Last updated: April 26, 2026
The data controller within the meaning of the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG) is:
FluxHuman
Martin Benes (sole proprietor)
Vienna, Austria
Email: hello@fluxhuman.com
Given the size of the business, we are not legally required to appoint a Data Protection Officer (Art. 37 GDPR). Please direct privacy enquiries to the address above.
The site is operated on our own infrastructure and delivered through the edge network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Acting as a processor, Cloudflare handles connection metadata (notably your IP address) for delivery, DDoS protection, and TLS termination. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure, performant site). Transfers to the United States rely on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
When you visit the site, our server briefly handles:
cf-connecting-ip header)IP addresses are kept only in memory for rate-limiting / abuse-prevention and are evicted automatically after at most five minutes. We do not maintain persistent access logs containing IP addresses, and IP addresses are stripped server-side before any analytics event is dispatched (see section 5).
When you use our contact form, we process the data you provide (name, email address, optional company, optional phone, message, optional newsletter opt-in). This data is stored in our self-hosted PostgreSQL database (Payload CMS, EU-based servers) and forwarded to our self-hosted automation platform n8n, which runs in the same private Docker network. n8n does not forward the data to third parties; it only handles internal routing of your enquiry. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) and Art. 6 (1) (f) GDPR (responding to your request).
Our chat widget processes your messages to answer your questions. Depending on the operating mode, replies are generated either by a locally hosted language model (Ollama) on our own infrastructure or by an n8n automation; in both cases, your messages do not leave our EU-based infrastructure. A random, non-identifying session ID (e.g. session-1742...) is stored in your browser's localStorage (key Flux_chat_session_id) so that individual messages within a session can be correlated. If you submit a booking or contact form via the chat, the rules of section 3.1 apply. Chat transcripts are automatically deleted from our automation platform after at most 30 days.
If you sign up for our newsletter, we forward your email address to our n8n automation, which delivers the message via the processor Brevo(see section 4). Legal basis: Art. 6 (1) (a) GDPR (consent). You can withdraw consent at any time via the unsubscribe link in any newsletter email or by sending a message to hello@fluxhuman.com.
For sending transactional emails (e.g. confirmations, replies, newsletters, lead follow-up emails) we use the SMTP service Brevo, operated by Sendinblue SAS(106 Boulevard Haussmann, 75008 Paris, France). Brevo processes the recipient's name, email address, the message contents and technical delivery metadata (e.g. delivery status, bounces). Legal basis: Art. 6 (1) (b) or (f) GDPR. Processing takes place inside the EU; a Data Processing Agreement under Art. 28 GDPR is in place.
We measure usage of our site with the analytics tool PostHog, operated by PostHog Inc., hosted in the EU region (eu.i.posthog.com, servers in Frankfurt, Germany). Unlike conventional analytics services:
/api/track.$ipfield.sessionStorage (key fluxhuman-session-id) and is deleted when you close the tab.Without your consent, we record only an anonymous page view (URL, viewport size, anonymous session ID). The legal basis is Art. 6 (1) (f) GDPR and § 165 (3) of the Austrian TKG 2021 (technically necessary audience measurement without cookies and without IP storage).
With your consent, we additionally record interaction events that are not pure page views (e.g. contact-form submissions, chat messages, clicks on booking links). Legal basis: Art. 6 (1) (a) GDPR.
You can withdraw consent at any time via the cookie banner ("Configure"). A Data Processing Agreement with PostHog is in place.
This site sets no tracking cookies and no advertising cookies, and loads no third-party cookies. We use only first-party browser storage (localStorage / sessionStorage) for the following technically necessary purposes:
fluxhuman-theme – your selected colour theme (light/dark).fluxhuman-locale – your selected language.fluxhuman-consent – your consent choice.fluxhuman-session-id / fluxhuman-session-start / fluxhuman-session-utm – an anonymous session ID and UTM parameters, valid only for the duration of the browser session.Flux_chat_session_id – your chat session ID, only if you use the chat widget.These entries stay on your device and are not transmitted to third parties. You can clear them at any time through your browser settings.
On some pages we link out to Cal.com (Cal.com, Inc.) for appointment booking. You leave our website only when you actively click such a link. Once you are on Cal.com, the Cal.com privacy policy applies. We do not embed Cal.com scripts or iframes on our pages.
We use the "Geist" and "Geist Mono" typefaces. They are self-hosted via the next/font mechanism: the font files are downloaded at build time and served directly from our server. Your browser does not connect to Google Fonts or any other font CDN.
Our database (PostgreSQL), the Payload CMS, the chat backend (Ollama) and the automation platform (n8n) all run on our own EU-based infrastructure.
You have the following rights regarding your personal data:
To exercise these rights, an informal email to hello@fluxhuman.com is sufficient.
You have the right to lodge a complaint with a supervisory authority. The authority competent for us is:
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna, Austria
Email: dsb@dsb.gv.at
We employ technical and organisational security measures to protect your data against accidental or intentional manipulation, loss, destruction or unauthorised access. All traffic is delivered over TLS, passwords are stored only as cryptographic hashes, and access to the admin area is restricted to a limited group of authorised users.
We may update this privacy policy to reflect changes in the law or in our services. The current version is always available on this page; the date of the most recent update is shown at the top.
For questions about data protection, please contact:
Email: hello@fluxhuman.com