Privacy Policy

Last updated: November 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Phone: +49 1577 3456535
E-mail: di2@marcus-belz.de

2. Scope

This privacy policy applies to the web application DI² - an ETL generator for database teams. The application is accessible exclusively to invited members. Public registration is not possible.

3. Personal data collected

3.1 Account data

When a user account is created (exclusively by administrators), the following data is stored:

On a user's first login, a technical shadow record is additionally created in the app database, caching the Keycloak user ID, e-mail address and display name. This cache enables displays such as “created by Max Mustermann” without constant queries to the identity provider. As soon as a user is deleted in Keycloak, e-mail and name are automatically removed from the app database (GDPR Art. 17 - right to erasure); only the technical reference remains so that historical audit entries stay traceable (anonymised as “Deleted account”). This also applies to details such as “created by”, “modified by” or “approved by” on projects, connections and tables. The unchangeable logs are the exception: in the approval history and the member history the e-mail address remains stored as a reference and is displayed as “Deleted account”; in the activity log the account remains recognisable until the entries are deleted after 90 days (section 10).

3.2 Technical access data (brute-force protection)

Protection against brute-force attacks is handled entirely by Keycloak as the identity provider. Keycloak internally records failed login attempts and temporarily locks accounts after repeated failures. This data is processed exclusively in the Keycloak backend (PostgreSQL database) and is not passed to the application.

3.3 Database connection profiles

Users can create connection profiles to external source databases. These contain:

3.4 Generated SQL scripts

The DDL statements and SQL procedures generated by the application are stored per user to enable a script history.

3.5 Approval notes and approval history

A project owner who approves a table or database can add a note; revoking an approval requires a reason. For the latest state, the application stores with the object who approved or revoked it (e-mail address), when, and the text. If the project's approval history is switched on (the default), it additionally records every such action: its type (approved, revoked, lapsed), the time, a reference to the account and the note or reason. All members of the project can read the latest state and the history; entries cannot be changed.

Notes and reasons are free text and may contain personal data - the person writing them is responsible for their content; the input dialog points out that the text is visible to all project members. A project owner can switch the history off in the project settings; no new entries are recorded after that. The history does not store names but a reference to the account: once an account is deleted, its entries - like the latest state on the object - appear as “Deleted account”.

4. Purposes and legal bases of processing

5. Storage period and deletion

6. Hosting and infrastructure

6.1 Hetzner Cloud (application server and database)

The application runs on a Hetzner Cloud VPS. Hetzner Online GmbH is a German company with data centres in Germany and Finland (EU/EEA).

All personal data is processed and stored exclusively on Hetzner servers in the EU. A data processing agreement (DPA) pursuant to Art. 28 GDPR exists with Hetzner.

Hetzner services used:

• Hetzner Cloud VPS - application server (Next.js, Nginx as reverse proxy)
• PostgreSQL - self-hosted database on the VPS

6.2 SSL/TLS encryption

Data transmission between browser and server is encrypted via SSL/TLS. The certificate is issued free of charge via Let's Encrypt (Internet Security Research Group). Let's Encrypt processes only the domain name, no personal data of the users.

6.3 DNS and domain

Domain management is handled via All-Inkl.COM (new media GmbH, Germany). All-Inkl manages DNS records only and has no access to application data.

7. E-mail (password reset)

An automated e-mail dispatch (e.g. for password reset) is not yet implemented in the current version of the application. Passwords are reset exclusively by administrators manually.

8. Sessions, JWT tokens and cookies

After signing in, a JSON Web Token (JWT) is issued representing your session. This token:

• has a validity of 8 hours
• is stored in your browser as an HTTP-only cookie
• contains only: user ID, e-mail, name
• becomes invalid automatically after expiry and requires signing in again

In addition, the following cookies are set for pure UI preferences:

• sidebar_state - stores only whether the navigation sidebar is expanded or collapsed. Lifetime: 7 days. No personal content, no tracking, no third party. Technically necessary within the meaning of § 25 (2) no. 2 TTDSG (storage of an explicit user preference) and therefore permitted without consent.
• di2_public_lang - stores your chosen website language (“de” or “en”) so that the site remembers your language preference on your next visit. Lifetime: 12 months. No personal content, no tracking, no third party. Technically necessary within the meaning of § 25 (2) no. 2 TTDSG (storage of an explicit, user-initiated preference) and therefore permitted without consent - no cookie banner required.

No persistent tracking cookies or third-party cookies are used.

9. Database connection profiles

Connection profiles to external databases contain technical access credentials to the source databases (hostname, port, database name, username, password). This data:

• are used exclusively to establish database connections in the context of ETL generation
• are stored encrypted in the PostgreSQL database on the Hetzner server
• are accessible only to you and administrators (Row Level Security)
• are not passed to third parties

10. Activity log (optional per project) and administration entries

Each project can keep an activity log. It is switched off by default and is only switched on by a project owner after an explicit confirmation that explains what is recorded, who can read it, how long it is kept and what is never recorded. The owner informs the team; in a company such a log may be subject to co-determination.

Purpose

Traceability of joint work: members can read who changed what in the project and when (e.g. a table was deactivated, a validation rule deleted, a load type changed). The admins of the application can read the entries of all projects with the log switched on in one place. The log is not used for performance or behaviour monitoring.

Data recorded

• Time of the action (server time)
• Account that triggered the action: e-mail address and display name at the time of the action
• Area and type of action (e.g. “tables · deactivated”) and its outcome (successful / partial / failed / rejected with a reason code)
• Identifiers of the affected objects (connection, table, column, rule and foreign-key names), counters and the value that was set (e.g. a status or a role)

Never recorded (allow-list principle - only explicitly permitted fields are stored): passwords and connection secrets, connection strings, the content of comment and note fields, values of validation-rule parameters beyond the rule type, and the wording of database driver error messages.

Recipients, storage period, legal basis

• Readable by the members of the respective project (restricted by Row Level Security in the database) and by the admins of the application (through an overview that only accounts with the admin role can open); no entry can be changed or deleted manually by anyone, not even an owner or admin.
• Entries are deleted automatically and permanently 90 days after the action, regardless of whether the log is switched on or off. Switching the log off stops the recording; the remaining entries are hidden until they expire. There is no export.
• An account that leaves the project or is deleted remains recognisable in its entries by the display name at the time of the action (or as a former member) until they expire.
• Legal basis: Art. 6 (1) (f) GDPR - legitimate interest of the project team in the traceability of joint changes; the switch is a conscious decision of the project owner. Stored on the own server in Germany, no processor, no third country, no cookies.

Administration entries (always kept)

Regardless of the project switch, the application records who administers accounts (invite, resend invitation, activate, deactivate, change role, change profile, delete) and who creates, duplicates or deletes projects - with account, time, action, the affected account or project name and the outcome. Purpose: administration that is traceable and protected against unauthorised changes. Recipients: the admins of the application only. Retention: 90 days, then deleted automatically and permanently. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in traceable administration). Passwords, invitation links and error texts of the sign-in service are not recorded.

11. Disclosure to third parties

Personal data is not sold or passed on for advertising purposes. Disclosure occurs exclusively:

• To Hetzner Online GmbH within the scope of the hosting contract (DPA in place)
• In the event of a legal obligation (e.g. official requests)

12. No third-country transfer

All personal data is processed and stored exclusively on servers within the European Union (EU) or the European Economic Area (EEA). No transfer of personal data to third countries takes place.

All static assets - fonts (Inter, JetBrains Mono), icons, logos and JavaScript bundles - are also served directly from the Hetzner server in Falkenstein. In particular, no fonts are loaded from Google Fonts or comparable third-party CDNs, so that no IP address or other connection data is transmitted to US servers when the page is accessed (relevant in the context of Regional Court of Munich I, judgment of 20 January 2022, ref. 3 O 17493/20 on Google Fonts).

13. Data security

14. Your rights

As a data subject you have the following rights under the GDPR:

• Access (Art. 15) - which data is stored about you?
• Rectification (Art. 16) - have incorrect data corrected
• Erasure (Art. 17) - have your data deleted, provided there is no retention obligation
• Restriction (Art. 18) - have the processing of your data restricted
• Data portability (Art. 20) - receive your data in a machine-readable format
• Objection (Art. 21) - object to processing based on legitimate interests

Contact to exercise your rights: di2@marcus-belz.de

15. Right to lodge a complaint

You have the right to lodge a complaint with the competent data protection supervisory authority:

16. Changes to this privacy policy

This privacy policy is updated when the application or the legal situation changes. In particular, section 7 (e-mail) will be extended as soon as a password reset by e-mail is implemented.