What this site knows about you.

Konstantin Gerner
Hollergasse 30/11
1150 Vienna, Austria
konstantin@kgerner.com

Full operator details are on the imprint. Processing follows the EU General Data Protection Regulation (GDPR / DSGVO).

Reading ai4bcm.org sets no cookie and stores nothing in your browser. There is no analytics of any kind — no page-view counter, no beacon, no tag manager, no session recording, no advertising pixel. We cannot tell one reader from another.

Every part of a page comes from our own server. The typefaces are served from ai4bcm.org rather than from a font service, and there are no embedded videos, maps, widgets, comment systems or social buttons. No third party learns that you visited unless you click an outbound link — and then only the site you clicked through to.

Server logs

The web server writes an access log, as web servers do. Each line holds the IP address the request came from, the time, the page requested, the HTTP status, the number of bytes sent, the referring page if your browser sent one, and the browser's user-agent string. It is used to keep the site working and to see abuse — nothing else. It is not analysed for behaviour, not combined with anything, and not shared.

The logs are rotated daily and kept for 14 days, then deleted. Legal basis: our legitimate interest in operating and securing the site, Art. 6(1)(f) GDPR.

What is sent

The text you type, and nothing else. No name, no email address, no identifier, no cookie, and no record of anything you asked before — each question stands alone and the box has no memory between questions. Do not type anything confidential into it. It is a public box on a public website; treat it exactly as you would treat a public chatbot, which is a thing AI4BCM Guidance itself has a good deal to say about.

Where it goes

1. Your browser posts the question to agent.ai4bcm.org, a server run by the same operator, in Helsinki, Finland.
2. That server searches AI4BCM Guidance for the passages most likely to answer it. This part happens entirely on our own machine.
3. Your question, together with those passages, is passed through our own LiteLLM gateway — also on our machine — to OpenRouter, which routes it to the DeepSeek V4.1 Flash model that writes the answer.
4. The answer comes back and is shown to you. We do not store it.

OpenRouter and the model provider it routes to are outside the EU, so your question is transferred outside the EU when you use the box. Our request to OpenRouter is marked zero-retention, meaning it should be routed only to providers that do not retain the content of the request. That is an instruction we give a broker, not something we can audit from our side, and we would rather say so than imply a guarantee we cannot see.

What we keep

We do not store your questions or the answers, and we build no history, profile or transcript. What remains is the ordinary access log line described above, on agent.ai4bcm.org as on the site: your IP address and the fact that a request was made, kept for 14 days. The content of your question is not in that log.

Your IP address is also used, in memory and for a few seconds at a time, to rate-limit the box so that one visitor cannot exhaust it for everybody. Legal basis for answering the question: Art. 6(1)(b) GDPR — you asked, and sending the question is how it gets answered. Legal basis for the log and the rate limit: Art. 6(1)(f) GDPR.

The PDF, the Markdown bundle and the playbook are ordinary files on this server. Downloading one asks for nothing, registers nothing and appears only in the access log, like any other page. If you follow a link to the repository on GitHub, you are on GitHub's site under GitHub's privacy terms.

ai4bcm.org has no signup form and collects no email address. If you write to the address above, we hold that message and your address for as long as it takes to deal with what you wrote and to keep a record of the exchange, and we use it for nothing else. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in answering people who contact us.

If a subscription is ever offered here, it will be a separate, explicitly consented step with a confirmation email, and this page will say so before the first address is collected — not after.

Under the GDPR you may request access to your personal data, its correction, its deletion, a restriction on its processing, its transfer to you or another controller, and you may object to processing based on legitimate interest. Write to konstantin@kgerner.com.

In practice there is very little to ask for. We hold no account, no profile and no list — the only personal data this site produces is a log line containing an IP address, which we cannot connect to you as a person and which is gone within 14 days. Telling us your IP address so we can look for it would give us more information about you than we had before, which is usually not what anyone wants.

You can also complain to a supervisory authority — in Austria, the Datenschutzbehörde — or to the authority where you live or work.

• Hetzner Online GmbH (Germany) — the servers hosting this site and the question endpoint, located in Helsinki, Finland. They provide the machines; the data on them is ours.
• OpenRouter — routes a question from the box to a model. Only when you use the box. Outside the EU.
• The model provider that OpenRouter routes to, which runs DeepSeek V4.1 Flash. Only when you use the box. Outside the EU.

That is the complete list. No analytics provider, no CDN, no font service, no tag manager, no advertising network and no mailing-list platform is involved in serving this site.

If what we do with data changes, this page changes with it and the date at the top moves. Two changes are already expected: the question box beginning to answer, and — later, and only with an explicit consent step — a mailing list.