Controller
Ronald Reisener — ConformVector
Cisinskistr. 1A
01920 Crostwitz
Germany
Email: hello@conformvector.com
Hosting and technical logs
This website is hosted by ALL-INKL.COM — Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. In normal hosting operation, technical request data such as IP address, timestamp, requested resource, browser/user-agent information and server status data can be processed in access and security logs. This processing supports secure and reliable website operation. The legal basis is generally Art. 6(1)(f) GDPR (legitimate interest in reliable and secure operation), subject to the final circumstances of the request.
CRA QuickCheck — AI processing
When you use the CRA QuickCheck, the text you enter is transmitted to OpenAI through its API in order to generate adaptive questions and the preliminary result. The QuickCheck is intentionally designed not to require source code, credentials, unpublished vulnerabilities or confidential architecture details.
ConformVector does not intentionally write QuickCheck conversations to an application database. During an active QuickCheck, the current interview state and recent answers are kept temporarily in a server-side session so that the public endpoint can enforce turn limits, resist tampering and continue the interview consistently. Logical QuickCheck sessions are configured to expire after inactivity or a short absolute session window. The API request is sent with application-level response storage disabled (store: false). This does not by itself eliminate provider-side security or abuse-monitoring logs.
OpenAI states that business/API content is not used to train its models by default. Under OpenAI's standard API data controls, API inputs and outputs may be retained for up to 30 days for service and abuse monitoring unless a different eligible retention configuration applies. Processing can involve OpenAI infrastructure and subprocessors outside the EEA; OpenAI describes contractual safeguards, including Standard Contractual Clauses where required, for international transfers.
Provider information: OpenAI business data privacy and OpenAI Europe privacy policy.
Anonymized reach statistics
To understand whether and when this website is visited, a small first-party script reports each page view to this server. The record contains the time, the visited page, the referring page, a coarse browser/operating-system category and the IP address in truncated form only (for IPv4 the last octet is removed before storage; for IPv6 only the /48 prefix is kept). A short-lived pseudonymous value derived from the truncated address rotates daily and is used solely to estimate visitor counts; it cannot be linked across days. No cookies are set for this purpose, no full IP addresses or raw user-agent strings are stored, and no data is shared with advertising or analytics providers. Statistics records are deleted after six months at the latest. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in measuring the basic reach and reliability of the website). You can exclude your browser at any time at conformvector.com/stats/optout.html or by blocking the script /assets/stats.js.
Security and abuse prevention
Because the CRA QuickCheck is available without an account, ConformVector uses proportionate technical controls to prevent automated flooding and use of the AI endpoint as a general-purpose proxy. These controls include server-side session state, maximum turn and input limits, request and session rate limits, daily AI-usage limits and simple off-topic / prompt-abuse detection. Rate limiting uses pseudonymous keys derived from the requesting IP address rather than intentionally storing the raw IP in a ConformVector application database.
The public deployment may also use Cloudflare Turnstile as an automated abuse-protection challenge. If enabled, the browser communicates with Cloudflare to obtain a short-lived challenge token, and ConformVector validates that token server-side before a new QuickCheck session starts. Cloudflare can process technical data needed to operate the challenge, potentially including IP address and browser/device signals. Provider information: Cloudflare Privacy Policy.
Email snapshot
If you ask the QuickCheck to email a snapshot, the email address is used to send that requested message. The form is designed not to store the address in a ConformVector application database. The address and message can nevertheless appear in normal hosting/mail-server logs and in the sent email. If you separately request follow-up, the address and request are also used to contact you about the assessment.
Contact and fit-call requests
If you use the contact form or contact ConformVector by email, the information you provide is processed to answer your request, assess scope fit, take pre-contractual steps where applicable and maintain necessary business correspondence. The form is delivered through the hosting/mail infrastructure and is not used for newsletter marketing.
Depending on the context, the legal basis can include Art. 6(1)(b) GDPR (pre-contractual steps requested by you) and Art. 6(1)(f) GDPR (legitimate interest in responding to B2B enquiries and operating the service). Where an optional consent is requested, Art. 6(1)(a) GDPR applies to that consented purpose.
Retention
QuickCheck conversations are not intentionally stored in a ConformVector application database. Temporary server-side QuickCheck session state is configured for short-lived operation and is discarded after inactivity or session expiry; pseudonymous rate-limit counters are transient security data and stale local counter files are periodically purged. Hosting/security logs remain subject to the hosting provider's operational retention. Standard OpenAI API retention can be up to 30 days as described above. Email and contact correspondence is retained only as long as reasonably necessary for the enquiry, business relationship and applicable statutory record-keeping obligations.
No advertising tracking
This version of the website does not use behavioral advertising, third-party marketing analytics or newsletter tracking. If such services are added later, this notice and any required consent mechanism must be updated before use.
Your rights
Depending on applicable data-protection law, you may have rights including access, correction, deletion, restriction, objection and data portability, as well as a right to lodge a complaint with a competent supervisory authority. Contact hello@conformvector.com for privacy requests.
Changes
This privacy notice may be updated when the site, service providers or data flows change. Last updated: 15 September 2026.