Legal notice and terms
Legal notice
Draft: A lawyer hasn't checked this text yet.
- Company
- Data Driven Solutions e.U. (registered sole proprietorship), owner: Alexander Dür
- Address
- Küniglberggasse 10, 1130 Vienna, Austria
- office
@alexduer.com - Another way to reach us
- [Open: a second way to reach us]
- Business activity and trade
- Services in automatic data processing and information technology (Dienstleistungen in der automatischen Datenverarbeitung und Informationstechnik, freies Gewerbe)
- Company register
- FN 491229x, Commercial Court of Vienna (Handelsgericht Wien), registered office Vienna
- VAT ID
- ATU73322969
- Chamber
- Member of the Vienna Economic Chamber (Wirtschaftskammer Wien), Fachgruppe UBIT
- Trade authority
- Magistratisches Bezirksamt für den 13. und 14. Bezirk, Vienna
- Professional regulations
- Austrian Trade Regulation Act (Gewerbeordnung), available at www.ris.bka.gv.at
ZackPages is a service of Data Driven Solutions e.U.
Terms of use
Draft: A lawyer hasn't checked this text yet.
What this is about
ZackPages is a service of Data Driven Solutions e.U. ("we"). You ask Claude to build a small website, and Claude puts it online through ZackPages. These terms apply to these web pages, to the connector in Claude, and to the websites that you publish with them.
If your websites process personal data other than in the course of a purely personal or household activity, the data processing agreement below is part of these terms.
Access and agreement
ZackPages can only be used by invitation. An admin invites you by email. When you accept the invitation, you create your account and accept these terms. Until then nothing happens, and you can simply leave the page.
These terms exist in German and in English, and the German text applies. We don't store which version you accepted. The version in force is on this page.
An account belongs to one person. You sign in with a link that we send you by email, or with your Google account where we offer it. Anyone who can read your mailbox can sign in as you, so keep it safe.
The service
Claude builds and changes your websites through the connector. Each change makes a new version, and you can restore an earlier version.
Each website has its own address on ZackPages. You can connect a domain of your own only if you manage its DNS.
An account can have at most 10 websites that aren't deleted.
Your content
You are responsible for the content of your websites. Publish only content that you may publish and that breaks no law. In particular, these are not allowed:
- malware;
- pages that pretend to be someone else to collect passwords or card or bank details;
- content that infringes other people's rights, such as copyright or personal rights.
You allow us to store, process and serve your content as far as the service needs it. That includes storing images again and removing their metadata.
Domains
If another person proves that they manage the DNS of a domain, by setting the TXT record that ZackPages gives them, the domain moves to their website. We then send you an email.
Reports and suspension
An admin reviews every report in person. We use no automatic moderation. If a website breaks the law or these terms, an admin can suspend it. An admin can also remove a domain whose DNS its user doesn't manage.
You get the reason for a suspension by email. To appeal, write to the support address: support
Deleting
You can delete a website at any time. It goes offline at once. Within 30 days, an admin can bring it back. After that, we remove it as the privacy policy describes.
You can delete your account at any time. Your websites go offline at once, and this cannot be undone. We keep your email address, so that nobody can sign in with it again or get a new invitation for it.
Availability and liability
ZackPages is a preview for a few invited people. We try to keep it working, but we don't promise any particular availability.
We are liable without limit for intent, for gross negligence and for personal injury. Otherwise our liability is excluded as far as the law allows. The mandatory rights of consumers are not affected.
Changes and ending
If we change these terms, we tell you by email at least one month beforehand. If you don't object by then, the new terms apply; the email says so. If you object, you can delete your account.
If we end the service or your account, we tell you by email with reasonable notice, so that you can save your content through Claude.
Law and courts
Austrian law applies. For disputes with businesses, the competent court in Vienna has jurisdiction. Consumers keep the courts and the protection that the law of their country of residence gives them.
Privacy policy
Draft: A lawyer hasn't checked this text yet.
Controller
Data Driven Solutions e.U., Alexander Dür, Küniglberggasse 10, 1130 Vienna, Austria, office
What this is about
This policy describes which data ZackPages processes about invited people and about visitors of these web pages. You are responsible for the data in your own websites and about their visitors. The data processing agreement below covers that.
Your account
We store your email address, your language, when your account was created, when Claude first used the connector and, if you delete the account, when you deleted it. We need these data to provide the service (Art. 6(1)(b) GDPR). Without an email address we cannot create an account.
Invitations
An admin enters your email address and the language of the invitation. We store both with the inviting admin's address and the state of the invitation. The invitation names the admin's address. We record the invitation, sending it again and withdrawing it, with your address, in the admins' log (see there). The legal basis is our legitimate interest in reaching invited people (Art. 6(1)(f) GDPR). How long we keep invitations: [Open: how long invitations are kept]
Signing in
To sign you in, we email you a link. It works for 15 minutes and only once. We store only a hash of the link, not the link itself. The legal basis is our agreement with you (Art. 6(1)(b) GDPR).
If we offer sign-in with Google and you use it, Google learns of the sign-in. We then receive your email address and whether Google has verified it. Google acts as a controller of its own. With Google you can only sign in to an account that already exists; only for an admin's address does the first sign-in create an account. Any other address creates no account.
Every day we delete expired sessions, sign-in codes, requests and codes of the connection to Claude, its keys, and proofs for domains. We keep a used code until its connection is revoked, so that we notice it being used a second time.
Cookies and browser storage
These web pages use only these cookies and this storage:
- __Host-session keeps you signed in, for 30 days.
- __Host-oauth-browser ties your consent for Claude to this browser, for one hour.
- __Host-sign-in-browser ties a sign-in code to the browser that asked for it, for 15 minutes.
- __Host-google-sign-in lasts while you sign in with Google, for ten minutes.
- The upload page keeps its link in the browser tab's storage (sessionStorage) until the upload ends. The sign-in page keeps there the email address it sent a code to, for 15 minutes.
All of this is strictly necessary for the service, so it needs no consent (§ 165(3) of the Austrian Telecommunications Act, TKG 2021). We process the data in it for our agreement with you (Art. 6(1)(b) GDPR). We use no analytics and no advertising, and these web pages load nothing from other providers, not even fonts.
Claude
You connect Claude, by Anthropic, to ZackPages as a connector. We store this connection: which app, when it was connected, when it was last used, and whether it is revoked.
Claude sends us, on your behalf, what you ask Claude to do: names, files, texts, images, addresses to import and domains. We answer Claude with the data of your websites that Claude needs for that. What Anthropic does with your conversations is governed by your own agreement with Anthropic. The legal basis is our agreement with you (Art. 6(1)(b) GDPR).
We store the keys for Claude only as hashes. An access key lasts one hour, a refresh key 60 days. If you revoke the connection on your account page, the access ends at once.
Your websites
We store the files, versions and version messages of your websites, for our agreement with you (Art. 6(1)(b) GDPR). A published website is public. Anyone who knows the link of a preview can see it.
We shrink images wider than 1920 pixels. We store JPEG, PNG, GIF, WebP and AVIF images again and remove all their metadata in doing so, including the place where a photo was taken. An animated PNG keeps its frames and loses only its text, EXIF and time data. If it is wider than 1920 pixels, we don't accept it. We store ICO files (icons) and SVG files unchanged.
A website stays stored until you delete it. After that it stays for 30 days, so that an admin can bring it back, and is then removed. Files that no version uses any more are removed by a weekly cleanup after 7 days at the earliest. Uploaded files, or files that Claude fetched, that no version uses are deleted after 7 days. An upload link works for 72 hours. Deleted data stays in the backups for up to 30 more days.
Domains and certificates
If you connect a domain, we store it, its DNS records from the last check, and its state, for our agreement with you (Art. 6(1)(b) GDPR). If you remove the domain, we delete them at once. DNS records are public. We read them through the DNS service of Cloudflare.
Cloudflare for SaaS issues the certificate for your domain with www, or for the subdomain that you connect. For the domain without www and for these web pages, our web server gets certificates from Let's Encrypt, or from ZeroSSL as a fallback. Every certificate is listed, with the name of the domain, in public logs (Certificate Transparency).
Emails
ZackPages sends only these emails by itself: the invitation, the sign-in code, the notice of a new sign-in, which names the browser from its user agent, the welcome, the domain is live, the domain needs attention, the domain moved, and the website is suspended. We write notices of changes and answers to you one by one. We send no newsletters. The legal basis is our agreement with you (Art. 6(1)(b) GDPR), and for the invitation our legitimate interest (see Invitations). The emails go through Amazon Web Services (Amazon SES) in the Frankfurt region (eu-central-1). Contracting party: [Open: the contracting party at Amazon Web Services]
Support
If you write to the support address support
Forwarding to Gmail: [Open: whether messages go on from there to a Google (Gmail) mailbox]
Server and logs
ZackPages runs on a server of Hetzner Online GmbH in Nuremberg, Germany. Our web server's access log records, for each request, your IP address, the method, the host, the path, the status, the time and an identifier of the request, with no query parameters and no headers. Its other log records errors with their request, also with no query parameters and no headers, and names the domains it gets certificates for. Our server's log also names domains, identifiers of websites and refused apps when errors happen. We use the logs to find errors and attacks (Art. 6(1)(f) GDPR). How long we keep logs: [Open: how long the logs are kept]
Limits on requests
To slow down abuse, we count requests. By IP address we count in windows of 15 minutes. For that, we shorten an IPv6 address to its /56 and its /48 network. Requests for a sign-in code are also counted by email address, in memory in windows of 15 minutes, and in the database for up to two days. Failed checks of a sign-in code are kept in the database for up to two days too. In the database we keep only SHA-256 hashes of the typed address and of the sign-in cookie of the browser, not the address. Requests from Claude are counted per connection in windows of 10 minutes, and calls for domains per account in windows of 5 minutes. The counters in memory vanish on a restart. The legal basis is our legitimate interest in protecting the service and its users from abuse (Art. 6(1)(f) GDPR).
Backups
Every hour we back up the database, encrypted, to a Cloudflare R2 store in the EU. Each backup is locked against deletion for 14 days and deleted after 30 days. Deleted data therefore stays in backups for up to 30 days. The legal basis is our legitimate interest in restoring the data after a failure (Art. 6(1)(f) GDPR).
The admins' log
We record every action of an admin, such as an invitation or a suspension, with the admin's address, the time, the target and the reason. When an admin removes a domain, we also record the domain's name. When a domain moves by a DNS proof, or someone takes a domain back from a suspended website of their own, we record the person who did it, the domain's name, and the websites it moved from and to. The legal basis is our legitimate interest in keeping such actions traceable (Art. 6(1)(f) GDPR). How long we keep this log: [Open: how long the admins' log is kept]
When you delete your account
Your websites go offline at once, we delete your sessions and sign-in codes, and we revoke your connections to Claude. We keep your email address, so that nobody can sign in with it again or get a new invitation for it. The legal basis for that is our legitimate interest (Art. 6(1)(f) GDPR). For how long: [Open: how long a deleted account's address is kept]
How long we keep revoked connections: [Open: how long revoked connections are kept]
Recipients
- Hetzner Online GmbH, Germany: the server and the database.
- Cloudflare, Inc., USA: serving the websites, storage for their files (R2) and for looking up addresses (KV), certificates for domains of your own, DNS lookups, and the backups.
- Amazon Web Services: the emails.
- mailbox.org (Heinlein Hosting GmbH, Berlin, Germany): messages to support.
- Let's Encrypt and ZeroSSL: certificates, see above.
- Google: only if you sign in with Google.
- Anthropic: only because you connect Claude, under your own agreement with Anthropic.
Data processing agreements: [Open: the data processing agreements with these providers]
Transfers outside the EU, and copies around the world
Cloudflare and Google are certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission. For Amazon Web Services: [Open: the basis of a transfer by Amazon Web Services]
For the certificates: [Open: the basis of the transfers to Let's Encrypt (ISRG, USA) and to ZeroSSL, and ZeroSSL's country]
Cloudflare R2 stores the files of your websites with a location hint for Western Europe. That is a hint, not a promise. Cloudflare keeps the store for looking up addresses (KV) around the world. Cloudflare keeps served files in caches around the world for up to a year, and we don't empty them.
Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR). To use them, write to office
Objection
Where we process data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).
Complaints
You can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
Data processing agreement
Draft: A lawyer hasn't checked this text yet.
Parties and subject
This agreement applies between you as the controller and Data Driven Solutions e.U. as the processor (Art. 28 GDPR). It is part of the terms of use when your websites process personal data other than in the course of a purely personal or household activity. It covers personal data in the content of your websites, and data about their visitors, which we process when we store and serve your websites.
Nature and purpose, instructions
We store files and versions, shrink large images and remove metadata, serve websites and connect domains. We process the data only on your documented instructions: what you start through Claude or through these web pages, and what these terms provide, such as backups, the suspension of a website and the lifting of a suspension, an admin bringing back a deleted website, the removal of a domain by an admin, and the move of a domain to another website after a DNS proof. These instructions also cover the transfers to third countries that the privacy policy names. If we think an instruction breaks the GDPR, we tell you without delay.
Data and data subjects
You decide which data your websites hold, such as the names, photos and contact details of people you show. On each visit, Cloudflare processes technical data of the visitors, such as the IP address, to serve the page. When someone opens your domain without www, our web server redirects the request to the domain with www and sees the same data.
Duration
The agreement applies as long as your account exists. After that, the periods of the privacy policy apply: deleted websites stay for 30 days, files without a version are removed after 7 days at the earliest, and backups are deleted after 30 days.
Confidentiality
Access to the data: [Open: who has access to the data]. Whoever has access is bound to confidentiality (§ 6 of the Austrian Data Protection Act, DSG).
Technical and organisational measures
- These web pages can be reached over HTTPS only, with HSTS. Websites redirect from http to https.
- Of the containers, only the web server, Caddy, publishes ports: 80 and 443, and 443 over UDP too.
- The containers of the API server, of Next and of the backups run read-only, without capabilities and without new privileges.
- The server's firewall (ufw) and a Hetzner Cloud Firewall let through only TCP 22, 80 and 443, UDP 443 and ICMP.
- SSH accepts keys only, with at most three tries (MaxAuthTries 3).
- We store randomly generated keys, such as those of sessions, sign-in codes, invitations and the connection to Claude, only as SHA-256 hashes. The exceptions are the keys of preview addresses, which the serving Worker must compare, and the values of domain proofs, which are in DNS anyway.
- The sign-in cookie is Secure, HttpOnly and SameSite=Lax.
- The keys for KV and for the certificates of custom domains work only from the server's addresses. R2 may ignore such a limit.
- Secrets are kept only in files with mode 600.
- Backups are encrypted with age to two recipients, one of them kept offline, and locked against deletion for 14 days.
- The admins' actions are kept in a log that our code never changes or deletes.
- JPEG, PNG, GIF, WebP and AVIF images lose their metadata when they are stored. An animated PNG loses only its text, EXIF and time data. ICO files (icons) and SVG files stay unchanged.
Subprocessors
- Hetzner Online GmbH, Germany: the server and the database.
- Cloudflare, Inc., USA: storing and serving the websites.
You agree to them in general. We tell you about a new subprocessor by email beforehand, and you can object. We pass the same duties on to them as we have, and we are liable to you for them. Amazon Web Services only sends the emails to your account and processes none of your websites' content. Agreements: [Open: the data processing agreements with these providers]
Assistance, notices and audits
We help you with requests from data subjects, with the security of processing, with data protection impact assessments and with prior consultation (Art. 32–36 GDPR). We tell you about a breach of the security of your data without undue delay. We give you all the information you need to show compliance, and allow audits. An audit starts with written questions, which we answer.
Deletion and return
You can read and save your files through Claude at any time. That is their return. If you delete a website or your account, we delete the data and its copies within the periods above, unless a law requires us to keep them. Served files can stay in Cloudflare's caches for up to a year.
Report abuse
Draft: A lawyer hasn't checked this text yet.
To report a website that breaks the law or these terms, write in German or English to: support
Name the address of the page and why it breaks the law or these terms. Also give your name and email address, and confirm that your report is accurate to the best of your knowledge. We confirm that we received it, and tell you our decision. The same address is the point of contact for authorities and for users, in German or English.