookies, embeds no analytics or tracking tools, contains no forms, holds no user accounts and loads no resources from third-party servers. Apart from the server logs that arise unavoidably when a page is requested, and the processing described in the “Chat assistant” section, no personal data is processed here. The assistant starts only when you click it yourself; anyone who does not click it triggers none of it.
That is not minimalism through neglect but the way the site is built: what is never collected does not have to be protected, stored or deleted.
Server logs
When this site is accessed, the web server automatically records data transmitted by your browser in server log files:
- shortened IP address of the requesting device (see below)
- date and time of the request
- name and URL of the file requested
- volume of data transferred and confirmation of successful retrieval
- browser type and version, operating system
- where applicable, the previously visited page (referrer)
Access log. The IP address is shortened as it is written: for IPv4 the last octet is dropped, for IPv6 the last 80 bits are dropped. An address such as 203.0.113.42 is therefore recorded as 203.0.113.0. The full address is never stored in the access log at any point.
Error log. The web server also keeps an error log. Its format cannot be determined technically — the web server in use offers no setting for it — so where an entry names a client at all, it contains the full IP address. The shortening applied to the access log therefore does not apply to it. Ordinary page views do not produce such entries; what accumulates there is essentially automated scanning traffic and genuine faults.
Both logs live in their own directory, are readable only by the server user and the adm group (file permissions 0640), and are deleted within seven days at the latest.
The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the technically correct and secure operation of the site. This data is not combined with other sources and is not analysed to identify individuals.
Hosting
The site is hosted by Contabo GmbH, Germany. The host processes the log data described above on our behalf as a processor within the meaning of Art. 28 GDPR. The processing of that log data takes place in Germany; no transfer of that data to a third country occurs. For the chat assistant, the separate section below applies.
No cookies, no tracking
This site sets no cookies and uses neither localStorage nor sessionStorage
nor comparable means of storing data on your device. No analytics, reach
measurement or advertising tools are embedded. There is no cookie banner — not
out of convenience, but because there would be nothing to consent to.
Fonts are served locally
The fonts used are stored on the same server as the site and delivered from there. There is no connection to Google Fonts or any other third-party font service, and no IP address is transmitted to a third party in the process.
No forms, no data collection
There is no contact form, no newsletter field and no registration on this site. Input that this site accepts is not stored on our systems beyond the session in which it occurs — the only place that accepts input is the chat assistant (see the “Chat assistant” section).
Chat assistant
This site offers a chat assistant. It loads only when you click it; merely visiting the page does not start it and transmits nothing. You are communicating with an AI system and not with a person — the widget tells you so itself, before you write.
What is transmitted. Your message, the previous course of the current session, extracts from this site’s published content, the instructions given to the model, and the model selection — your pick in the widget or, absent a pick, the default. Your IP address, a session identifier, your name and an email address are not transmitted; the request contains no account data, because this service holds no accounts.
No storage on our side. We do not store the conversation: it is held in memory only and discarded thirty minutes after your last message at the latest, and immediately when the service restarts. There is no log of conversations on our side and therefore no copy that could be handed over or deleted.
Who receives your input. The processor is OpenRouter, Inc., New York, USA. It forwards the request to a model provider’s endpoint, which it selects per request from those it lists as retention-free. A fixed model provider cannot be named here, and that is not an omission: the selection happens at the gateway, we impose no pre-selection of the provider, and the contract does not oblige the platform to notify us in advance when the model providers change. Which company actually serves is therefore establishable only as a dated observation; on 2026-08-10 these were Microsoft (Azure), Amazon Web Services (Bedrock) and Google. We re-observe this on a schedule.
Storage at the platform and the providers. We request retention-free processing (Zero Data Retention) on every single request and at the same time prohibit the use of the data for further purposes; requests are routed only to endpoints the platform lists as retention-free. That is a technical assurance by the platform, not a contractual term assured by us. OpenRouter states no retention period for inputs and outputs in its own materials (as at 2026-08-11); we therefore state none, rather than claim a period nobody commits to. Content that a provider’s safety systems classify as a breach of its usage policies, or that is subject to a statutory retention obligation, may be retained by that provider by way of exception. There is no contractual prohibition on using your input to train models: the platform states only that it has opted out of such training “where possible”.
Third-country transfer. The transfer to OpenRouter, Inc. and — via OpenRouter — to the respective model provider goes to the USA. It is based on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR: OpenRouter is bound by the Standard Contractual Clauses incorporated into its data processing agreement (Module 2, Decision (EU) 2021/914) and obliges its downstream providers to a corresponding level of protection. This transfer does not rely on the EU-US Data Privacy Framework; that the observed providers Microsoft Corporation and Google LLC are listed there as certified is an additional factor, but does not carry the transfer.
Protection against automated use. To protect the assistant against automated use, we limit the number of conversations per connection per day. Your IP address is not stored for this but converted into a check value from which it cannot be calculated back; the random key used for this arises in memory alone, is stored nowhere, and is renewed with every new time window. Only that check value and a counter are stored, for twenty-four hours at most.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in answering questions about this site’s content directly, and in protecting the service against automated use and uncontrolled cost.
Please do not enter personal data. The assistant answers questions about this site’s content. It needs no details about you to do that, and you should not enter any there — neither about yourself nor about third parties. If you would like to tell us something personal, please use email.
Contact by email
The contact page carries an email link to hello@studio.bavarian.app — opens your email program. Clicking it opens your own email program — no data is transmitted to us in doing so. Only if you decide to send a message do we receive the data you put in it.
We process those details solely to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry is directed at concluding a contract, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in answering enquiries. Your enquiry and the associated correspondence are deleted once they have been dealt with conclusively and no statutory retention obligations apply.
Contact via WhatsApp
Alongside the email address, the contact page carries a WhatsApp link. It is a plain outgoing link — no embedded widget, no chat integration, no data collection on this site. Merely visiting the contact page establishes no connection to Meta.
Only if you click the link yourself and use WhatsApp is data transferred to Meta Platforms Ireland Limited — in particular your telephone number and communication metadata. We have no influence on the nature and extent of that processing; WhatsApp’s own privacy policy applies. A transfer to third countries, including the USA, cannot be ruled out.
Using this route is voluntary and triggered solely by you. If you wish to avoid the transfer to Meta, please use email instead — that route establishes no connection to Meta.
Messages that reach us via WhatsApp are treated the same way as email enquiries: we process the details they contain solely to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry is directed at concluding a contract, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in answering enquiries. Your enquiry and the associated correspondence are deleted once they have been dealt with conclusively and no statutory retention obligations apply.
External links
This site links in places to external offerings. Clicking such a link takes you off this site; the respective provider is responsible for any processing there. Merely visiting this site triggers no connection to any external provider.
Your rights
You have the right at any time to information about the data stored about you (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR).
Right to object (Art. 21 GDPR): you have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. Here that concerns the server logs, the chat assistant and the answering of enquiries.
To exercise them, contact the address given in the imprint.
Independently of this, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is usually the one at your habitual residence or at the controller’s registered office.
Changes to this policy
This policy describes the state of processing as at the date given below. If the site changes technically, this policy will be updated.
As at: 13 August 2026