Privacy

1. Controller

Controller within the meaning of the GDPR is:

Sonja Lechner, sole proprietor (Einzelunternehmerin)
Wattenbachgasse 29, 6112 Wattens, Austria
Email: hallo@lechner-studios.at

2. What data is processed

When you visit this site, technically necessary access data is processed by our hosting provider (see processors). This typically includes:

• IP address (truncated / for operational security)
• date and time of the request
• requested URL / referring URL
• user agent (browser, operating system)

This site sets no cookies and performs no tracking across websites or devices. For reach measurement we use a cookieless statistic without user profiles (Vercel Web Analytics and Speed Insights — see point 5).

Storage in your browser: Some functions create entries in your browser's storage. Unless stated otherwise, they stay on your device, and you can delete them in your browser settings.

• “ls-theme” (local storage): your choice of light or dark display from the icon in the navigation (“light” or “dark”), so that it is kept on your next visit.
• “ls-start-draft” (local storage): a draft of the project form on /start with what you have entered so far (e.g. name, email address, project description), so that nothing is lost if the page reloads. The draft is sent to us only when you submit the form and is then deleted from your browser.
• “ls-scan-found” (local storage): on /scan, the list of sticker motifs whose QR code you have already scanned (motif names only).
• “sd-session” (session storage): a random ID for your chat session. It is sent with each chat message so that we can limit the number of messages per session (see point 6), and it is deleted when you close the tab.

These entries serve only the function you are using, so no consent is required (§ 165(3) of the Austrian Telecommunications Act 2021, TKG 2021).

Live check on /scan: If you enter a website address there, a Vercel Function fetches the start page of that website once and evaluates its source code (embedded external servers, consent tool, legal-notice and privacy links). The address you entered and your IP address are processed. To limit requests, we store a counter per IP address (as a shortened hash keyed with a secret; expires after one hour) at Upstash (see section 5). The checked website is fetched from our server, not from your device; its operator receives no data about you. Neither the address nor the result is stored. Legal basis: Art. 6(1)(b) GDPR (performing the check you requested).

3. Contact requests

If you contact us via the contact form, the project form on /start or by email, we process the data you provide (name, email address, message body; in the project form also project type and goal, plus the optional details on company, timeline, budget range, existing website and further details) for the purpose of handling your request. Legal basis is Art. 6(1)(b) GDPR (pre-contractual steps) and/or Art. 6(1)(a) GDPR (consent). Form submissions are sent by a Vercel Function through the email delivery service Zoho ZeptoMail to our mailbox at Zoho Mail and stored there as an email; they are not stored in a database, CRM or any other system. To limit requests, we store a counter per IP address (as a shortened hash keyed with a secret; expires after one hour) at Upstash (see section 5). Retention: per mailbox archival; at latest after correspondence completion and applicable statutory retention periods. Consent may be withdrawn at any time — the lawfulness of processing carried out prior to withdrawal remains unaffected.

Booking a call: For a first call you can book an appointment at Cal.com through a link. Clicking it takes you off our website. On the booking page you enter your name and email address and choose a time; Cal.com processes this on our behalf, and we receive it as a booking confirmation. The appointment is added to our calendar at Zoho. The call takes place as a video call on Cal Video, Cal.com's video service. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps). Cal.com's own privacy policy also applies to the booking page itself.

Postal contact initiated by us: We occasionally write to accommodation businesses in Tyrol by letter to introduce our services. For this we process the business name and business address, and publicly visible information on its website that the letter refers to. This data comes from publicly accessible sources: the accommodation directories of the regional tourism associations (e.g. TVB Region Hall-Wattens) and the business’s own website. Legal basis is Art. 6(1)(f) GDPR; our legitimate interest is introducing our services to businesses for which they are relevant. We do not research any further personal data and do not share the data with third parties. Retention: up to 12 months after the letter if there is no reply; if you get in touch, the paragraph above applies. Objection: You can object to the use of your data for marketing at any time without giving reasons (Art. 21(2) GDPR), informally by email, phone or letter. We then delete your data and keep only name and address on a suppression list so that you receive no further mail from us.

4. Legal bases (Art. 6 GDPR)

• Art. 6(1)(f) (legitimate interest) — technical provision of the website incl. server logs to ensure operation and IT security; operation of the AI chat assistant for visitor support and abuse prevention; introducing our services to accommodation businesses by letter (see section 3).
• Art. 6(1)(b) (contract / pre-contractual measures) — answering requests sent through the forms or by email; booking a call through Cal.com.

5. Processors

The site is hosted by Vercel Inc. (Privacy Policy, DPA). Delivery is performed via Vercel's EU edge network; server logs for operational security are processed at Vercel. Standard Contractual Clauses and a Data Processing Agreement are in place with Vercel.

To tailor and improve the site, we collect usage statistics with Vercel Web Analytics. The measurement is cookieless and builds no user profile: visits are counted through a hash of the incoming request that expires after one day, so visitors are not recognised across days, websites or devices. For each page view, the page address without URL parameters (except the sticker code on /scan, which identifies a sticker location, not a person), the referring page, device and browser type, operating system and country are sent; only aggregated figures are evaluated. In addition, Vercel Speed Insights records technical page-load metrics (Core Web Vitals) per page, device type, connection type and country. To do this, the two scripts read the page address, the browser identification and (Speed Insights) the connection type in your browser; they create no entries on your device. Legal basis: Art. 6(1)(f) GDPR (legitimate interest); you may object under Art. 21 GDPR. Processing is carried out by our hosting provider Vercel named above.

In addition, Zoho Corporation B.V. (Hoogoorddreef 15, 1101 BA Amsterdam, Netherlands) is used as an email provider (Zoho Mail), for our calendar (Zoho Calendar) and to deliver the form messages (Zoho ZeptoMail); EU data center, DPA in place (privacy policy).

For the AI chat assistant, chat messages are transmitted to Anthropic PBC (548 Market St, San Francisco, CA 94104, USA) to generate replies (privacy policy). Anthropic processes these data to deliver the API service and, as standard, does not use them to train AI models. Under its retention rules for commercial API customers, Anthropic deletes inputs and outputs within 30 days; content that Anthropic's systems flag as a possible violation of its usage policy is kept for up to 2 years. Transfer to the US is based on the EU-US Data Privacy Framework (DPF) and EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

For rate-limiting of the AI chat, the forms and the live check on /scan, we store counters with a short expiry at Upstash, Inc. (Vercel KV; USA) (privacy policy): one per IP address (as a shortened hash keyed with a secret; expires after a few minutes for the AI chat, after one hour for the forms and /scan), one per chat session (random session ID; expires after one day) and daily counters with no personal reference. No further data is stored at Upstash. Transfer to the US is based on EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

For technical error diagnostics, Sentry (Functional Software, Inc.) is used in its EU data region (privacy policy). Only technical error data is transmitted: the error message, the code location, the requested path without URL parameters and the browser identification. Form and chat content, cookies and click histories are not collected, and IP addresses are not stored; a Data Processing Agreement is in place. Any support access from the US is based on EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

For booking a call (see point 3) we use Cal.com, Inc. (USA) (privacy policy). Cal.com processes the details entered when booking and the chosen time on our behalf and provides the video call (Cal Video); a Data Processing Agreement is in place. Transfer to the US is based on EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

If you contact us via WhatsApp (click-to-chat from the button on this website or from our Google Business Profile), we process the data you send in order to handle your enquiry: your phone number, your WhatsApp profile name and the message content. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). The service is operated by WhatsApp Ireland Limited (Ireland), part of the Meta group (privacy policy). Message content is end-to-end encrypted. Metadata such as phone numbers, timestamps and device data is nonetheless processed by WhatsApp and may be transferred to the US, based on the EU-US Data Privacy Framework and EU Standard Contractual Clauses pursuant to Art. 46 GDPR. Use is voluntary; you can reach us equally by email, telephone or the contact form. We retain chat histories only for as long as needed to handle your enquiry.

No further processors are used on this site — in particular no third-party advertising, tracking, profiling or embedded services and no cookie-based analytics.

6. AI chat assistant

This site operates a disclosed AI chat assistant (“The Studio Director”) that informs and routes visitors about services, projects and contact options.

• Purpose: visitor support and detection and prevention of abusive use.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the controller).
• Processing: Chat messages are transmitted in real time to the Anthropic Claude API to generate a reply. We do not store chat content: the conversation is held only in your browser and sent with each request. As standard, Anthropic deletes inputs and outputs within 30 days (content flagged as a possible usage-policy violation: up to 2 years) and does not use them to train AI models. Please do not enter sensitive data in the chat.
• Rate-limiting: To limit use, we store in Upstash/Vercel KV one counter per IP address (as a shortened hash keyed with a secret; expires after a few minutes) and one per chat session (random ID from your browser's session storage, see point 2; expires after one day). The hash is pseudonymisation within the meaning of Art. 4(5) GDPR, not anonymisation. Apart from these counters and the counters for the forms and /scan (sections 2 and 3), no personal data is stored in the KV store.
• Third-country transfer: Anthropic and Upstash are US providers. Transfers are based on the EU-US Data Privacy Framework (DPF) and EU Standard Contractual Clauses pursuant to Art. 46 GDPR.
• Objection: You may refrain from using the AI chat at any time. To object to processing based on legitimate interest, please contact hallo@lechner-studios.at.

7. Retention

• Server logs (Vercel): per the hosting provider's default retention; generally short-term for operational security.
• Email correspondence: until the purpose of the request is fulfilled, at most within statutory retention periods (e.g. § 132 BAO for business correspondence — up to 7 years).
• Rate-limiting (Upstash/Vercel KV): counters per IP hash deleted automatically after a few minutes (AI chat) or one hour (forms, /scan), per chat session and daily counters after one day.
• Chat content: not stored by us, held only in your browser for the duration of the session; at Anthropic, as standard, at most 30 days (see point 6).
• Form draft (“ls-start-draft”): in your browser until you submit the form or delete the entry.
• Bookings (Cal.com): until the call has taken place; if it leads to an enquiry, the period for email correspondence applies.
• Postal contact: business name and address for up to 12 months after the letter; after an objection, only name and address on the suppression list.

8. Your rights (Art. 15–21 GDPR)

You have the right at any time to:

• access (Art. 15)
• rectification (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interests (Art. 21)

Requests can be sent to hallo@lechner-studios.at.

9. Right to lodge a complaint

You have the right to lodge a complaint with the Austrian supervisory authority:

Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Vienna
www.dsb.gv.at

10. Third-country transfer

Vercel is a US provider with EU edge delivery. Where a transfer to the US occurs, it is based on the EU Standard Contractual Clauses pursuant to Art. 46 GDPR. The email provider used by the operator may also process data when receiving inbound mail.

11. Last updated

October 2026.