Privacy Policy

Last updated: July 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Phone: +49 1577 3456535
E-mail: di2@marcus-belz.de

2. Scope

This privacy policy applies to the web application DI² - an ETL generator for database teams. The application is accessible exclusively to invited members. Public registration is not possible.

3. Personal data collected

3.1 Account data

When a user account is created (exclusively by administrators), the following data is stored:

On a user's first login, a technical shadow record is additionally created in the app database, caching the Keycloak user ID, e-mail address and display name. This cache enables displays such as “created by Max Mustermann” without constant queries to the identity provider. As soon as a user is deleted in Keycloak, e-mail and name are automatically removed from the app database (GDPR Art. 17 - right to erasure); only the technical reference remains so that historical audit entries stay traceable (anonymised as “deleted user”).

3.2 Technical access data (brute-force protection)

Protection against brute-force attacks is handled entirely by Keycloak as the identity provider. Keycloak internally records failed login attempts and temporarily locks accounts after repeated failures. This data is processed exclusively in the Keycloak backend (PostgreSQL database) and is not passed to the application.

3.3 Database connection profiles

Users can create connection profiles to external source databases. These contain:

3.4 Generated SQL scripts

The DDL statements and SQL procedures generated by the application are stored per user to enable a script history.

4. Purposes and legal bases of processing

5. Storage period and deletion

6. Hosting and infrastructure

6.1 Hetzner Cloud (application server and database)

The application runs on a Hetzner Cloud VPS. Hetzner Online GmbH is a German company with data centres in Germany and Finland (EU/EEA).

All personal data is processed and stored exclusively on Hetzner servers in the EU. A data processing agreement (DPA) pursuant to Art. 28 GDPR exists with Hetzner.

Hetzner services used:

• Hetzner Cloud VPS - application server (Next.js, Nginx as reverse proxy)
• PostgreSQL - self-hosted database on the VPS

6.2 SSL/TLS encryption

Data transmission between browser and server is encrypted via SSL/TLS. The certificate is issued free of charge via Let's Encrypt (Internet Security Research Group). Let's Encrypt processes only the domain name, no personal data of the users.

6.3 DNS and domain

Domain management is handled via All-Inkl.COM (new media GmbH, Germany). All-Inkl manages DNS records only and has no access to application data.

7. E-mail (password reset)

An automated e-mail dispatch (e.g. for password reset) is not yet implemented in the current version of the application. Passwords are reset exclusively by administrators manually.

8. Sessions, JWT tokens and cookies

After signing in, a JSON Web Token (JWT) is issued representing your session. This token:

• has a validity of 8 hours
• is stored in your browser as an HTTP-only cookie
• contains only: user ID, e-mail, name
• becomes invalid automatically after expiry and requires signing in again

In addition, we set the following cookies for pure UI preferences:

• sidebar_state - stores only whether the navigation sidebar is expanded or collapsed. Lifetime: 7 days. No personal content, no tracking, no third party. Technically necessary within the meaning of § 25 (2) no. 2 TTDSG (storage of an explicit user preference) and therefore permitted without consent.
• di2_public_lang - stores your chosen website language (“de” or “en”) so that the site remembers your language preference on your next visit. Lifetime: 12 months. No personal content, no tracking, no third party. Technically necessary within the meaning of § 25 (2) no. 2 TTDSG (storage of an explicit, user-initiated preference) and therefore permitted without consent - no cookie banner required.

No persistent tracking cookies or third-party cookies are used.

9. Database connection profiles

Connection profiles to external databases contain technical access credentials to the source databases (hostname, port, database name, username, password). This data:

• are used exclusively to establish database connections in the context of ETL generation
• are stored encrypted in the PostgreSQL database on the Hetzner server
• are accessible only to you and administrators (Row Level Security)
• are not passed to third parties

10. Disclosure to third parties

Personal data is not sold or passed on for advertising purposes. Disclosure occurs exclusively:

• To Hetzner Online GmbH within the scope of the hosting contract (DPA in place)
• In the event of a legal obligation (e.g. official requests)

11. No third-country transfer

All personal data is processed and stored exclusively on servers within the European Union (EU) or the European Economic Area (EEA). No transfer of personal data to third countries takes place.

All static assets - fonts (Inter, JetBrains Mono), icons, logos and JavaScript bundles - are also served directly from the Hetzner server in Falkenstein. In particular, no fonts are loaded from Google Fonts or comparable third-party CDNs, so that no IP address or other connection data is transmitted to US servers when the page is accessed (relevant in the context of Regional Court of Munich I, judgment of 20 January 2022, ref. 3 O 17493/20 on Google Fonts).

12. Data security

13. Your rights

As a data subject you have the following rights under the GDPR:

• Access (Art. 15) - which data is stored about you?
• Rectification (Art. 16) - have incorrect data corrected
• Erasure (Art. 17) - have your data deleted, provided there is no retention obligation
• Restriction (Art. 18) - have the processing of your data restricted
• Data portability (Art. 20) - receive your data in a machine-readable format
• Objection (Art. 21) - object to processing based on legitimate interests

Contact to exercise your rights: di2@marcus-belz.de

14. Right to lodge a complaint

You have the right to lodge a complaint with the competent data protection supervisory authority:

15. Changes to this privacy policy

This privacy policy is updated when the application or the legal situation changes. In particular, section 7 (e-mail) will be extended as soon as a password reset by e-mail is implemented.