Privacy Policy
English
Last updated: October 2026
This privacy policy explains which personal data we process when you use aiblog.website and the blogs hosted on it, and what rights you have.
1. Controller
Dennis Michael Heine
Amselweg 4
70794 Filderstadt
Germany
Email: info@dennis-heine.de
For the blogs on our customers' own domains, the respective customer is responsible for the content of the blog and for the advertising they add (see the imprint of the blog). We process the data of the visitors of these blogs on behalf of our customers as their processor, and as controller where we provide the service ourselves (user accounts, ad-free subscription, spam protection).
2. Hosting and server log files
The website runs on a server of ZAP-Hosting GmbH in Germany, which processes the data on our behalf (Art. 28 GDPR). When you open a page, your browser sends technical data (IP address, date and time, page requested, referrer, browser and operating system), which the web server stores in log files to deliver the website and to detect attacks. Legal basis: Art. 6 (1) (f) GDPR (secure and stable operation). Log files are deleted after 90 days at the latest.
The fonts are served from our own server; no data is sent to font providers or CDNs.
3. User and customer accounts
When you register, we store your user name, email address, password (only as a hash) and, if you provide them, your name and website. We send you an email with an activation link; accounts whose email address is never confirmed are deleted after 7 days. Customers also store their imprint and the settings of their blogs. Legal basis: Art. 6 (1) (b) GDPR (contract).
To keep you logged in, we set the session cookie ChyrpSession. Login sessions are deleted 30 days after their last use.
4. Bookings, subscription and payment (PayPal)
Bookings of blogs and article packages and the ad-free subscription are paid via PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. We transmit the subscription and its price to PayPal and receive the status of the payments; PayPal processes your payment data as its own controller (privacy policy: paypal.com). Legal basis: Art. 6 (1) (b) GDPR (contract) and Art. 6 (1) (c) GDPR (retention obligations under tax and commercial law).
Booking and payment records are kept for 8 years after the end of the booking (§ 147 AO, § 257 HGB), after the deletion of your account without a reference to it. The payment log (PayPal API calls and webhooks) is kept for 1 year, the IDs of processed PayPal events for 90 days.
5. Emails
We send emails (activation, password reset, booking confirmations, notices about your bookings and blogs) via the email service Spacemail of Spaceship, Inc., USA, which processes them on our behalf. The transfer to the USA is based on the standard contractual clauses of the EU Commission (Art. 46 GDPR). The email log is kept for 90 days.
6. Spam protection of the forms
To protect registration, login, password and comment forms against bots, we use only self-hosted methods, without external services and without cookies of their own:
- a hidden form field, a signed time stamp and a limit of requests per IP address and form;
- a proof of work (ALTCHA) that your browser solves invisibly in the background;
- only when a request looks automated: a picture puzzle (IconCaptcha).
For this we store, for at most 30 days, counters and failed attempts with a keyed hash of your IP address (never the address itself), and for a few minutes the puzzle with the same hash. The decisions are logged without the content of the form. Legal basis: Art. 6 (1) (f) GDPR (protection of the service and its users against abuse).
7. AI generation of the articles
The articles, translations, preview images and Fediverse teasers are created with AI services of Anthropic, PBC, USA (Claude). For this we transmit the description of the blog and the texts of public source articles; no data of the visitors of the blogs. If a customer's description of their blog contains personal data, it is transmitted as well; the transfer to the USA is based on the standard contractual clauses of the EU Commission (Art. 46 GDPR).
8. Consent, language and visitor statistics on the blogs
The blogs show a consent dialog. Your choice is stored in your browser (localStorage), not in a cookie, and can be changed at any time via "Cookie Settings".
- Language: if you choose a language with the language selector, it is stored for one year in the cookie
lang. Legal basis: § 25 (2) No. 2 TDDDG, Art. 6 (1) (f) GDPR. - Visitor statistics: only after you have accepted, a random visitor ID is stored in the localStorage of the blog, so that we can count new and returning visitors. We store it with the days of your visits, without your IP address; it is deleted 400 days after your last visit. The numbers are only shown to the owner of the blog. Bots, subscribers and logged-in staff are not counted. Legal basis: your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can withdraw at any time with effect for the future.
- Advertising: the owners of the blogs can add advertising codes of advertising networks. They are only loaded after you have accepted, in a sandboxed frame that can read neither cookies nor the page around it. The advertising network processes data as its own controller; the owner of the blog informs you about it. Readers with an ad-free subscription do not see advertising.
9. Fediverse and Bluesky
If the owner of a blog enables it, teasers of new articles are sent to the Fediverse (ActivityPub) and to Bluesky via Bridgy Fed. Only the content of the blog is sent, no data of its visitors. Servers that follow a blog store the teasers themselves. The delivery queue is deleted after 30 days.
10. Comments
If comments are enabled on a blog, we store your name, email address, optional website and the comment, as well as a hash of your IP address and your browser for 30 days to fight spam. Legal basis: Art. 6 (1) (a) and (f) GDPR.
11. Retention
| Data | Kept for |
|---|---|
| Account | until you delete it, then 30 days |
| Accounts whose email address was never confirmed | 7 days |
| Blogs after the end of their booking or their deletion | 30 days |
| Login sessions | 30 days after the last use |
| Bookings and payment records | 8 years after the end of the booking |
| Pseudonymous visitor IDs of the visitor statistics | 400 days after the last visit |
| Server log files (articles, Fediverse, images, emails, deletions) | 90 days |
| Payment log (PayPal API calls and webhooks) | 1 year |
| Spam protection (counters, failed attempts with a keyed hash of the IP address) | 30 days |
| Records of PayPal webhook events (IDs only) | 90 days |
| Fediverse delivery queue | 30 days |
| IP hash and browser of comments | 30 days |
12. Your rights
- Access and data portability (Art. 15, 20 GDPR): in your account settings, "Download your data" gives you everything we store about your account as a file (JSON): account details, ad-free subscription, bookings, blogs with their settings and the list of their posts, your imprint, AI usage and sessions.
- Rectification (Art. 16 GDPR): you can change your name, email address and website in your account settings at any time; customers edit their imprint and blogs in the admin area.
- Erasure (Art. 17 GDPR): "Delete your account" in your account settings. Your account is locked at once, running bookings and the ad-free subscription are cancelled, your blogs are no longer shown. All of your data is deleted 30 days later, except for the records we must keep (see "Retention").
- Restriction (Art. 18 GDPR) and objection (Art. 21 GDPR) to processing based on legitimate interests.
- Withdrawal of consent at any time with effect for the future ("Cookie Settings" on the blogs).
- Complaint to a supervisory authority (Art. 77 GDPR), e.g. the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.
For everything else, write to info@dennis-heine.de.
13. Changes
We update this privacy policy when the service or the law changes. The current version is always available at /privacy/.