Legal
Privacy
Which personal data is processed when you visit this website – and which is not.
01Data processing
Controller
Miroslaw Michna
LEVERLY HILLS SOFTWARE SOLUTIONS
Albertus-Magnus-Straße 5
52372 Kreuzau (district of Leversbach)
Germany
Email: info@leverlyhills.com
02Data processing
The essentials
The public website sets no cookies, stores no information in your browser and uses no analytics, tracking or advertising services. Fonts, images and scripts are served from our own server; no third-party content is embedded. The Hosting Manager is described separately in the “Hosting Manager and Google sign-in” section.
The connection to the website is encrypted with TLS.
03Data processing
Hosting and server logs
When you visit the website, the servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen process technically necessary data: IP address, date and time, requested address, amount of data transferred, referring page, and browser and operating system.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable delivery of the website. A data processing agreement (Art. 28 GDPR) is in place with the hosting provider.
Server logs are deleted after 14 days at the latest unless they are needed to investigate a specific security incident.
04Data processing
Hosting Manager: Sign-in and identity
When you use the Hosting Manager, we process your Google account identifier, email address and verification status, and – if provided by Google – your name. Sign-in uses Google OpenID Connect with the “openid” and “email” scopes. Google access and refresh tokens are not stored in our database. Google processes data during sign-in under its own data protection responsibility; this may involve processing in countries outside the European Economic Area. See Google’s privacy notice for more information.
05Data processing
Hosting Manager: Projects and access
We process account role and status, project metadata and access permissions, and invitation data such as an optional email restriction, expiry date, use count and one-way-hashed invitation tokens. We process this data to authenticate accounts, provide the Hosting Manager and manage project access. The legal basis is Art. 6(1)(b) GDPR insofar as processing is necessary to provide Hosting Manager access, and Art. 6(1)(f) GDPR for secure administration and protection against unauthorized access.
06Data processing
Hosting Manager: Sessions and retention
For sign-in and session management, the Hosting Manager sets a technically necessary HttpOnly, Secure and SameSite=Lax cookie. Sessions expire after 12 hours by default. Short-lived sign-in transactions expire after 10 minutes and one-time handoff tokens after 60 seconds; expired session and sign-in records are cleaned up regularly. Session tokens are stored in the database only as hashes. We retain account, project and permission data while needed to administer the Hosting Manager and access; afterwards we delete it unless statutory duties or necessary security purposes require retention. Invitations become invalid upon expiry or revocation. Short-lived sign-in, handoff and session data are deleted after expiry.
07Data processing
Contact by email
If you email us, we process your email address, your name and the content of your message in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR.
The mailbox is operated by Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands.
Your data is deleted once it is no longer needed to handle your enquiry. Statutory retention obligations, for example for business correspondence, remain unaffected.
08Data processing
Links to social networks
The references to X and Instagram are plain links. No data is transferred to these platforms when you visit this website. Only when you click a link do you leave this website; processing on the platform is governed by its own privacy notice.
09Data processing
Public AI interfaces
Applications can retrieve published website content through the public MCP endpoint and the llms.txt file. These requests are processed technically like page views and recorded only in the server logs described above. Search queries are not stored for any other purpose.
10Data processing
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).
Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).
An email to info@leverlyhills.com is sufficient for any request.
11Data processing
Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is: State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
Last updated: September 2026.
