Privacy Policy
Last updated: May 2026
This Privacy Policy describes which personal data is processed when visiting and using this website (mycv.vgdata.net), for which purposes, and on which legal basis.
1. Controller
Vilson Cristiano Gärtner Albrechtstraße 19, 33602 Bielefeld, Germany Email: vilson@gartner.net.br
Please direct privacy-related requests to the email address above.
2. What data is processed
2.1 Server logs (technically necessary)
Each visit to this website processes:
- IP address (truncated, stored only for rate-limiting / abuse protection)
- Date and time of access
- Requested URL
- User-Agent (browser type)
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure operation). Retention: Rate-limit entries up to 30 rolling days; general logs up to 12 months.
2.2 Chat with the AI assistant "VG"
When you use the chatbot, your messages are transmitted to the AI provider OpenAI (USA) to generate a response. Before reaching the chat model, each message also passes through OpenAI's Moderation API as a pre-filter — messages flagged for sexual, harassing, hateful, violent or self-harm content are refused with a polite redirect and never reach the chat model. The following is logged on our server for audit and security purposes:
- IP address
- Language of the question
- Question content
- Beginning of the answer (max. 2000 chars)
- Whether the message was flagged by the moderation pre-filter and which categories triggered
- Whether the message was blocked (refused)
Legal basis: Art. 6 (1) (a) GDPR (consent — by using the chat) and Art. 6 (1) (f) GDPR (legitimate interest in operating and securing the service). Retention: 12 months.
The chat history is also stored locally in your browser (localStorage) so the history persists across reloads. This local data is never transmitted to our server and can be deleted at any time via the "New chat" button or your browser settings.
2.3 Contact form
When you use the contact form, we process the following data you submit:
- Name (required)
- Email address (required)
- Company (optional)
- Opportunity type (required)
- LinkedIn URL (optional)
- Message (required, max. 500 chars)
- Your IP address and timestamp (for abuse protection)
Delivery to Vilson Cristiano Gärtner happens primarily via WhatsApp; if that channel is unavailable, the message is sent by email through the third-party provider Resend (USA).
Legal basis: Art. 6 (1) (a) GDPR (explicit consent via the form's checkbox). Retention: 12 months.
2.4 CV download (PDF / DOCX)
Upon CV download, your IP address, chosen language, and chosen format are logged.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in abuse protection). Retention: 12 months.
2.5 MCP API usage
When external MCP clients (e.g., Claude Desktop) use the public MCP endpoint, we log IP, tool name, truncated arguments, and a success flag.
Legal basis: Art. 6 (1) (f) GDPR. Retention: 12 months.
2.6 Site visit statistics
For each page load we store the date and time, the requested path, the UI language, a category flag (human vs. detected bot), and approximate geolocation derived from the IP (country, city, and the city's centroid coordinates). The visitor IP is never persisted; instead we store a one-way SHA-256 hash of (IP + user-agent) salted with a server secret and the UTC day. The salt rotates every day, so the same visitor produces a different hash tomorrow and cannot be tracked across days from the stored data. No cookies or localStorage are used for visit tracking.
The geolocation lookup is performed locally on our server against an offline IP-to-location database — the visitor IP is not sent to any external geolocation service. The resolution is country and approximate city; never street-level.
We use this aggregate data only to see overall traffic levels, the geographic distribution of visitors, and to detect crawler noise. No third-party analytics service, ad network, or fingerprinting library is involved.
Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in operating and securing the site. Retention: 12 months.
3. Recipients and international data transfers
| Recipient | Location | Purpose | Legal basis |
|---|---|---|---|
| OpenAI, L.L.C. | USA | AI response generation | Art. 6 (1) (a) (consent); EU-US Data Privacy Framework |
| Resend, Inc. | USA | Email fallback (only if WhatsApp is unavailable) | Art. 6 (1) (a); SCC |
| Cloudflare, Inc. | USA | Turnstile (bot protection, if enabled) | Art. 6 (1) (f); SCC |
No further sharing with third parties takes place. The website is hosted on a dedicated server at Contabo GmbH (Germany).
4. Cookies
This website sets no tracking or advertising cookies. We exclusively use the browser's own storage (localStorage) for purely technical purposes (chat history, theme preference, language selection). This data never leaves your browser.
5. Your rights
You have the right to:
- Access the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing (Art. 21 GDPR)
- Withdraw consent with effect for the future (Art. 7 (3) GDPR)
- Lodge a complaint with a supervisory authority (e.g., Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen)
Please direct requests to: vilson@gartner.net.br
6. Updates to this policy
This Privacy Policy is updated upon material changes to processing or legal requirements. The current version is always available on this page.