Skip to content
Back to Home

Privacy Policy

Last updated: October 6, 2026

1. Data Controller

The data controller within the meaning of the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG) is:

FluxHuman
Martin Benes (sole proprietor)
Vienna, Austria (full postal address in the imprint)
Email: hello@fluxhuman.com

Given the size of the business, we are not legally required to appoint a Data Protection Officer (Art. 37 GDPR). Please direct privacy enquiries to the address above.

2. Hosting and Server Logs

The site runs on a server we administer ourselves, rented from Contabo GmbH (Munich, Germany); Contabo acts as our processor for it. It is delivered through the edge network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Acting as a processor, Cloudflare handles connection and request data (notably IP addresses; because it terminates TLS, also the content of forms and chat messages on their way to our server) for delivery, DDoS protection and TLS termination. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure, performant site). Transfers to the United States rely on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

When you visit the site, our server briefly handles:

  • IP address (passed by Cloudflare in the cf-connecting-ip header)
  • Date and time of the request
  • Requested URL / path
  • HTTP status code and response size
  • Browser, browser version, and operating system (User-Agent)
  • Referrer URL (if your browser sends one)

IP addresses are kept only in memory for rate-limiting / abuse-prevention and are evicted automatically after at most eleven minutes. We do not maintain persistent access logs containing IP addresses, and IP addresses are stripped server-side before any analytics event is dispatched (see section 5). Our pages open no advance connections to third parties.

3. Contact Form, Chat, Checklist and Newsletter

3.1 Contact Form

When you use our contact form, we process the data you provide (name, email address, optional company, message, optional newsletter opt-in). This data is stored in our self-hosted PostgreSQL database (Payload CMS, server in Germany) and forwarded to our self-hosted automation platform n8n, which runs in the same private network. n8n then:

  • sends you a confirmation containing your name and message, and sends an internal copy of the enquiry to hello@fluxhuman.com, both via Brevo (see section 4);
  • stores your email address, name and company as a contact in our Brevo contact list so we can handle and follow up on your enquiry. You only receive promotional email if you ticked the newsletter box in the form and confirmed the subscription by email (section 3.3);
  • posts an internal notification to a private Slack channel containing your name, language, company, email address and the full text of your message.

If you click "Book a call" after submitting, we pass your name and email address to Cal.com to prefill the booking form (section 7). Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) and Art. 6 (1) (f) GDPR (responding to and following up on your request).

ROI report. If you request a detailed report in the ROI assistant, we process your email address and the calculated figures (e.g. savings, hours, payback) in the same way as a contact request under this section.

Ad-channel attribution (only with marketing consent). If you arrived via an ad click and explicitly opted in to marketing processing in the cookie banner, we additionally store the ad network's click identifier (e.g. Google, Microsoft, Meta, LinkedIn), the original landing page, and UTM parameters together with the lead record. This information is used solely for our own internal channel analysis; we forward it to the relevant ad networks only if and to the extent you have separately consented. Without marketing consent, click identifiers are neither stored nor forwarded. Legal basis: Art. 6 (1) (a) GDPR (consent). You may withdraw consent at any time via the cookie banner ("Configure").

3.2 Chat Widget

Our chat widget (including the ROI assistant at /roi) processes your messages to answer your questions and, if you wish, to prepare an initial assessment. We process the text of your messages, the earlier messages of the session, the conversation state (e.g. processes, weekly hours, hourly rate and tools you mention) and anything you type into the chat yourself, such as your name, email address or company. Please do not enter confidential or sensitive data in the chat. Your IP address is not passed to the automation or to any AI provider.

Processing chain. Your message goes from our server to our self-hosted automation platform n8n and from there to a language-model gateway we also run on the same server. The gateway stores no chat content, only technical metadata (max. 90 days). To generate the reply it forwards the request to external AI providers, which we currently use through their free tiers:

  • primarily to Requesty Ltd (London, United Kingdom), a routing service that passes the request on to a language model of Mistral AI SAS (Paris, France);
  • if that route does not respond, to LLM7.io (operator without a published address), a service that passes requests on to undisclosed model providers, or directly to Mistral AI SAS.

These providers do not act as our processors but as independent controllers. Under their own terms they may log the content and use it to improve or train their models; Requesty does not process requests exclusively in the EU or the United Kingdom. The European Commission has adopted an adequacy decision for the United Kingdom (Art. 45 GDPR); for processing outside the EU and the United Kingdom, and for LLM7.io, we cannot guarantee an adequate level of data protection. Please use the chat only for general questions about our services; for anything else, reach us via the contact form or by email. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures, where you enquire about our services) and Art. 6 (1) (f) GDPR (legitimate interest in answering your enquiry).

A random session ID is stored in your browser's localStorage (key Flux_chat_session_id, expires after 30 minutes of inactivity) to link the messages of a session. Only with your analytics consent (section 5) do we also create a persistent pseudonymous ID (Flux_chat_user_id) that does not expire on its own. The ROI assistant keeps the conversation in your browser (see section 6) so you can resume it.

If you leave your name and email address in the chat, we create a lead record (name, email, language, chat session ID, the process you described, weekly hours, hourly rate, tools, estimated cost and our recommendation; no transcript) and receive an internal notification with these details and the conversation through our self-hosted messaging service (Matrix, on our server). For booking or contact forms, section 3.1 also applies. If you have given analytics consent and submit a contact form in the same browser after a chat, the chat ID may be merged in our analytics tool with the pseudonymous identifier derived from your email address (see section 5).

Retention: chat transcripts are deleted from our automation platform after at most 30 days; they remain in backups for up to 90 days. Storage at the external AI providers follows their own retention periods.

3.3 Newsletter

If you sign up for our newsletter, we forward your email address to our n8n automation, which delivers the message via the processor Brevo(see section 4). Legal basis: Art. 6 (1) (a) GDPR (consent). The subscription only takes effect once you click the link in our confirmation email (double opt-in); Brevo stores the time of confirmation as proof. You can withdraw consent at any time via the unsubscribe link in any newsletter email or by sending a message to hello@fluxhuman.com.

3.4 EU AI Act Checklist Download

When you request the checklist, we process your email address, your language and the form placement. We store these details as a lead in our own database, add you to a contact list at Brevo and email you the checklist via Brevo. Legal basis: Art. 6 (1) (b) GDPR (sending the document you requested). We only send you further emails on AI automation and compliance if you ticked the optional box in the form (Art. 6 (1) (a) GDPR); we store the time of your consent. You can withdraw it at any time via the unsubscribe link in any email or by writing to hello@fluxhuman.com.

4. Email Delivery (Brevo)

For sending email (e.g. confirmations, replies, newsletters, the requested checklist) and as contact management for enquirers, newsletter subscribers and checklist recipients, we use the service Brevo, operated by Sendinblue SAS (106 Boulevard Haussmann, 75008 Paris, France). Brevo processes the recipient name, email address, message content, and technical delivery metadata (e.g. delivery status, bounces). Brevo also records whether an email is opened and which links in it are clicked (tracking pixel and link redirect), so we can evaluate delivery and the effect of our emails. Legal basis: Art. 6 (1) (b) or (f) GDPR; for newsletters and promotional email, Art. 6 (1) (a) GDPR. Processing takes place within the EU; a Data Processing Agreement under Art. 28 GDPR is in place.

Email to hello@fluxhuman.com is forwarded by Cloudflare to a mailbox at Google (Gmail), where we read and answer it.

5. Audience Measurement (PostHog, EU)

We measure site usage with PostHog, operated by PostHog Inc., hosted in the EU region (eu.i.posthog.com, servers in Frankfurt am Main, Germany). Unlike traditional analytics services:

  • No client-side tracking script runs in your browser, and your browser does not connect to PostHog. Events are reported server-side via our own endpoint /api/track.
  • Your IP address is stripped server-side before the event is forwarded to PostHog. PostHog explicitly receives no $ip field.
  • Without your consent, no persistent recognition is used. A random session ID is stored only in your browser's sessionStorage (key fluxhuman-session-id) and is deleted when you close the tab.

Without your consent we record only an anonymous page view or page exit containing: the path visited, viewport size, a session-scoped anonymous ID, and the referring domain (hostname of the previous page, e.g. google.com — explicitly without path or query string, so no personal URL components are processed), and, if present in the address you opened, the link's campaign tag (utm_source, utm_medium, utm_campaign, e.g. "linkedin / social" — these describe the link we published, not you, and are not stored in your browser). Legal basis: Art. 6 (1) (f) GDPR and § 165 (3) TKG 2021 (strictly necessary cookieless measurement without IP storage). With every event reported through /api/track we also send the browser identifier your browser includes in every request anyway (user agent, e.g. "Chrome 141 on macOS") and whether the browser reports itself as automated. Both serve only to tell automated bot traffic apart from human visits; the user agent is not linked to your IP address or any persistent identifier. In addition, we compare on the server technical details your browser sends with every request (the browser version from its client hints, its language setting). Only the result is stored — whether, and for which reason, a visit was classified as automated — not the details themselves.

With your consent we additionally record non-anonymous interaction events (e.g. contact form submission, chat message, click on a booking link), the full referrer URL, screen resolution and session duration, a technical measurement of the time until your first interaction with the page (first interaction timing), and error events from the browser if the page throws a JavaScript error (client error reporting; potentially personal content such as email addresses or tokens is stripped server-side before transmission). Chat events are then tied to the persistent chat ID Flux_chat_user_id. Legal basis: Art. 6 (1) (a) GDPR.

So that we can demonstrate whether visitors grant or refuse consent, we send the consent-banner impression and your choice (consent_banner_shown, consent_choice) to PostHog anonymously even without consent. No personal data and no IP address are transmitted. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in documenting and evaluating the consent request under Art. 7 (1) GDPR).

Also without consent, we anonymously send a small number of aggregate signals used solely for reach, conversion and operational measurement: a click on a call-to-action (cta_click — with the element's label and position, but no personal content), a view of the pricing page (pricing_viewed), the start of the ROI calculator (roi_calculator_started), a completed booking in the embedded calendar (call_booked — only the fact of the booking, no appointment details), chat usage (chat_session_started, chat_message, booking_intent_detected, roi_calculated — metadata such as language, message count, conversation stage, response time and, for roi_calculated, the estimated effort; no message text), checklist requests and delivery (lead_magnet_requested, lead_magnet_email_failed, lead_magnet_downloaded) and technical errors (chat_error, client_error_fatal, each after potentially personal content is stripped server-side). Without your consent these signals are not linked to a person or to any persistent ID. Because no information is stored on or read from your device for this, § 165 (3) TKG 2021 (consent for device access) does not apply; the processing relies solely on Art. 6 (1) (f) GDPR (legitimate interest in cookieless measurement of site effectiveness and in a working service).

You can withdraw your consent at any time via the cookie banner ("Configure"). A Data Processing Agreement with PostHog is in place. Where the US company PostHog Inc. has access to the data, this relies on the EU Standard Contractual Clauses in the Data Processing Agreement.

Pseudonymous person identifier after lead capture. When you submit our contact form or request an ROI report, your email address is converted on our own server into a one-way hash (HMAC-SHA-256 keyed with a secret known only to us) before anything is passed to PostHog. PostHog receives only this pseudonymous identifier plus channel details (UTM parameters, landing page, newsletter choice); your actual email address is never sent to PostHog. We attach the capture of the enquiry (lead_captured) and, where applicable, a forwarding error (lead_automation_failed) to this identifier. If you have given analytics consent, events from a prior chat session in the same browser are also linked to the same pseudonymous record. This constitutes pseudonymisation within the meaning of Art. 4 (5) GDPR; re-identification on PostHog's side is not reasonably possible without our cooperation. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in meaningful, data-minimised conversion measurement); you may object at any time under Art. 21 GDPR.

6. Browser Storage (No Tracking Cookies)

This site sets no tracking cookies and no advertising cookies. No third-party cookies are loaded. We only use first-party storage in your browser (localStorage / sessionStorage) for the following purposes:

  • fluxhuman-theme – your chosen colour scheme (light/dark).
  • fluxhuman-locale – your chosen language.
  • fluxhuman-consent – your consent decision.
  • fluxhuman-session-id / fluxhuman-session-start / fluxhuman-session-utm – anonymous session ID and UTM parameters, for the duration of the browser session only.
  • fluxhuman-session-attribution – click IDs plus first landing page and first referrer, only after marketing consent and only for the duration of the browser session.
  • Flux_chat_user_id – persistent pseudonymous ID for linking chat analytics events (section 5); created only with your analytics consent and does not expire on its own.
  • Flux_chat_session_id / Flux_chat_session_last_activity – chat session ID and timestamp of the last activity. A session expires after 30 minutes of inactivity.
  • fluxhuman-roi-v3-session:<locale> – conversation and state of the ROI assistant so you can resume it; discarded on your next visit once 24 hours have passed.

These entries stay on your device. The chat IDs and the conversation are sent to our server when you use the chat (see sections 3.2 and 5); otherwise the entries are not transmitted. You can delete them at any time via your browser settings.

7. Appointment Booking (Cal.com)

For appointment booking we use the calendar of Cal.com, Inc. (USA). It loads only when you click "Load calendar" on the contact page or a booking button elsewhere; before that, your browser makes no connection to Cal.com. Once it loads, Cal.com receives your IP address and technical browser data, and the calendar loads a profile picture from Google servers. If you book an appointment, Cal.com processes the data you enter (name, email address, any notes), makes it available to us, adds the appointment to our Google Calendar, creates a Google Meet link and sends you confirmation emails. Legal basis: Art. 6 (1) (a) GDPR and § 165 (3) TKG 2021 (your click on "Load calendar") and, for the booking itself, Art. 6 (1) (b) GDPR. The transfer to the US relies on Cal.com's EU Standard Contractual Clauses.

8. Fonts

We use the "Funnel Sans", "Funnel Display" and "Geist Mono" typefaces. They are self-hosted via the next/font mechanism: the font files are downloaded at build time and served directly from our server. Your browser does not connect to Google Fonts or any other font CDN.

9. Recipients of Personal Data

  • Contabo GmbH – rental of the server that runs the website, database, n8n, the AI gateway, our messaging service (Matrix) and our backups (Germany, EU; processor).
  • Cloudflare, Inc. – edge / tunnel delivery, DDoS protection, TLS, and forwarding of inbound email to hello@fluxhuman.com (USA, EU SCCs + DPF; processor).
  • Google (Gmail, Google Calendar, Google Meet) – the mailbox behind hello@fluxhuman.com and the calendar and video conferencing for booked appointments (EU/USA, DPF).
  • Sendinblue SAS (Brevo) – email delivery, newsletters and contact management (France, EU; processor).
  • PostHog Inc. – audience measurement on the EU region (Germany; processor; EU SCCs for the US entity).
  • Requesty Ltd, Mistral AI SAS and LLM7.io – generating chat replies (United Kingdom, France, or no published location respectively; independent controllers, see section 3.2).
  • Slack – internal notification of contact-form enquiries in a private Slack channel (USA; EU Standard Contractual Clauses and EU-US Data Privacy Framework; processor). Data processed: name, language, email address, company and the full message.
  • Cal.com, Inc. – appointment booking (USA; see section 7).

We run our database (PostgreSQL), the Payload CMS, the AI gateway, the automation platform (n8n) and our messaging service (Matrix) ourselves on the server rented from Contabo in Germany. Chat replies are generated by the external AI providers listed above.

10. Retention Periods

  • In-memory IP for rate-limiting: max. 11 minutes.
  • Contact-form submissions and lead records: until your enquiry is closed and for the duration of statutory retention obligations (e.g. 7 years under § 132 BAO for invoice-related records).
  • Newsletter data and Brevo contacts: until you withdraw consent or the lead record is deleted.
  • Chat transcripts in the automation platform: max. 30 days.
  • Technical metadata in the AI gateway: max. 90 days.
  • ROI assistant conversation in your browser: 24 hours.
  • PostHog events: 12 months, after which they are automatically deleted.
  • PostHog person profiles (pseudonymous identifier and channel details): until you object or request deletion.
  • n8n execution history (internal workflow logs, may contain lead content): max. 30 days.
  • Channel and campaign attribution on lead records: 90 days, then removed automatically.
  • Backups on our server (including database and automation): max. 90 days. Data we delete at your request remains in these access-restricted backups until that period ends.

11. Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR): request information about the data we hold.
  • Right to rectification (Art. 16 GDPR): request correction of inaccurate data.
  • Right to erasure (Art. 17 GDPR): request deletion of your data.
  • Right to restriction (Art. 18 GDPR).
  • Right to data portability (Art. 20 GDPR).
  • Right to object (Art. 21 GDPR), in particular against processing based on legitimate interests.
  • Right to withdraw consent (Art. 7 (3) GDPR), with effect for the future.

To exercise these rights, an informal email to hello@fluxhuman.com is sufficient.

12. Right to Complain

You have the right to lodge a complaint with a supervisory authority. The authority competent for us is:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna, Austria
Email: dsb@dsb.gv.at

13. Data Security

We employ technical and organisational security measures to protect your data against accidental or intentional manipulation, loss, destruction or unauthorised access. All traffic is delivered over TLS, passwords are stored only as cryptographic hashes, and access to the admin area is restricted to a limited group of authorised users.

14. Changes to This Privacy Policy

We may update this privacy policy to reflect changes in the law or in our services. The current version is always available on this page; the date of the most recent update is shown at the top.

15. Contact for Privacy Inquiries

For questions about data protection, please contact:
Email: hello@fluxhuman.com