Privacy policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Mamani UG (haftungsbeschränkt)
Büngerstraße 17, 40597 Düsseldorf
Represented by: Mohammad Mahdi Dehnavi, Founder and Managing Director
E-mail: founder@mamani.ai
Telephone: +49 179 1716494

This website embeds no client-side analytics or advertising services. There is no cross-device tracking, no fingerprinting, no profiling and no advertising reach measurement. No tracking pixels, ad networks or tag managers are included. No visitor statistics are produced server-side either (section 5).

All fonts, images and scripts are served from the same domain as this page; there is no connection to Google Fonts or any other font service. Likewise no external content is embedded — no videos, maps, social media widgets or other content from third-party servers. The link to the MAMANI app is a plain text link; a connection is made only if you actively click it.

This website’s own code sets no cookies. No analytics, advertising, profiling or tracking cookies are set, and no fingerprinting takes place. No data is stored in IndexedDB. The upstream infrastructure does, however, set the following two technically necessary cookies:

• __cf_bm — set by the upstream content delivery network (Cloudflare) to detect bots and fend off automated access. It therefore serves the security and uninterrupted operation of this website, cannot be read by the page’s scripts and expires after about 30 minutes.
• __dpl — set by the hosting platform when a page is requested. It contains only the identifier of the website version currently being served, ensures that page content and its associated files are loaded from the same version, contains no information about you and expires after 24 hours.

In addition, only the following technically necessary information is stored on your device; the second only in the exceptional case described there:

• Notice status (localStorage). If you dismiss the privacy notice on your first visit using its button, we store a single marker permanently so the notice does not appear again. It contains no identifier, no timestamp and no information about you, and it is not transmitted. You can remove it at any time using the “Privacy notice” button in the footer or through your browser settings.
• Recovery marker (sessionStorage). After the website is updated, a page that is already open may try to load a program file that has since been replaced. To trigger a single automatic reload in that case while preventing an endless loop, the router framework in use sets a short-lived marker. It contains no personal data, is not transmitted, and expires at the latest when the browser tab is closed.

When the website is opened, it checks whether the marker described above is present; that read access also serves the stated purpose only.

Both storing and reading these cookies and this information are strictly necessary for the service you have expressly requested and are therefore exempt from the consent requirement under § 25(2) no. 2 TDDDG. No consent banner is used for that reason. We use no other storage mechanisms.

This website is hosted by Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden (“Lovable”). Lovable provides the technical provisioning, operation and delivery of the website for us. The website is delivered through Cloudflare’s content delivery network.

When this website is accessed, Lovable and the upstream content delivery network automatically process information that your browser transmits. This is:

• IP address
• date and time of the request
• the resource requested (page or file)
• referrer URL
• browser type and version, and operating system (user agent)
• volume of data transferred

The IP address is processed in the course of this. This data is stored only for as long as is necessary for the purposes set out below; the providers do not give us a fixed retention period. We do not analyse this data ourselves and do not combine it with other data sources.

The purposes of this processing are the delivery and technical operation of the website, ensuring its stability and security, defending against misuse, and error analysis. The content delivery network’s bot protection serves to fend off automated access (see the __cf_bm cookie in section 3).

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing this website securely, stably and in working order.

Transfers to third countries (Art. 13(1)(f) GDPR). Because the website is delivered through the infrastructure of Lovable and Cloudflare, a transfer of personal data to third countries, in particular the USA, cannot be ruled out. According to its own statements, Lovable bases transfers out of the European Economic Area on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) under Art. 46(2)(c) GDPR.

The hosting platform optionally offers visitor statistics (analytics). This feature is not enabled for this website, and this website loads no analytics script. No visitor statistics are therefore produced and no statistical analysis of your visit is carried out.

The server log data itself still arises for technical reasons; its processing is described in section 4.

There are no contact forms on this website. The e-mail link provided simply opens your own e-mail program — no data is transmitted to us in the process. We receive personal data only if you decide to write to us.

In that case we process your e-mail address and the content you send us in order to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in answering enquiries.

We store this data for as long as it is needed to deal with the enquiry. Where a message is subject to commercial or tax retention obligations (in particular § 257 HGB, § 147 AO), we retain it for the statutory period provided there; the legal basis for this is Art. 6(1)(c) GDPR. The data is deleted afterwards.

Recipient: your message is processed by Spaceship, Inc., which provides the e-mail service for the mamani.ai domain for us (Spacemail). It processes the message solely for the purpose of delivering and storing your mailbox contents. Spaceship acts as a processor under Art. 28 GDPR; the corresponding data processing agreement forms part of the contract for that service under Spaceship’s terms.

Transfers to third countries (Art. 13(1)(f) GDPR). For the delivery of this website, see section 4. The e-mail service for the mamani.ai domain is provided by Spaceship, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA (“Spacemail”). Personal data is therefore transferred to the USA, a third country. The transfer is based on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two – controller to processor) under Art. 46(2)(c) GDPR. They form part of the data processing agreement that Spaceship incorporates into its terms for the services concerned — expressly including Spacemail — under which we are the controller and data exporter and Spaceship, Inc. is the processor and data importer. A copy of the safeguards is available on request to founder@mamani.ai.

You are under no legal or contractual obligation to provide data in order to use this website. The technically necessary request data (see section 4) arises unavoidably; without it the website cannot be delivered. Whether you write to us is entirely your choice; without your details, however, we cannot answer your enquiry.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on this website.

This website is designed for encrypted delivery over HTTPS only; requests over HTTP are redirected to HTTPS. Transmission between your browser and the server is therefore encrypted according to the current state of the art.

You have the following rights in relation to the controller, where the respective statutory conditions are met:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR, see section 10)

To exercise your rights, a message to founder@mamani.ai is sufficient.

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is carried out on the basis of Art. 6(1)(f) GDPR. On this website that concerns the server log data (section 4) and the handling of non-contractual enquiries by e-mail (section 6). If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. No particular form is required; you can send your objection to founder@mamani.ai.

Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (the data protection authority for North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany

We update this privacy policy whenever the technical operation of this website or the legal requirements change. Changes apply going forward. If we process personal data further for a purpose other than those stated here, we will inform you separately in advance where Art. 13(3) GDPR requires it.