Privacy Policy

The controller within the meaning of the GDPR is CalcIng - Müller Engineering Solutions GmbH, Gewerbepark 10a, 36160 Dipperz, represented by the Managing Director Susanne Müller, e-mail info@calcing.de, phone +49 6657 91 40 062.

We have not appointed a data protection officer; according to our current assessment there is no statutory obligation to do so.

When you access saas.calcing.de, technical information is automatically stored temporarily in log files: IP address, date and time, the resource requested, referrer URL, browser/operating system/provider details. Purpose: establishing the connection, system security and stability. The legal basis is Art. 6(1)(f) GDPR. The logs are deleted at the latest after 30 days.

To use the logged-in area you create an account. We process the master and contact data required to perform the contract (e-mail, name, organisation/company details, credentials). You sign in through our own user management directly on saas.calcing.de; your password is stored solely as a cryptographic hash (Argon2id), never in plain text. For the session we set a strictly necessary cookie (HttpOnly, SameSite=Lax) valid for calcing.de services so that you do not have to sign in to each service separately. No external identity provider is involved. The legal basis is Art. 6(1)(b) GDPR (contract or pre-contractual measures).

To provide the engineering apps, we process project metadata, the input data of the calculations and the result artefacts produced (e.g. PDF reports, exports). In public access, calculations are carried out without permanent project assignment; in the logged-in area, projects and results are stored in our self-operated object storage. The legal basis is Art. 6(1)(b) GDPR, where applicable in conjunction with lit. (f) (operation and security).

For paid plans, we process payments via Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. We process billing-relevant data (Stripe customer ID, plan, usage/credit data). You enter payment-method data (e.g. card details) directly with Stripe; we do not store it. The legal basis is Art. 6(1)(b) GDPR (contract) and lit. (c) (retention for tax purposes). Stripe's privacy notice: stripe.com/de/privacy.

AI-based features of the user interface are provided through our separate service ai.calcing.de, which has its own privacy notice. On its own initiative, saas.calcing.de does not transmit any content to AI providers. If you call our apps yourself through an AI platform (section 2.8), we send the answers to those calls to the platform through which you made them.

If you contact us by e-mail, we process your details in order to handle the enquiry. The legal basis is Art. 6(1)(b) or lit. (f) GDPR.

To operate the platform reliably, plan its capacity and find errors, we create a record for every request you make to the server interface of saas.calcing.de while signed in and, without sign-in, for the first calculation you start after opening an app, containing: the time, the area accessed (e.g. the app used, projects, account), the technical result (status code), the processing time, the country the request comes from, whether it was made with an agent key or through a connected AI platform and, if so, through which kind of access (Claude, ChatGPT, another AI platform or a key you created yourself) and — if you are signed in — your user account and the associated organisation; a successful sign-in is marked as such. We do not store your IP address for this: it is only used in memory to determine the country with a country database held on our own server (“IP to Country Lite” by DB-IP, db-ip.com, licence CC BY 4.0) and is discarded afterwards; nothing is transmitted to DB-IP or any other third party in the process. Browser identifier, the full address of the page requested and the content of your input are not stored; the browser identifier is only compared in memory with a list of known search engines and crawlers in order to filter out automated requests. No cookies are set for the statistics and no additional information is stored on or read from your device; the account is taken from your existing sign-in. Without sign-in, we only count the first calculation started per visit of an app, without reference to a person and separately from the requests of signed-in users; further calculations and all other requests without sign-in are neither stored nor counted. Only what your browser sends via our user interface is counted; we recognise this from the information your browser itself attaches to every request (fetch metadata) and from a marker that our user interface adds to this first calculation. The marker contains no information from your device; whether it has already been sent is remembered by the open page only in its working memory. We delete the individual records after 90 days (day by day in a nightly run); beforehand we combine them into daily totals (number of requests, errors and processing time per day, account, organisation, area, country and kind of access), which we retain permanently. As long as your account exists, these daily totals are assigned to your account; when your account is deleted, we remove the reference to account and organisation from all records and daily totals. Only the administrators of the platform can view the statistics; they are not passed on to third parties and no external analytics service is used. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in secure and stable operation, capacity planning and troubleshooting; because neither IP addresses nor browser identifiers are stored, no devices are read and the individual records are deleted after 90 days, your interests do not prevail in our assessment. You may object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR); the records and daily totals stored for your account are part of the information provided under Art. 15 GDPR.

You can use our calculation apps through an AI platform that you yourself connect to your account with us (interface following the “Model Context Protocol”) or through an agent key that you create yourself. In doing so we receive: the inputs of each tool call (e.g. dimensions, loads, materials), the identifier of your account and your organisation from the connection or key, the identifier of the connection and the name of the platform’s program holding it (OAuth client), and the technical data described in section 2.7. The requests come from the platform’s servers; as a rule we do not receive your own IP address for these calls. We compute the result and send it — together with notes and error messages — only back to the platform the call came from; other content of your account (projects, saved analyses) is transmitted only if you have expressly granted permission for it. If the platform also asks for your e-mail address when connecting (the consent page states this expressly) and you allow the connection, we transmit to the platform, when it requests them, your e-mail address, whether you have verified this address with us, and a persistent identifier of your account; the platform can use this, for example, to recognise whether your address belongs to an organisation that restricts the use of the connection in its workspace. The AI platform is your provider under its own terms and privacy notice; it processes your inputs and our answers under its own responsibility, possibly also outside the EU. The legal basis for our processing is Art. 6(1)(b) GDPR (performing the calculation you requested). We keep a connection until you revoke it or it has not been used for 90 days; each individual access grant is valid for 60 minutes. While connecting, we store the pending connection request (name and redirect address of the platform’s program, a state value of the platform, timestamps and the link to your account) for at most 70 minutes; afterwards it is deleted. The one-time code with which the platform completes the connection is valid for 60 seconds. Calls are logged per connection or key (time, app, action, result) in order to charge them to your plan; we keep these records as evidence of your organisation’s billing; if you delete your account, we remove name and e-mail address from the account they refer to. You can revoke a connection or key at any time in your key management or disconnect it in the AI platform; afterwards our interface no longer accepts calls from that connection. If you call an app through an AI platform without signing in, we receive the inputs of the tool call and the technical data described in section 2.7, but no account identifier; all we store about it is the number of calls without sign-in per hour, with no link to any person.

Internally, only those units responsible for fulfilling the contract and our obligations have access. In addition, the following recipients receive data:

• Strato AG – hosting and server operation (processing on our behalf pursuant to Art. 28 GDPR; server location Germany/EU).

• Stripe Payments Europe, Ltd. – payment processing (see 2.4).

Self-operated components (login/SSO, object storage, e-mail dispatch) run on our EU infrastructure and are covered by the hosting data processing agreement. Processing takes place on servers within the EU/EEA; exception: Stripe may use sub-processors in the USA — appropriate safeguards exist for this pursuant to Art. 44 et seq. GDPR (EU Standard Contractual Clauses).

We use exclusively technically necessary cookies or storage mechanisms; pursuant to § 25 (2) TDDDG no consent is required for these (no cookie banner):

• Login session (authentication cookie, HttpOnly/SameSite) — for the login.

• Functional storage in the browser (localStorage): language setting, app-to-app data hand-off, onboarding status.

We do not use tracking or marketing tools or third-party analytics services. Our own usage statistics (section 2.7) run on our server, without cookies and without access to your device.

We store data only for as long as is necessary for the respective purpose. We retain billing and invoice records in accordance with the statutory retention periods (regularly up to ten years, §§ 147 AO, 257 HGB). We store account and project data until you delete the account or the project, subject to statutory retention obligations. Server logs (section 2.1): 30 days at the latest. Usage statistics (section 2.7): individual records 90 days; daily totals permanently, without reference to account and organisation once the account has been deleted.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw consent given, with effect for the future. To do so, please contact the address stated above or info@calcing.de.

You also have the right to lodge a complaint with a supervisory authority. The competent authority is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Wilhelmstraße 7, 65185 Wiesbaden, phone +49 611 1408-0, poststelle@datenschutz.hessen.de.

We take appropriate technical and organisational measures to protect your data. Transmission is encrypted (TLS/SSL); access to stored data is secured by authorisation and access controls.