Privacy notice
Version 2026-11-11.1
Local prototype draft. Production hosting, AI contracts and optional services must be reviewed before public launch.
Controller and contact
The controller is Delta Garage UG (haftungsbeschränkt), Pfaffenhofener Str. 3A, 85302 Gerolsbach, Germany, represented by Dorota Igras-Wesolowski. Privacy enquiries: service@deltagarage.de, phone +49 8445 929 78 79.
Account and community
We process your email, a one-way password hash and nickname for your account. First/last name, postal code and city are optional. Optional data include profile text, photos, vehicle details, questions, replies, comments and ratings. Account and requested features rely on GDPR Article 6(1)(b); abuse prevention, moderation and evidence on Article 6(1)(f) (secure and accountable portal operation).
Public content
Nicknames, avatars, biographies, profile photos, vehicles, posts, ratings and publication times are publicly accessible and may be indexed by search engines. Email, first/last names and postal codes are not published as community identifiers. Do not post number plates, complete VINs, addresses, health information or third-party personal data. Check images for people, documents and location details.
AI processing
A requested AI answer sends the question, relevant conversation, vehicle data, selected question images and matching knowledge excerpts to the configured AI service. Account passwords and account email are not AI input fields, but free text or images may still contain personal data. A Codex test connection currently exists; production provider, contract and transfer review remains pending. Portal storage is not training our own model. Approved solutions become retrievable context for later answers. AI output may be wrong and is not used for automated decisions with legal effects.
Hosting, recipients and international transfers
The prototype runs locally in Docker. Hostinger is planned for production; legal entity, data-centre country, subprocessors, retention and processing agreement must be established before publication. Administrators and contracted providers receive necessary access only. Services outside the EEA require assessment under GDPR Articles 44 et seq., including valid safeguards and any additional measures. No unverified adequacy or contractual safeguard is claimed.
Cookies and optional measurement
Necessary cookies support login, sessions, language, CSRF protection and cookie choices (TDDDG section 25(2)). Sessions expire after 14 days by default and CSRF cookies after one year. Cookie choices last 180 days and can be changed in Cookie settings. Google Analytics is prepared but disabled pending technical and legal clearance. Later activation requires voluntary consent under TDDDG section 25(1) and GDPR Article 6(1)(a). Refusal does not restrict portal use. No Analytics scripts or measurement signals load before consent. AdSense is inactive and requires a separately configured certified CMP.
Google Analytics – prepared feature
If enabled later: provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Technical browser/device information and visits to allowed overview pages are processed; network communication transmits an IP address. Google may involve recipients in third countries. This integration sends no user ID, form content, search terms or case/profile pages and disables ad personalisation. Analytics cookies are limited to 180 days. Before release, Google agreements, transfer mechanisms, property settings (including event retention and disabled enhanced measurement) and provider information must be verified and this notice completed.
Retention and deletion
Account data are retained for account administration; posts until deletion or necessary moderation. Erasure requests are reviewed individually, including derived knowledge excerpts, media and publicly attributed content; statutory retention or specific legal claims may require limited further storage. Registration acknowledgements are retained with the account. Cookie receipts are stored without IP addresses or account links and removed by the cleanup job after no more than 210 days. Completed privacy requests are deleted after 90 days. Backup and hosting/AI log retention still requires a binding production policy.
Your rights
You may request access, rectification, erasure, restriction and portability under GDPR Articles 15–20, and object for reasons relating to your situation to processing under Article 6(1)(f) (Article 21). Consent can be withdrawn for the future without affecting earlier lawfulness. Contact us through My data or service@deltagarage.de. We normally respond within one month and explain any necessary extension. You may complain to a supervisory authority, in particular the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.