Privacy Policy

This Privacy Policy applies to www.sebastiannichtern.com, including the applications at /apps/incomecalc and /apps/tradingbot, and the associated public and restricted hosts bot.sebastiannichtern.com and bot-private.sebastiannichtern.com.

Third-party websites and services linked from the site have their own privacy notices. Data is transferred to them only when you follow an external link, unless this policy expressly describes otherwise.

The website and its applications are delivered through Vercel. Each request causes the hosting infrastructure to process technical connection data so that it can deliver the requested page, protect the service, and investigate errors.

Data processed

IP address, date and time, requested URL, HTTP method and status code, referrer, browser and device information, and technical error data.

Purpose

Website delivery, load distribution, prevention of abuse, stability, and error analysis.

Legal basis

Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the service.

Retention

Logs are kept only for as long as they are required for operations, security, and error analysis. The specific period depends on the type of log and the Vercel configuration.

Recipient / provider

Vercel Inc., United States.

Vercel Privacy Notice

We use Vercel Web Analytics to understand the use of individual pages in aggregate. According to Vercel, the service does not use cookies, does not store IP addresses in analytics data points, and does not track visitors across different websites or days. A daily hash generated from the request is discarded after 24 hours.

Data processed

Page path, time, referrer, approximate location, device type, operating system, and browser. We do not record custom events containing contact details.

Purpose

Anonymous audience measurement and improvement of the service.

Legal basis

Article 6(1)(f) GDPR. Our legitimate interest is a data-minimising assessment of website use.

Retention

The visitor hash is discarded after 24 hours. Reports are provided only in aggregate.

Recipient / provider

Vercel Inc., United States.

Vercel Web Analytics privacy information

Some settings are stored only in your browser so that the applications work as selected on your next visit. These include the website appearance, the appearance of the unlisted Bali page, calculator values, and display options for the trading dashboard.

You can delete this data at any time using your browser settings. Without local storage, the relevant convenience settings will be reset.

Data processed

Display preferences, calculator state, and dashboard view options in Local Storage. Required cookies are also used for calculator drafts and authentication to the private dashboard.

Purpose

Remembering selected settings, restoring a calculator draft, and secure session management.

Legal basis

Section 25(2)(2) TDDDG and, where personal data is involved, Article 6(1)(f) GDPR. Storage is required for the requested functions and their secure operation.

Retention

Local Storage data remains on the device until you or the application deletes it. Cookie durations are described in the following sections.

Recipient / provider

Processing on your device and, for session features, the providers named below.

Calculations take place directly in your browser. Inputs are stored locally and are also sent automatically to our server as a pseudonymous draft so they can be restored on a later visit. The draft is linked to a random session identifier, not to a name or user account.

Calculator values can allow inferences about personal or financial circumstances. Use sample values when precise personal information is unnecessary, and do not enter names or other directly identifying information.

Data processed

This includes employment type, income or revenue, federal state, age, tax class, church tax option, children, insurance type, and contribution settings. A random session identifier, update time, and technical checksum are also stored.

Purpose

Performing the requested calculation and restoring the last draft.

Legal basis

Article 6(1)(f) GDPR and Section 25(2)(2) TDDDG. Our legitimate interest is a reliable calculator that can restore an interrupted session.

Retention

The server draft and signed, HTTP-only session cookie expire after 30 days. Local values remain until they are deleted in the browser.

Recipient / provider

Upstash Inc., United States, as the Redis database provider.

Upstash Privacy Policy

The public trading dashboard reads approved, non-personal bot and market data from Supabase. For the private operator area, Supabase also processes login details and manages the authentication session. The private area is restricted to an authorised operator.

Data processed

Technical connection data for public access. Login additionally involves an email address, password transmission to Supabase, session identifiers, signed access tokens, authentication status, and security logs.

Purpose

Providing current dashboard data, authentication, access control, and protection of the private area.

Legal basis

Article 6(1)(f) GDPR. Our legitimate interest is secure delivery and access control. Authentication cookies are required under Section 25(2)(2) TDDDG.

Retention

Authentication cookies remain valid for the session duration set by Supabase and are deleted or invalidated on sign-out. Account data remains until the operator account is deleted; security logs are retained only for required operational and legal periods.

Recipient / provider

Supabase, Inc., United States. The primary data region depends on the configuration of the Supabase project.

Supabase Privacy Policy

The public trading dashboard loads an interactive stock chart from TradingView. Your browser therefore connects directly to TradingView. TradingView states that embedded widgets do not set cookies. It processes the IP address briefly to deliver data and protect its servers against DDoS attacks.

Data processed

IP address, URL of the embedding page, widget type, displayed symbol, and standard technical connection data.

Purpose

Displaying the interactive market chart and protecting the widget infrastructure.

Legal basis

Article 6(1)(f) GDPR. Our legitimate interest is the understandable visualisation of publicly available market data.

Retention

TradingView states that it retains the IP address only briefly to protect its servers. TradingView's own periods apply to any other data.

Recipient / provider

TradingView, Inc., United States.

TradingView Privacy PolicyTradingView widget privacy information

If a feature is expressly identified as an AI feature using DeepSeek and you actively use it, your input, context required for the response, and technical request data may be sent through our server to the DeepSeek API. An ordinary page visit does not cause data to be sent to DeepSeek.

DeepSeek is operated by a company established in China. Its published information states that data is processed and stored in the People's Republic of China and may be used to improve and train its technology. The European Commission has not adopted an adequacy decision for China. A level of data protection equivalent to the EU therefore cannot always be guaranteed, particularly concerning access by public authorities and enforceable data-subject rights.

Use such a feature only if you agree to this transfer. Do not enter confidential information, trade secrets, or personal data about yourself or another person. AI output can be inaccurate and is not used for decisions that have legal or similarly significant effects.

Data processed

Your input, required conversation or page context, generated output, and technical API request metadata. DeepSeek normally receives our server connection, not your direct browser connection.

Purpose

Generating the AI response you requested, prevention of abuse, and technical error analysis.

Legal basis

Article 6(1)(a) GDPR. The transfer to China takes place with explicit, informed consent under Article 49(1)(a) GDPR. You may withdraw consent for the future at any time, including by no longer using the feature or by contacting us.

Retention

We store inputs and outputs only where required for the specific feature, security, or error analysis. DeepSeek determines its own retention periods under its terms; we cannot guarantee EU-only storage.

Recipient / provider

Hangzhou DeepSeek Artificial Intelligence Co., Ltd., People's Republic of China.

DeepSeek Privacy PolicyDeepSeek Open Platform Terms

The website does not use a contact form. If you contact us by email, we process the contact details you provide, the content of your message, and technical email metadata.

Data processed

Email address, name and any other details you provide, message content, timestamps, and technical email metadata.

Purpose

Processing and responding to your request and, where applicable, taking steps before entering into or performing a contract.

Legal basis

Article 6(1)(b) GDPR for contract-related enquiries and otherwise Article 6(1)(f) GDPR based on our interest in responding to your message.

Retention

Messages are deleted after the enquiry is complete unless they are required for a business relationship, legal defence, or statutory retention. Depending on their type, business and tax records may be retained for six, eight, or ten years.

Recipient / provider

q-ops GmbH and technical service providers used to operate email.

We disclose personal data only where this is required for the purposes described above, required by law, or based on your consent. Recipients may include hosting, database, authentication, email, and AI service providers, as well as public authorities and legal advisers.

Some providers are established in the United States or use subprocessors outside the European Economic Area. Where required, we rely on an adequacy decision, including the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses and supplementary safeguards. The explicit consent described in the DeepSeek section applies to the optional transfer to DeepSeek in China.

Where no specific period is stated, we keep personal data only for as long as it is required for the relevant purpose. It is then deleted or anonymised unless statutory retention duties, legitimate security needs, or the establishment, exercise, or defence of legal claims require a longer period.

Subject to the statutory requirements, you have the following rights in particular:

• Access to your personal data under Article 15 GDPR
• Rectification of inaccurate data under Article 16 GDPR
• Erasure under Article 17 GDPR
• Restriction of processing under Article 18 GDPR
• Data portability under Article 20 GDPR
• Objection to processing based on legitimate interests under Article 21 GDPR
• Withdrawal of consent at any time for the future under Article 7(3) GDPR

To exercise your rights, email info@sebastiannichtern.com. We may request reasonable evidence of your identity.

You have the right to lodge a complaint with a data protection supervisory authority. The following authority is responsible for q-ops GmbH in particular:

We update this Privacy Policy when features, providers, or legal requirements change. The version published on this page with the date shown above is the applicable version.