Privacy

1. Controller

Controller within the meaning of the GDPR is:

Sonja Lechner, sole proprietor (Einzelunternehmerin)
Wattenbachgasse 29, 6112 Wattens, Austria
Email: hallo@lechner-studios.at

2. What data is processed

When you visit this site, technically necessary access data is processed by our hosting provider (see processors). This typically includes:

• IP address (truncated / for operational security)
• date and time of the request
• requested URL / referring URL
• user agent (browser, operating system)

This site sets no cookies and performs no personal tracking. For reach measurement we use only a cookieless, anonymous statistic(Vercel Web Analytics — see point 5).

3. Contact requests

If you contact us via the contact form or by email, we process the data you provide (name, email address, message body) for the purpose of handling your request. Legal basis is Art. 6(1)(b) GDPR (pre-contractual steps) and/or Art. 6(1)(a) GDPR (consent). Form submissions are forwarded by a Vercel Function to our email provider Zoho and stored as an email in our mailbox; no persistence in a database, CRM, or other system occurs. Retention: per mailbox archival; at latest after correspondence completion and applicable statutory retention periods. Consent may be withdrawn at any time — the lawfulness of processing carried out prior to withdrawal remains unaffected.

4. Legal bases (Art. 6 GDPR)

• Art. 6(1)(f) (legitimate interest) — technical provision of the website incl. server logs to ensure operation and IT security; operation of the AI chat assistant for visitor support and abuse prevention.
• Art. 6(1)(b) (contract / pre-contractual measures) — answering inbound requests sent by email.

5. Processors

The site is hosted by Vercel Inc. (Privacy Policy, DPA). Delivery is performed via Vercel's EU edge network; server logs for operational security are processed at Vercel. Standard Contractual Clauses and a Data Processing Agreement are in place with Vercel.

To tailor and improve the site, we collect anonymous, aggregated usage statistics with Vercel Web Analytics. The measurement is cookieless: no cookies, no cross-device recognition, no persistent user profile. Only aggregated metrics are collected (pages viewed, referring page, approximate region at country level, device/browser type); individuals are not identifiable. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). As no information is stored on or read from your device, no consent is required; you may object under Art. 21 GDPR. Processing is carried out by our hosting provider Vercel named above.

In addition, Zoho Corporation B.V. (Hoogoorddreef 15, 1101 BA Amsterdam, Netherlands) is used as an email provider (Zoho Mail); EU data center, DPA in place (privacy policy).

For the AI chat assistant, chat messages are transmitted to Anthropic PBC (548 Market St, San Francisco, CA 94104, USA) to generate replies (privacy policy). Anthropic processes these data solely to deliver the API service; messages are not stored by Anthropic and Anthropic does not train AI models on commercial API data. Transfer to the US is based on the EU-US Data Privacy Framework (DPF) and EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

For rate-limiting of the AI chat, a pseudonymised (one-way SHA-256 hashed) IP counter with a short expiry is stored in Upstash, Inc. (Vercel KV; USA) (privacy policy). The counter expires automatically after a short TTL; no further personal data is stored at Upstash. Transfer to the US is based on EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

For error and crash diagnostics of the site, Sentry (Functional Software, Inc., USA) is used (privacy policy). Data is stored in Sentry's EU data region. Only technical error data is transmitted; no personal data by default (no IP address, no cookies; sendDefaultPii disabled). Where support access from the US occurs, it is based on EU Standard Contractual Clauses pursuant to Art. 46 GDPR; a Data Processing Agreement is in place.

If you contact us via WhatsApp (click-to-chat, for example from our Google Business Profile), we process the data you send in order to handle your enquiry: your phone number, your WhatsApp profile name and the message content. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). The service is operated by WhatsApp Ireland Limited (Ireland), part of the Meta group (privacy policy). Message content is end-to-end encrypted. Metadata such as phone numbers, timestamps and device data is nonetheless processed by WhatsApp and may be transferred to the US, based on the EU-US Data Privacy Framework and EU Standard Contractual Clauses pursuant to Art. 46 GDPR. Use is voluntary; you can reach us equally by email, telephone or the contact form. We retain chat histories only for as long as needed to handle your enquiry.

No further processors are used on this site — in particular no third-party advertising, tracking, profiling or embedded services and no cookie-based analytics.

6. AI chat assistant

This site operates a disclosed AI chat assistant (“The Studio Director”) that informs and routes visitors about services, projects and contact options.

• Purpose: visitor support and detection and prevention of abusive use.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the controller).
• Processing:Chat messages are transmitted in real time to the Anthropic Claude API to generate a reply. Neither we nor Anthropic store chat content; Anthropic does not train AI models on commercial API data. The conversation is held exclusively in the visitor's browser and sent with each request (stateless operation).
• Rate-limiting: To limit the rate of use, a pseudonymised (one-way hashed, non-reversible) IP counter with a short expiry is stored in Upstash/Vercel KV. This constitutes pseudonymisation within the meaning of Art. 4(5) GDPR, not anonymisation. No further personal data is stored in the KV store.
• Third-country transfer: Anthropic and Upstash are US providers. Transfers are based on the EU-US Data Privacy Framework (DPF) and EU Standard Contractual Clauses pursuant to Art. 46 GDPR.
• Objection: You may refrain from using the AI chat at any time. To object to processing based on legitimate interest, please contact hallo@lechner-studios.at.

7. Retention

• Server logs (Vercel):per the hosting provider's default retention; generally short-term for operational security.
• Email correspondence: until the purpose of the request is fulfilled, at most within statutory retention periods (e.g. § 132 BAO for business correspondence — up to 7 years).
• AI chat rate-limiting (Upstash/Vercel KV): pseudonymised IP counter; short TTL (automatic expiry); no persistent storage.
• Chat content: not stored by us or by Anthropic; held client-side (browser) only for the duration of the session.

8. Your rights (Art. 15–21 GDPR)

You have the right at any time to:

• access (Art. 15)
• rectification (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interests (Art. 21)

Requests can be sent to hallo@lechner-studios.at.

9. Right to lodge a complaint

You have the right to lodge a complaint with the Austrian supervisory authority:

Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Vienna
www.dsb.gv.at

10. Third-country transfer

Vercel is a US provider with EU edge delivery. Where a transfer to the US occurs, it is based on the EU Standard Contractual Clauses pursuant to Art. 46 GDPR. The email provider used by the operator may also process data when receiving inbound mail.

11. Last updated

July 2026.