Skip to content
FLX
DE
Menu

Legal

Privacy

What data this website processes, why, on what legal basis and for how long. The German version is the authoritative one.

Controller

The controller within the meaning of Art. 4 (7) GDPR is:

Registered name
FLX LLC
Address
1021 E Lincolnway, Suite #7652
Cheyenne, WY 82001
USA
Email
info@flxlabs.io
Data protection officer
No data protection officer has been appointed. Section 38 (1) BDSG does not require one, because fewer than twenty people here are permanently engaged in the automated processing of personal data.

What is processed

Each operation is listed below with the data, the purpose, the legal basis and how it is stored.

  • Visiting this website

    Data
    Requesting a page produces log data at the hosting provider for technical reasons: IP address, time, requested address, amount of data transferred, referring page and browser identification.
    Purpose
    Delivering the page and keeping the service technically operational.
    Legal basis
    Art. 6 (1) (f) GDPR — legitimate interest in operating the site without disruption.
    Storage
    The pages are served by Vercel. On the Pro plan we use, Vercel retains runtime logs for one day and deletes them automatically thereafter.

  • Contact form

    Data
    Name, email address, subject and message, each within the length the form allows.
    Purpose
    Handling and answering your enquiry.
    Legal basis
    Art. 6 (1) (b) GDPR for enquiries relating to a contract, otherwise Art. 6 (1) (f) GDPR.
    Storage
    The details are delivered to us as an email; the website itself does not store them. Enquiries that do not lead to an engagement are deleted no later than six months after the last contact. Where a contract follows, the commercial and tax retention periods of six and ten years respectively apply instead.

  • Limiting bulk submissions

    Data
    The IP address from the “X-Forwarded-For” header of the submitting request.
    Purpose
    Protecting the form from abuse: it accepts at most 5 submissions per window per address.
    Legal basis
    Art. 6 (1) (f) GDPR — legitimate interest in preventing abuse.
    Storage
    In the server’s memory only, as a counter with an expiry time. The entry is discarded after 60 seconds.

  • Booking calendar on the contact page

    Data
    When you open the calendar, Cal.com receives your IP address and browser identification and sets cookies. If you book a slot, your name, email address and what you write about the meeting are added.
    Purpose
    Showing available times and arranging a conversation.
    Legal basis
    § 25 (2) no. 2 TDDDG for loading it, which happens only on your click. Art. 6 (1) (b) GDPR for the booking.
    Storage
    At Cal.com.

  • Light/dark display preference

    Data
    The value “light”, “dark” or “system” under the key “theme”.
    Purpose
    Remembering the appearance you chose, so that it survives to the next visit.
    Legal basis
    § 25 (2) no. 2 TDDDG — a function you asked for.
    Storage
    In your browser’s local storage (localStorage). The value is not transmitted and can be cleared in the browser settings.

  • Audience measurement with Google Analytics

    Data
    Your IP address, from which Google derives the approximate location and which, according to Google, is not stored, the pages visited, time on page, browser, details of your device and an approximate location at city level and the referring page. In addition, events on the page itself: how far you scroll, which outbound links and files you click, and whether you started or submitted a form. Form field contents, names and email addresses are not transmitted. The advertising features of Google Analytics are switched off.
    Purpose
    Seeing which pages get read and which do not, so the site can be shaped accordingly.
    Legal basis
    Your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time via “Change consent” in the footer; the cookies are then deleted.
    Storage
    Cookies on your device, lifetime two years, and measurement data on Google’s servers. Event data is retained in the property for fourteen months and deleted automatically thereafter. Where that data goes is set out under “Recipients” below.

  • Your decision about audience measurement

    Data
    A cookie named “cc_cookie”. It records which categories you accepted or declined, and when.
    Purpose
    Storing your choice so it applies on every page, and recording consent under Art. 7 (1) GDPR.
    Legal basis
    § 25 (2) no. 2 TDDDG.
    Storage
    A cookie set by this website, lifetime 182 days. It contains no identifier for your device and is not sent to third parties.

Not in use at present

If any of these is added later, this notice will be updated first.

  • Audience measurement without consent.
  • External font services such as Google Fonts; the typefaces are served by this website.
  • Embedded third-party content, apart from the booking calendar on the contact page.
  • Profiling and automated decision-making under Art. 22 GDPR.
  • Sharing or selling data for advertising.

Recipients

The following service providers receive data when you use this website. For hosting, mail delivery and booking, they do so on our behalf under Art. 28 GDPR. For audience measurement the classification is disputed: the German supervisory authorities treat Google Analytics as joint controllership under Art. 26 GDPR rather than processing on our behalf.

Vercel — serving the site

The website is hosted with Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Log data is produced in the process. The pages are delivered over Vercel’s global edge network, and processing therefore also takes place in the United States. A processing agreement under Art. 28 GDPR is in place: Vercel’s Data Processing Addendum applies to the Pro plan and takes effect with the agreement itself. It incorporates the Standard Contractual Clauses under Art. 46 (2) (c) GDPR for the transfer to the United States.

Hetzner Online GmbH — mailbox

Your enquiry is sent and received through our own mailbox. It is run by Hetzner Online GmbH on servers in Germany. A processing agreement under Art. 28 GDPR is in place, accepted on 23 August 2026.

Cal.com — booking

The calendar on the contact page is provided by Cal.com and loads only when you open it. If you book a slot, Cal.com processes your details on our behalf.

Google Analytics 4 — audience measurement

The contracting party is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the United States in the process. The basis is the European Commission adequacy decision on the EU-US Data Privacy Framework, to which Google LLC has certified. Should that basis fall away, the Standard Contractual Clauses under Art. 46 (2) (c) GDPR apply instead.

Your rights

You have the following rights against the controller. An informal message is enough to exercise them.

  • Access to the data processed (Art. 15 GDPR).
  • Rectification of inaccurate data (Art. 16 GDPR).
  • Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR).
  • Data portability (Art. 20 GDPR).
  • Objection to processing based on a legitimate interest (Art. 21 GDPR).
  • Withdrawal of consent with effect for the future (Art. 7 (3) GDPR). For audience measurement, “Change consent” in the footer is enough.
  • Complaint to a data protection supervisory authority (Art. 77 GDPR). The controller has no establishment in the European Union, so no German supervisory authority is competent by virtue of a seat. You may lodge a complaint with the supervisory authority of your habitual residence or place of work (Art. 77 (1) GDPR).

The imprint belongs with this notice.