Skip to content
FLX
DE
Menu

Legal

Privacy

Every statement below was checked against the code and describes the position today. The German version is the authoritative one.

Controller

The controller within the meaning of Art. 4 (7) GDPR is:

Checkable, not asserted. Cookie names, lifetimes and the question of what loads before you consent can all be verified on this page itself. What a template would put here is not what is written here.
Registered name
FLX LLC
Address
1021 E Lincolnway, Suite #7652
Cheyenne, WY 82001
USA
Email
info@flxlabs.io
Data protection officer
No data protection officer has been appointed. Section 38 (1) BDSG does not require one, because fewer than twenty people here are permanently engaged in the automated processing of personal data.

What is processed

Each operation is listed below with the data, the purpose, the legal basis and how it is stored.

  • Visiting this website

    Data
    Requesting a page produces log data at the hosting provider for technical reasons: IP address, time, requested address, amount of data transferred, referring page and browser identification. The application itself writes no such logs.
    Purpose
    Delivering the page and keeping the service technically operational.
    Legal basis
    Art. 6 (1) (f) GDPR — legitimate interest in operating the site without disruption.
    Storage
    The pages are served by Vercel. On the Pro plan we use, Vercel retains runtime logs for one day and deletes them automatically thereafter.

  • Contact form

    Data
    Name, email address, subject and message, each within the length the form allows.
    Purpose
    Handling and answering your enquiry.
    Legal basis
    Art. 6 (1) (b) GDPR for enquiries relating to a contract, otherwise Art. 6 (1) (f) GDPR.
    Storage
    The details are delivered to us as an email. This website keeps no database for them and does not store the message. Enquiries that do not lead to an engagement are deleted no later than six months after the last contact. Where a contract follows, the commercial and tax retention periods of six and ten years respectively apply instead.

  • Limiting bulk submissions

    Data
    The IP address from the “X-Forwarded-For” header of the submitting request.
    Purpose
    The form accepts at most 5 submissions per window per address. Without that limit it could be abused for bulk sending.
    Legal basis
    Art. 6 (1) (f) GDPR — legitimate interest in preventing abuse.
    Storage
    In the server’s memory only, as a counter with an expiry time. The window is 60 seconds, after which the entry is discarded. Nothing is stored permanently and no log file is written.

  • Booking calendar on the contact page

    Data
    When you open the calendar, Cal.com receives your IP address and browser identification and sets cookies. If you book a slot, your name, email address and what you write about the meeting are added.
    Purpose
    Showing available times and arranging a conversation.
    Legal basis
    § 25 (2) no. 2 TDDDG for loading it — the calendar is only loaded on your explicit click. Art. 6 (1) (b) GDPR for the booking itself.
    Storage
    At Cal.com. As long as you do not open the calendar, no request goes there and nothing is stored on your device.

  • Light/dark display preference

    Data
    The value “light”, “dark” or “system” under the key “theme”.
    Purpose
    Remembering the appearance you chose, so that it survives to the next visit.
    Legal basis
    § 25 (2) no. 2 TDDDG — a function explicitly requested by the user, for which no consent is required.
    Storage
    In the browser’s local storage, not in a cookie. The value never leaves your device and is not transmitted to us. It can be cleared in the browser settings.

  • Audience measurement with Google Analytics

    Data
    Your IP address, from which Google derives the approximate location and which, according to Google, is not stored, the pages visited, time on page, browser, details of your device and an approximate location at city level and the referring page. In addition, events on the page itself: how far you scroll, which outbound links and files you click, and whether you started or submitted a form. The contents of your form fields are not transmitted, and neither is your name or email address. Processing for advertising is switched off explicitly: on every page view we instruct Google to set no advertising cookies and to use no data for ad measurement or personalised advertising.
    Purpose
    Seeing which pages get read and which do not, so the site can be shaped accordingly.
    Legal basis
    Art. 6 (1) (a) GDPR and § 25 (1) TDDDG — your consent and nothing else. Without it no script is loaded and no cookie is set. You can withdraw consent at any time via “Change consent” in the footer, which deletes the cookies that were set.
    Storage
    Cookies on your device, lifetime two years, and measurement data on Google’s servers. Event data is retained in the property for fourteen months and deleted automatically thereafter. Where that data goes is set out under “Recipients” below.

  • Your decision about audience measurement

    Data
    A cookie named “cc_cookie”. It records which categories you accepted or declined, and when.
    Purpose
    Remembering your answer to the consent question, so you are not asked again on every page — and so that what you agreed to can be shown if it is ever disputed.
    Legal basis
    § 25 (2) no. 2 TDDDG — storing it is necessary to carry out the very decision you made, so it does not itself require consent.
    Storage
    A first-party cookie with SameSite=Lax and a lifetime of 182 days. It carries no identifier by which your device could be recognised: the field in which the software would otherwise write a random identifier is overwritten on every decision with a fixed value that is the same for every visitor. The cookie is not sent to third parties.

Not in use at present

The position below was checked against this website’s source code and describes what is built in today. If a service is added later, this notice will be extended first.

  • No audience measurement is loaded without your consent. Before you agree, no request goes to Google and no cookie is set.
  • The two typefaces are delivered together with the page. Loading it makes no request to Google Fonts or any other font service.
  • Apart from the booking calendar on the contact page, no third-party content is embedded: no maps, no videos, no social media plugins.
  • There is no profiling and no automated decision-making within the meaning of Art. 22 GDPR.
  • Data is not shared for advertising purposes and is not sold.

Recipients

The following service providers receive data when you use this website. For hosting, mail delivery and booking, they do so on our behalf under Art. 28 GDPR. For audience measurement the classification is disputed: the German supervisory authorities treat Google Analytics as joint controllership under Art. 26 GDPR rather than processing on our behalf.

Vercel — serving the site

The website is hosted with Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Log data is produced in the process. The pages are delivered over Vercel’s global edge network, and processing therefore also takes place in the United States. A processing agreement under Art. 28 GDPR is in place: Vercel’s Data Processing Addendum applies to the Pro plan and takes effect with the agreement itself. It incorporates the Standard Contractual Clauses under Art. 46 (2) (c) GDPR for the transfer to the United States.

Hetzner Online GmbH — mailbox

Your enquiry is sent and received through our own mailbox. It is hosted by Hetzner Online GmbH in Germany, who run the servers for it. No provider outside Germany is involved, and the message does not leave the EU. A processing agreement under Art. 28 GDPR is in place, accepted on 23 August 2026.

Cal.com — booking

The calendar on the contact page is provided by Cal.com. It loads only when you open it; only then does Cal.com receive your IP address. If you book a slot, Cal.com processes the details you give on our behalf.

Google Analytics 4 — audience measurement

The contracting party is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Measurement only takes place after your consent. Data may be transferred to Google LLC in the United States in the process. The basis is the European Commission adequacy decision on the EU-US Data Privacy Framework, to which Google LLC has certified. Should that basis fall away, the Standard Contractual Clauses under Art. 46 (2) (c) GDPR apply instead.

Your rights

You have the following rights against the controller. An informal message is enough to exercise them.

  • Access to the data processed (Art. 15 GDPR).
  • Rectification of inaccurate data (Art. 16 GDPR).
  • Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR).
  • Data portability (Art. 20 GDPR).
  • Objection to processing based on a legitimate interest (Art. 21 GDPR).
  • Withdrawal of consent with effect for the future (Art. 7 (3) GDPR). For audience measurement, “Change consent” in the footer is enough.
  • Complaint to a data protection supervisory authority (Art. 77 GDPR). The controller has no establishment in the European Union, so no German supervisory authority is competent by virtue of a seat. You may lodge a complaint with the supervisory authority of your habitual residence or place of work (Art. 77 (1) GDPR).

The imprint belongs with this notice.