Who is responsible
The controller responsible for this website and for our business contacts is:
Kiarash N.A., trading as 1slash Postfach 13 02 66, 20102 Hamburg, Germany Email: talk@1sla.sh
The two hats we wear
For the website, your messages to us, and billing, we decide why and how data is processed. There we are the controller, and this policy applies.
For the business data you put into your brain and your helpers, you decide why and how. There you are the controller and we are the processor, bound by our Data Processing Agreement. That data is governed by the DPA, not by this policy.
When you visit the website
Our hosting provider, Vercel, processes standard connection data to deliver pages and keep them secure: IP address, time of request, requested URL, and browser information. That is our legitimate interest (Art. 6(1)(f) GDPR), and the provider's logs rotate out quickly.
We run no analytics, no tracking pixels, and no advertising cookies. The site sets only two strictly functional first-party cookies; the Cookie Policy lists them.
When you contact us
The contact form and email ask for your name, your email address, and your message. We use them only to answer you: Art. 6(1)(b) GDPR where your message concerns a possible contract, otherwise Art. 6(1)(f) GDPR. We keep the thread while the matter is active and delete it when it is done, unless statutory retention duties apply.
When you become a client
Onboarding answers and contracts: we process what we need to set up and run your service (Art. 6(1)(b) GDPR).
Billing: card payments are processed by Stripe; we receive the payment status and references, not your full card data. If you pay by invoice, we process your billing details for accounting. Tax and commercial law (§ 147 AO, § 257 HGB) obliges us to keep billing records for up to ten years (Art. 6(1)(c) GDPR).
Your business data inside the brain is processed under the DPA, not under this policy.
Who receives your data
A short list of providers, each bound by a data processing agreement:
- Vercel Inc., USA: website hosting and the Vercel AI Gateway, which routes model requests.
- Anthropic, OpenAI, and Google LLC, USA: AI model providers. Which of them touches your data depends on the models chosen for your helpers; your current list lives in your brain.
- Stripe, Inc., USA: payment processing, only if you pay by card.
We do not sell data, and we do not share it beyond what running your service requires.
Transfers outside the EU
The providers above process data in the United States. Transfers are covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by EU Standard Contractual Clauses. Copies of the safeguards are available on request.
How long we keep data
Contact threads: until the matter is closed, then deleted. Billing records: as long as tax and commercial law requires, up to ten years. Client data in the brain: for the duration of the contract, then exported to you and deleted within 30 days, as the DPA describes.
Your rights
You can request access, rectification, erasure, restriction of processing, and data portability (Art. 15-20 GDPR). You can object to processing based on legitimate interest (Art. 21 GDPR). Where we rely on consent, you can withdraw it at any time with effect for the future.
You can complain to a supervisory authority. The one competent for us is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.
Automated decisions
We make no automated decisions about website visitors and run no profiling. AI helpers act only on client data, under client instructions, within the DPA.
Security
Connections are encrypted, access follows least privilege under the key-card model (helpers borrow permission, and you can revoke it), every helper action is logged and independently checked, and humans watch the service around the clock. One honest sentence: no system is perfectly safe, and anyone who claims otherwise is lying. Ours has locked doors, alarms, and people watching.
Changes
If we change how we handle data, we update this page and its date. Material changes are emailed to active clients before they take effect.
Contact
Privacy questions, export requests, and deletion requests: talk@1sla.sh. Postal: Kiarash N.A., 1slash, Postfach 13 02 66, 20102 Hamburg, Germany.