Information pursuant to Art. 13 and 14 GDPR on all processing operations on this website — hosting, contact/trial form, spam protection and external fonts. We do not use any tracking, analytics or advertising tools.
Marie-Curie-Straße 19, DE-73529 Schwäbisch Gmünd, Germany
Phone: +49 7171 / 187 – 0 · Fax: +49 7171 / 187 – 250
E-Mail: legal@scaience.ai
Managing Directors: Herbert Grau, Christopher Kallhoff · HRB 752206, Local Court of Ulm
Please send privacy enquiries and requests to exercise your rights to the e-mail address above. Full company details are available in the legal notice.
When you access this website, our host and the upstream CDN automatically process technical access data: IP address, date and time, requested URL, transferred data volume, referrer, browser type and operating system.
Purpose: technical delivery, stability and security of the website.
Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in secure and uninterrupted operation); the technically necessary access to your device is exempt from consent under § 25 (2) no. 2 TDDDG.
Retention: log data is generally deleted or truncated after 30 days at the latest.
Through the form we process: name, organisation, role (optional), e-mail address and your message or research question. To prevent abuse we also store a cryptographic hash of your IP address and the submission timestamp (rate limit: max. 3 requests per IP within 10 minutes).
Purpose: handling your enquiry, providing trial access and pre-contractual communication.
Legal basis: Art. 6 (1)(b) GDPR (pre-contractual measures) and Art. 6 (1)(f) GDPR (legitimate interest in answering general enquiries and in defending against spam and automated attacks).
Recipients: our hosting and database providers acting as processors (see section 6).
Retention: until your enquiry has been fully handled, then deleted unless commercial or tax retention obligations (6 or 10 years) apply. Rate-limit records are deleted after 24 hours.
Obligation to provide data: providing the data is voluntary; without a name and e-mail address we cannot answer your enquiry.
To protect the form against automated submissions we use Cloudflare Turnstile. This transmits your IP address, browser and device information and interaction signals to Cloudflare and sets cookies (including __cf_bm, cf_clearance). Turnstile does not create user profiles and is not used for advertising.
Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in IT security and spam prevention); access to device information is strictly necessary and therefore exempt from consent under § 25 (2) no. 2 TDDDG, because the requested service (form submission) cannot be provided without it.
Third-country transfer: USA, safeguarded by EU standard contractual clauses and the EU-US Data Privacy Framework.
We do not use any web tracking, analytics software (e.g. Google Analytics, Matomo), advertising or social media pixels and no profiling. The only entries stored are:
• bma-cookie-consent-v1 (local storage) — stores your cookie choice; strictly necessary, § 25 (2) no. 2 TDDDG.
• Cloudflare Turnstile cookies — see section 4; strictly necessary, § 25 (2) no. 2 TDDDG.
• Google Fonts (Poppins, IBM Plex Mono) — loaded from Google servers only after your explicit consent; your IP address is transmitted to Google. Legal basis: § 25 (1) TDDDG in conjunction with Art. 6 (1)(a) GDPR and Art. 49 (1)(a) GDPR for the transfer to the USA. Without consent we use system fonts.
Consent proof (Art. 7 (1) GDPR): every consent, change and withdrawal is additionally logged server-side in our database (table consent_logs, EU hosting via Lovable Cloud/Supabase). Stored data: a pseudonymous consent ID, the action (granted/updated/withdrawn), the source (banner or settings), the selected categories, the policy version, a timestamp as well as a hashed IP address and a hashed user agent. No plain-text IP address is stored. Legal basis: Art. 6 (1)(c) in conjunction with Art. 7 (1) GDPR (obligation to demonstrate consent). Retention: 3 years from the end of the year of the consent or withdrawal.
Your consent is voluntary and can be withdrawn at any time with effect for the future:
Details are available in our cookie policy.
We have concluded a data processing agreement under Art. 28 GDPR with every provider listed below that processes personal data on our behalf. Transfers to third countries are based on EU standard contractual clauses (Art. 46 (2)(c) GDPR) together with additional safeguards.
CRM and newsletter tools: we currently do not operate a newsletter and do not use any external CRM or e-mail marketing system. Form enquiries are stored exclusively in the database mentioned above and handled internally. Should such a service be introduced, we will update this policy including the DPA and legal basis before processing begins.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6 (1)(f) GDPR (Art. 21). Consent given can be withdrawn at any time with effect for the future (Art. 7 (3) GDPR).
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
Data is transmitted TLS-encrypted (HTTPS). Automated decision-making including profiling pursuant to Art. 22 GDPR does not take place. This privacy policy is updated whenever processing operations or services change.
Last updated: August 2026
This English version is provided for convenience; in case of discrepancies the German version prevails.