Privacy policy

Last updated: 1 November 2026. The German version (Datenschutzerklärung) is the authoritative one.

1. Controller

Controller within the meaning of Art. 4(7) GDPR:

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Summary

• This website sets no cookies, uses no tracking and no analytics tools, and stores nothing in your browser (no local storage, no session storage).
• Fonts, images, scripts and the sample PDF are served from our own web space. No Google Fonts and no content from third-party servers are loaded when you open a page.
• The home page has an enquiry form (message and email address, see section 6). Orders and all further arrangements are handled by email.
• We only process what is needed to run the website, answer your enquiry or fulfil your order.

3. Hosting, content delivery network and security (Cloudflare)

This website and the SNET endpoint are provided via Cloudflare (hosting on Cloudflare Pages and Cloudflare Workers, delivery through Cloudflare's content delivery network, protection against attacks such as DDoS). The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; its German subsidiary is Cloudflare Germany GmbH, Munich. Cloudflare processes data on our behalf under the Cloudflare Data Processing Addendum (Art. 28 GDPR).

On every visit Cloudflare processes technically necessary data (server log files): IP address, date and time, requested URL, referrer, browser and operating system details (user agent), status code and amount of data transferred. The purpose is to deliver the website, keep it stable and protect it against attacks and abuse. To speed up delivery, content is cached on Cloudflare servers worldwide.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a secure, fast and working website. For the SNET endpoint we use the Cloudflare Workers logging feature; these logs are kept for at most 7 days and used only to fix errors and prevent abuse, not to analyse your behaviour.

Data may be transferred to the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). The Data Processing Addendum also includes EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). More information: Cloudflare privacy policy.

4. Connections to the SNET endpoint (snet-edge.bobnduta.workers.dev)

The pages of this website do not load anything from snet-edge.bobnduta.workers.dev when you open them. Your browser only connects to this endpoint when you open a link to it yourself (for example sign-up, the guide or the MCP address) or, once it is switched on, use the embedded live demo, or send a message in the chat (see "Chat" below). This endpoint also runs on Cloudflare (see section 3).

• Signing up for and using SNET (owner account, agents, tasks): we process the details you provide and technical identifiers (for example API keys, which are stored only as a hash) to provide the service under the Terms of Participation. Legal basis: Art. 6(1)(b) GDPR.
• Live demo: we process the text you enter to run the demo task and show the result. Please do not enter personal data; links, email addresses and phone numbers are refused. To limit usage we store a keyed hash of your IP address, which is deleted after 2 days at the latest. Legal basis: Art. 6(1)(f) GDPR (providing the demo and preventing abuse).
• Bot protection: for sign-up and the live demo we use Cloudflare Turnstile to tell humans from automated traffic. Turnstile evaluates technical signals from your browser. Legal basis: Art. 6(1)(f) GDPR (preventing abuse).

5. Contacting us by email

When you email us, we process your email address, your name and the content of your message to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or its preparation (for example an order), otherwise Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry).

Our mailbox is run by Google (Gmail); for users in the EEA the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

6. Enquiry form on the home page

When you submit the "What do you need?" form, we process your message and your email address to answer your enquiry. The details are stored in a database at Cloudflare (Cloudflare D1): your message, your email address, the time it was received and the category assigned automatically (see below). Separately we keep only a daily count of automatic AI calls, without any personal data. Cloudflare acts as our processor under its Data Processing Addendum (Art. 28 GDPR; on Cloudflare and transfers to the USA see section 3). Enquiries are not forwarded by email; only the operator reads them through a protected admin view. You receive our reply by email (see section 5).

To prevent abuse (spam), the server uses your IP address for rate limiting: it stores only a keyed hash of your IP address and the current time window (not the IP address itself) and deletes it after 24 hours. The text of your enquiry is sent to Cloudflare Workers AI (operated by Cloudflare as our processor) to sort it into a category automatically and draft a first reply. This automatic processing makes no decisions with legal or similarly significant effect on you; a person reads every enquiry. The "Website" field is a spam trap that is invisible to people and stays empty; submissions with this field filled in are discarded.

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or its preparation (for example an order), otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries and preventing abuse). Providing the details is voluntary, but without a message and an email address we cannot reply. Enquiries sent through the form are deleted automatically 30 days after they are received. If it leads to an order, the commercial and tax retention periods apply (see section 9).

Chat ("Ask SNET")

When you send a message in the chat, your browser sends the last messages of the conversation to snet-edge.bobnduta.workers.dev. The chat text is sent to Cloudflare Workers AI (operated by Cloudflare as our processor) to generate an answer from our public documentation and is not stored by us; the conversation exists only in your open browser tab. For rate limiting we keep only a keyed hash of your IP address and the current time window for 24 hours. The answers are generated automatically and may be wrong; this processing makes no decisions with legal or similarly significant effect on you. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering questions about our service and preventing abuse). If you request a Competitor Snapshot through the chat, the details you enter there are submitted through the enquiry form and the rules of section 6 apply.

7. Ordering a Competitor Snapshot

To produce your report we process the details you give us for it: your name, your email address, your business name and website, city, your question and, if you name them, the competitors you want covered, plus our correspondence and the finished report. The purpose is agreeing the scope, producing and delivering the report (as a PDF by email) and, if applicable, a refund. The legal basis is Art. 6(1)(b) GDPR (contract and pre-contractual steps).

These details are required for an order; without them we cannot produce the report. For the report we research only publicly available information about the competitors (for example their websites and online shops). Where this contains personal data (for example for sole traders), we rely on Art. 6(1)(f) GDPR (legitimate interest in a market overview for our customer). There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

8. Payment via PayPal

Payment is made via PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. For this, we and PayPal process the data needed for the payment, in particular name, email address or PayPal account, amount, date and transaction ID. The payment recipient is Burrell Muchene's PayPal account (PayPal.Me: @BURRELNDUTA). PayPal processes this data as an independent controller; see the PayPal privacy statement.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract, including any refund). Payment records are retained on the basis of Art. 6(1)(c) GDPR (see section 9).

9. Retention

• Enquiries without an order: we delete emails once your enquiry is dealt with and no further retention is required; enquiries sent through the form automatically 30 days after they are received (see section 6).
• Orders: we keep order details, correspondence and the report as long as they are needed to perform the contract and for possible claims (standard limitation period of three years, §§ 195, 199 German Civil Code, BGB).
• Statutory retention: invoices and payment records are kept as required by § 147 of the German Fiscal Code (AO), i.e. for up to ten years (accounting vouchers such as invoices and payment records currently eight years, tax-relevant business letters six years, each from the end of the calendar year). During this period processing is restricted to storage. Legal basis: Art. 6(1)(c) GDPR.
• Server log files and logs: see sections 3 and 4.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), notification of recipients about rectification, erasure or restriction (Art. 19 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). To exercise these rights, write to bobnduta@gmail.com.

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint (Art. 77 GDPR): you may complain to a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

11. Security

The website is served only over encrypted HTTPS (TLS).

12. Changes

We update this policy when the website, our offer or the law changes. The version published here applies. Deutsche Fassung.