Privacy Policy for “Der Bussard SI” (bussard.si)
Last updated: 9 October 2026
This privacy policy explains which personal data we process when you visit https://bussard.si and use the “Der Bussard SI” chat, for what purposes, on what legal basis and for how long. The online magazine derbussard.com has its own privacy policy. In case of doubt, the German version of this policy prevails.
1. Controller
Simon Tritschler
Ludwigstr. 20
67678 Mehlingen
Germany
E-mail: info@derbussard.com
Phone: +49 1575 2444667
See also our imprint. We are not legally required to appoint a data protection officer and have not appointed one.
2. Summary
- “Der Bussard SI” is an AI chat that answers questions exclusively on the basis of articles published on derbussard.com.
- We do not store or log your questions or the answers. They are processed only to generate the answer and are then discarded.
- We use no tracking, no analytics tools, no advertising and no cookies. Only if you switch the language is your language choice stored in your browser.
- To prevent abuse, we briefly count how many questions come from a connection. For this we do not use your IP address itself, only a keyed hash value, which expires after no more than 60 minutes.
- All technology is operated by Cloudflare, Inc. as our processor. Data may also be processed in the USA and other countries outside the EU.
- Please do not enter personal data into the chat (e.g. names, contact details, health information), neither about yourself nor about others.
3. Website delivery, hosting and security
When you access bussard.si, our service provider Cloudflare processes technically necessary connection data. This includes your IP address, date and time of access, the requested URL, amount of data transferred, browser type and version (user agent), operating system and referrer URL.
Purposes: delivering the website, encrypting the connection (TLS), protection against attacks (e.g. DDoS, web application firewall), stability and troubleshooting.
We do not analyse this data ourselves and keep no access logs of our own. Cloudflare processes connection and security data as part of operating its network in accordance with its own policies and may retain such data for a limited period to operate the service securely. Details: https://www.cloudflare.com/privacypolicy/ Cloudflare may also instruct your browser to send technical error reports (Network Error Logging) to Cloudflare if a connection fails; successful requests are not reported.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and efficient provision of our service.
4. Using the AI chat
What happens to your question? When you submit a question, it is sent via an encrypted connection to our application at Cloudflare and processed automatically:
- The question is converted into a numerical representation (embedding) using the AI model “bge-m3” (BAAI; Workers AI model
@cf/baai/bge-m3). - This embedding is used to search a database (Cloudflare Vectorize) for matching passages from derbussard.com articles. The database contains only our articles, not your questions.
- The language model “Gemma 4 26B A4B” (Google; Workers AI model
@cf/google/gemma-4-26b-a4b-it, run via Cloudflare Workers AI) writes an answer based on these passages. The answer is shown to you together with links to the source articles.
All models run exclusively on Cloudflare’s infrastructure (Workers AI). Your question is not transmitted to Google or any other third party.
No storage, no training. We do not store your questions or the generated answers, we do not log them and we do not keep chat histories. Once the answer has been generated, the content is discarded on our side. If you reload the page, the conversation is gone. Previous questions and answers are only displayed on the open page; we do not store them in your browser (e.g. local storage) or on our systems. Each question is answered on its own; earlier questions are not sent again. According to Cloudflare, Workers AI inputs and outputs are not used to train AI models or to improve services (https://developers.cloudflare.com/workers-ai/platform/data-usage/).
Please do not enter personal data. The chat needs no information about you. Please do not enter names, contact details, health data or other personal information about yourself or others. If you do so anyway, this information is likewise only processed briefly as described above and is not stored.
No automated decision-making. No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to answer your question on the basis of our articles.
5. Abuse prevention (rate limiting)
To prevent abuse and overload, a maximum of 30 questions per hour is possible per connection. For this purpose we derive a hash value (pseudonymised check value) from your IP address using a secret key that changes daily (HMAC-SHA-256). Only this hash value and a counter are held briefly at Cloudflare: in Cloudflare's rate-limiting service (Workers Rate Limiting, 60-second window, at most 6 questions per minute) and in the cache of the Cloudflare data centre handling your request (hourly counter). Your IP address itself is not stored. The entries expire after no more than 60 minutes; they are then no longer used and are deleted automatically by Cloudflare.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is protecting our service against abuse, automated mass queries and disproportionate costs.
6. Cookies and browser storage
We do not use cookies, tracking, or analytics or advertising services. There is only one technically necessary entry in your browser’s local storage, and it is only created if you switch the language:
| Name | Purpose | Duration |
|---|---|---|
| bsi_lang (local storage, not a cookie) | Stores your language choice (“de” or “en”) when you click the “DE | EN” switcher, so the site appears in that language on your next visit. It is not sent to us. Without a click nothing is stored; the language then follows your browser’s language setting. | until you delete it (clear browser data) |
Storing and accessing these items is based on Section 25(2) No. 2 of the German TDDDG, as it is strictly necessary to provide the service you have expressly requested. No consent is required. Where personal data is processed in this context, the legal basis is Art. 6(1)(f) GDPR.
You can delete or block local storage entries in your browser settings; your language choice will then not be remembered.
No third-party content is embedded on bussard.si (no external fonts, no scripts from third-party sources, no social media plugins, no videos or maps).
7. Contact by e-mail (including “Report an error” and “Suggest this topic”)
If you e-mail us, e.g. via the “Report an error” or “Suggest this topic” links, we process your e-mail address and the content of your message to handle your request, correct reported errors and consider topic suggestions. Both links merely open your own e-mail program with a pre-filled draft (for “Suggest this topic”, containing your question); the message is only transmitted once you send it yourself. The chat itself stores nothing. Please note: as we do not store chats, we can only review a reported answer if you copy the question and answer into your message.
Our mailbox info@derbussard.com is operated using Apple’s iCloud Mail service. Your e-mail is therefore received and stored on Apple’s servers. For users in the EU, the provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple may have data processed by affiliated companies, in particular Apple Inc. in the USA. According to Apple, transfers from the EEA are based on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). Details: https://www.apple.com/legal/privacy/
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries and in accurate content) or Art. 6(1)(b) GDPR where your request relates to a contract. We delete your message once it has been dealt with, unless statutory retention obligations apply.
8. Recipients
For hosting, content delivery (CDN), security, application logic (Cloudflare Workers), AI models (Workers AI), the article database (Vectorize), rate limiting (Workers Rate Limiting and cache) and the store for article synchronisation (Workers KV, contains no personal data), we exclusively use:
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.
We have a data processing agreement (Data Processing Addendum) with Cloudflare pursuant to Art. 28 GDPR. There are no other recipients for operating the website and the chat. E-mails you send us are received by our e-mail provider Apple (see section 7). Cloudflare’s sub-processors are listed here: https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/
9. Transfers to third countries
Cloudflare operates a global network of data centres. Your data is usually processed in a data centre close to your location but may also be processed in the USA or other countries outside the EU/EEA. This applies in particular to AI processing, which cannot be restricted to EU data centres.
Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework (https://www.dataprivacyframework.gov/list); for the USA, an adequacy decision of the European Commission therefore applies (Art. 45 GDPR). For transfers to other third countries, and as an additional safeguard, Cloudflare has included the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR) in its Data Processing Addendum. More information: https://www.cloudflare.com/trust-hub/gdpr/
For the processing of e-mails by Apple, including in the USA, see section 7.
10. Retention
- Chat questions and answers: not stored by us; processed only while the answer is being generated.
- Rate-limiting hash and counter: expire after no more than 60 minutes and are then deleted automatically by Cloudflare.
- Language choice (bsi_lang) in your browser: until you delete it.
- Connection and security data at Cloudflare: in accordance with Cloudflare’s policies, as necessary for operation and security.
- E-mails: until the request has been dealt with, unless statutory retention obligations apply.
11. Your rights
You have the right to
- access (Art. 15 GDPR),
- rectification (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR).
As we do not store chat content and rate limiting only uses a short-lived hash value, we will generally be unable to identify or provide such data (Art. 11 GDPR).
To exercise your rights, simply e-mail info@derbussard.com.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI)
Hintere Bleiche 34
55116 Mainz, Germany
https://www.datenschutz.rlp.de
12. Obligation to provide data
You are under no legal or contractual obligation to provide data. However, without processing connection data (in particular the IP address), the website cannot be delivered, and without a question the chat cannot answer.
13. Changes
We will update this privacy policy if the technology or the legal situation changes. The version published here applies.