Privacy Policy

1. Who we are

Responsible for data processing on this website:

A data protection officer is not legally required and has not been appointed.

2. When you fill the form in your browser

What you enter into the Anmeldung form never leaves your browser. The finished PDF is created directly on your device. Our servers do not receive your form data, neither while you type nor when the PDF is created.

What our servers do see: the normal technical data of any website visit. This includes your IP address, date and time, the page requested, and your browser type. Section 4 has the details.

3. Hosting and protection against attacks

Our servers are operated by Hetzner Online GmbH in Germany. In front of our servers sits Cloudflare, a service that blocks attacks and speeds up delivery. Both providers process data on our behalf (Art. 28 GDPR).

Cloudflare is a US company. The transfer is covered by Cloudflare's certification under the EU-US Data Privacy Framework (Art. 45 GDPR).

The legal basis for using both services is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

4. Server logs

Our servers log requests: IP address, time, requested address, status code, and browser type. We need these logs to find errors and detect abuse, for example automated mass requests.

We delete the logs after 14 days. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

To limit mass requests, we count requests per IP address. These counters are short-lived and are not stored permanently.

5. When an AI assistant fills the form for you

You can also have the form filled by an AI assistant, for example through our MCP interface. In this case, the assistant sends your form data to our server. The server creates the PDF in memory and sends it back. The data is not stored. After the response, it is gone.

The form data may include your religious affiliation, because the official registration form asks for it. This information is also processed only briefly and is not stored. If you instruct an AI assistant, make sure you agree to this transmission.

If the assistant gives you a link to finish the form yourself in your browser, our server briefly holds the data entered so far until you open the link. The link is valid for 15 minutes. After that, the data is deleted.

The legal basis is the fulfilment of your request (Art. 6(1)(b) GDPR).

6. Technical measurements (telemetry)

We measure whether our servers are healthy: response times, error rates, load. These measurements contain no form data. They are sent to Grafana Cloud and evaluated there for us.

The legal basis is our legitimate interest in stable operation (Art. 6(1)(f) GDPR).

7. Storage in your browser

The page stores your form progress locally in your browser so nothing is lost if you reload. This data stays on your device and is not sent to us. You can delete it at any time by clearing the site data in your browser.

This storage is required for the page to work (Section 25(2)(2) TDDDG).

8. Your rights

You have the rights under Art. 15 to 21 GDPR: access, correction, deletion, restriction, data portability, and objection.

Honestly: we store almost nothing about you. In most cases, the answer to an access request is that we hold no data about you. Write to us anyway at privacy@rugare.io, we will answer.

You can also complain to a supervisory authority. For Berlin, that is the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI).

9. No automated decisions

We make no automated decisions with legal effect about you (Art. 22 GDPR). Rugare fills out a form. The decision about your registration is made by the Bürgeramt.

10. Changes

If our data processing changes, we update this page. The date at the top shows the current version.