What this site knows about you
In short: very little. No trackers, no ad networks, no analytics cookies, no fonts from third-party servers. Below in detail: which data is processed, on what legal basis, and for how long.
01 — ControllerWho decides about the processing
Controller within the meaning of Art. 4(7) GDPR and the Spanish data protection act LOPDGDD (Ley Orgánica 3/2018):
- Name
- Michael Wennesheimer
- Address
- Residencial Marina d'Or II, Calle de les Roquisses s/n
07660 Cala d'Or, Santanyí, Illes Balears, Spain - michael@wennesheimer.net
- Phone
- +34 621 18 50 71
No data protection officer has been appointed, as the conditions of Art. 37 GDPR / Art. 34 LOPDGDD are not met. For all data protection matters, please write directly to the email address above.
02 — OverviewWhat this site deliberately doesn't do
- No cookies are set for analytics, marketing or profiling purposes.
- No tracking or statistics services are embedded — no Google Analytics, no Meta pixel, no Hotjar, no consent management service.
- Fonts and scripts are served exclusively from our own server. There is no connection to Google Fonts or any other content delivery network.
- There is no automated decision-making with legal effect and no profiling within the meaning of Art. 22 GDPR.
- Your data is not sold and not passed to third parties for advertising purposes.
A cookie banner is therefore unnecessary: only technically required storage is used, which is permitted without consent under § 25(2)(2) TDDDG and Art. 22.2 LSSI-CE.
03 — HostingServer log files
This website runs on a server operated by Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany. The server is located in Nuremberg, Germany — that is, within the European Union. A data processing agreement under Art. 28 GDPR is in place with Hetzner.
On every request, the web server automatically stores access data in log files:
- IP address of the requesting device
- Date and time of access
- Page or file requested and volume of data transferred
- HTTP status code and protocol used
- Browser type, browser version and operating system (user agent)
- Where applicable, the previously visited page (referrer)
Legal basis and purpose
Art. 6(1)(f) GDPR. The legitimate interest lies in technically faultless operation, in delivering the website, and in defending against attacks. This data is not combined with other sources and is not evaluated for marketing purposes.
Retention period
Log files are deleted automatically after 14 days at the latest, unless they are needed longer to investigate a specific security incident.
04 — FontsServed locally, no third-party connection
This website uses the typefaces Geist, Geist Mono and Instrument Serif. All font files are stored on our own server and loaded from there. When the page loads, no connection is made to servers operated by Google or any other provider; your IP address is consequently not transmitted there.
05 — Local storageA single technical entry
If you use the AI assistant, a randomly generated identifier for the current conversation is stored in your browser's sessionStorage (key mw_conv). Its sole purpose is to link your follow-up questions to the conversation already under way, so that the assistant knows the thread.
This entry contains no personal data, is deleted automatically when the browser tab is closed, and serves no recognition across sessions. Legal basis: § 25(2)(2) TDDDG (technically necessary) in conjunction with Art. 6(1)(f) GDPR. If you don't open the chat, nothing is stored.
06 — AI assistantWhat happens in the chat
This website embeds a text-based assistant that answers questions about Michael Wennesheimer and about general topics around digital assets. Use is voluntary; without your input, nothing is processed.
Which data is processed
- Your message and the assistant's answer — verbatim, in order to answer and to improve quality.
- A timestamp for the conversation, plus the page from which the chat was opened.
- The browser identifier (user agent) for error analysis.
- A cryptographic hash of your IP address. The IP address itself is not stored. The shortened hash serves solely to limit abuse (a maximum of 40 requests per hour) and does not by itself allow the IP address to be reconstructed.
- Optionally your rating of an answer (helpful / not helpful), if you give one.
Don't enter passwords, seed phrases or private keys, ID, account or card numbers, or health data in the chat window. A reputable provider — and this assistant too — will never ask you for such details.
Recipients and transfer to third countries
To generate the answers, the content of your message is transmitted to Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA, whose language model generates the answer text. Anthropic processes the content as a processor within the meaning of Art. 28 GDPR on the basis of its applicable terms for commercial API use; the transfer to the USA is safeguarded by the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR. According to the provider, content submitted via the API is not used to train its models.
Despite these safeguards, it cannot be entirely ruled out that US authorities may access data within their statutory powers, and that you would not have the same legal remedies against this as within the EU. A residual risk of transfer to a third country therefore remains. Using the chat is entirely voluntary — you can settle any matter by email or phone instead.
Legal basis
Art. 6(1)(b) GDPR (pre-contractual steps at your request) and Art. 6(1)(f) GDPR (legitimate interest in a functioning information service and in preventing abuse).
Retention period
Chat histories are stored for a maximum of twelve months and then deleted. At your request we will delete a conversation earlier at any time — just tell us roughly when it took place and what it was about, so it can be identified.
07 — CalculatorRuns entirely in your browser
The calculator embedded on the home page performs its calculations exclusively locally in your browser. Your inputs — amounts, timeframes, return assumptions — are never transmitted to the server, not stored and not evaluated. They do not leave your device.
08 — Getting in touchEmail, phone, messenger
If you get in touch by email, phone or messenger, your details — name, contact data and the content of your message — are stored in order to deal with your enquiry and in case of follow-up questions.
The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at a conversation or a working relationship, and otherwise Art. 6(1)(f) GDPR (legitimate interest in replying). The data is deleted once the matter has been settled and no statutory retention obligations — in particular under commercial and tax law — stand in the way. Consent once given can be withdrawn at any time with effect for the future.
No contact form is used on this website.
09 — External servicesLinks and messengers
The site contains a link to wa.me. Only when you click that link is a connection made to servers of WhatsApp Ireland Limited or the Meta group, and your IP address transmitted there. Until then, no data whatsoever is transmitted. WhatsApp's own privacy terms additionally apply to the communication that follows. If you'd rather avoid that, please use email or phone.
The reference to the Instagram profile is a plain text link. No Instagram content is embedded and no social media plugins are active; data is only transmitted once you actively click the link.
Referral links to providers
If referral links are mentioned in conversation or in the chat, only the privacy terms of the respective provider apply once you click. Through these links the provider can see that the referral came via Michael Wennesheimer; this is the precondition for the commission disclosed in the legal notice.
10 — Your rightsWhat you can ask for
You have the following rights vis-à-vis the controller:
- Access to the data processed about you (Art. 15 GDPR)
- Rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR)
- Erasure of your data, where no retention obligation prevents it (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability in a structured, commonly used format (Art. 20 GDPR)
- Objection to processing based on legitimate interests (Art. 21 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
An informal message to michael@wennesheimer.net is enough to exercise them. Handling is free of charge for you and takes place within one month.
Right to complain to a supervisory authority
Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent body is the Spanish data protection authority at the controller's place of establishment:
- Authority
- Agencia Española de Protección de Datos (AEPD)
- Address
- C/ Jorge Juan 6, 28001 Madrid, Spain
- Web
- www.aepd.es
Alternatively you may contact the supervisory authority of your habitual residence or place of work — in Germany, for example, the state data protection commissioner for your federal state.
11 — SecurityTechnical measures
This website is served exclusively over a TLS-encrypted connection (HTTPS); requests over HTTP are redirected automatically. Server access is restricted to key authentication, the chat database sits on a path that is not publicly reachable, and access to stored conversations is additionally protected by an access token. Rate limits prevent automated bulk querying of the assistant.
Absolute protection of data in transit over the internet is technically unattainable. Complete protection therefore cannot be guaranteed.
12 — ChangesHow current this statement is
This privacy statement will be adapted as soon as the procedures used on the website or the legal requirements change. The version available here at any given time is the applicable one.