Privacy policy

1. Overview

This privacy policy explains what personal data we process when you visit our website vortail.systems, describe a project to us, book an intro call, use the terminal on the home page or buy in the shop: for which purposes, on which legal basis, who receives the data, how long we keep it and what rights you have.

Personal data is any information relating to an identified or identifiable person (Art. 4(1) GDPR), such as your name, your email address or your IP address. We process it in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

2. Controller

VORTAIL SYSTEMS is the partner studio of MAD MIRROR STUDIOS for software, AI and automation. The controller for both studios is:

MAD MIRROR STUDIOS GbR, represented by its partners Marlon Baum and Melvin Baum
Zentgrafenstraße 93, 34130 Kassel, Germany
Email: hello@mad-mirror-studios.com
Phone: +49 176 416 316 47

We are not required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG). Please send questions about data protection to the email address above.

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. With every page request, your browser automatically transmits technical data that is processed in server log files: IP address, date and time, requested address, status code, amount of data transferred, referrer, and browser and operating system.

We need this data to deliver the website, keep it stable and secure and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and working website. The log data is only kept for as long as these purposes require and is not combined with other data sources.

Vercel is our processor (Art. 28 GDPR) and delivers the website through a worldwide server network. Data may be transferred to the USA in the process; Vercel is certified under the EU-U.S. Data Privacy Framework, and the EU standard contractual clauses apply in addition (see section 17).

4. Fonts, content and our backend

We serve fonts from our own server. No connection is made to Google Fonts or any other font provider.

Project pages, images, the shop catalogue and the website's functions (forms, booking, shop) run on our backend at Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, with its data center in Frankfurt am Main, which we share with our partner studio MAD MIRROR STUDIOS. When your browser loads content from there, your IP address is transmitted to Supabase for technical reasons. The legal basis for delivering the website is Art. 6(1)(f) GDPR; for your requests, the legal bases in the following sections apply.

Supabase is our processor. The data is stored in Frankfurt am Main; where Supabase or its sub-processors can access it from Singapore, the USA or other third countries for operation, maintenance and support, this is based on the EU standard contractual clauses, which are part of our contract with Supabase.

5. Contact by email or phone

When you contact us by email or phone, we process your details (such as your name, contact details and the content of your message) to answer your request. The legal basis is Art. 6(1)(b) GDPR if your request aims at a contract with us, otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering requests.

We run our mailboxes, calendars and video calls on Google Workspace of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor. Any transfer to Google LLC in the USA is based on the EU-U.S. Data Privacy Framework.

6. Project brief, configurator and call-back request

When you describe a project to us through the website, send a configuration or ask for a call back, we process your details: name, email address, optionally company and phone number, your message, your answers in the configurator with a link that restores the configuration, the timeframe you want, the kind of call and your preferred times for a call back. In addition, we receive the language and the topic of the request. We use this data to handle your request, prepare an offer or a call and follow up where needed.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). For following up and for merging several requests with the same email address we rely on Art. 6(1)(f) GDPR; our legitimate interest is handling requests completely and efficiently.

We store your request as a contact in our own customer management system (Supabase, data center in Frankfurt am Main). We send the notification to us and the confirmation to you through the email service Resend (Resend, Inc., USA) as our processor; the transfer to the USA is based on the EU standard contractual clauses.

To prevent misuse, we limit the number of requests per connection. For this, your IP address is processed briefly in memory; for call-back requests we also store a salted hash of the IP address (not the address itself) and delete it after 48 hours. The legal basis is Art. 6(1)(f) GDPR.

We also protect the forms on this website (project brief with configurator, call-back request, intro call booking including rescheduling and cancelling) against spam and automated requests with Cloudflare Turnstile. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile only loads once you use a form, for example by clicking into a field; as long as you only read the website, no connection to Cloudflare is made. Your browser then loads a script from challenges.cloudflare.com that checks whether a human is using the form. Cloudflare receives your IP address, technical characteristics of your browser and connection (such as the browser identifier and features of the encrypted connection) and the address of the website the form is on; Cloudflare may store and read information in your browser for this. Usually you notice nothing; only in case of doubt does a box appear for you to tick. The result is a single-use check value that your browser sends to our server with the form. Our server has Cloudflare confirm it and transmits your IP address in the process; we do not store the check value or the result.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting our forms, our inbox and our services against misuse and automated attacks. Storing and reading information in your browser is strictly necessary for us to provide the form you are using securely (§ 25(2) no. 2 TDDDG). For the check, Cloudflare is our processor (Art. 28 GDPR). According to Cloudflare, it also uses the characteristics under its own responsibility to improve its bot detection, but not to identify individuals, build profiles or show advertising. Cloudflare is certified under the EU-U.S. Data Privacy Framework (see section 17). More at https://www.cloudflare.com/turnstile-privacy-policy/ and https://www.cloudflare.com/privacypolicy/. If you would rather not use Turnstile, just write to us at hello@mad-mirror-studios.com.

Until you submit them, your answers in the configurator only sit in the page address in your browser. They are only sent to us when you submit the request.

7. Intro call booking and video calls

When you book an intro call in a free slot, we process your name, email address, phone number and company if given, topic, notes, the kind of call, your time zone and the chosen time. We create the appointment in our Google calendar; Google sends the invitation, with a Google Meet link for a video call, to your email address. We send the booking confirmation and, the day before the call, a reminder by email through Resend.

With the confirmation you receive a personal link to reschedule or cancel the appointment. Anyone who has this link can manage the appointment, so please do not share it.

If you join a video call on Google Meet, Google processes the data needed for the connection, such as your IP address, device information, your display name and picture and sound during the call. We do not record calls without your express prior consent.

The legal basis is Art. 6(1)(b) GDPR. Google is our processor; any transfer to Google LLC in the USA is based on the EU-U.S. Data Privacy Framework.

We protect booking, rescheduling and cancelling against spam with Cloudflare Turnstile (see section 6).

8. The terminal in the logo

On the home page you can type commands over the logo. The page answers simple commands itself. All others are sent by your browser, together with up to six previous entries and replies of this visit, the language and the size of the display, to a server function at Vercel. It has the reply generated by the AI model Claude of Anthropic Ireland, Limited. Data may be transferred to Anthropic PBC in the USA in the process; this is based on the EU standard contractual clauses. Under its contractual terms, Anthropic does not use this data to train its models. Only the text is sent to Anthropic, not your IP address. Please do not enter any personal data in the terminal.

We do not store your entries. To limit costs, our backend only counts how many replies are generated per day in total, without any link to you. To prevent misuse, the server function processes your IP address briefly in memory to limit the number of requests per connection.

To keep automated programs from exploiting the terminal, we use Vercel BotID. When the animation on the home page starts, your browser loads a check script through our own domain that evaluates technical characteristics of your browser and how it is used; the result is sent along with a command and checked by Vercel as our processor. Your browser remembers whether you have seen the hint for the terminal (see section 13).

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is an interactive website protected against misuse and unlimited costs. Where the check stores or reads information in your browser, this is strictly necessary to protect this service (§ 25(2) no. 2 TDDDG).

9. Images and videos on the project pages

The images and videos of our projects are stored on our own storage (Supabase, Frankfurt am Main) or delivered with the website. Some videos may be loaded directly from Dropbox (Dropbox International Unlimited Company, One Park Place, Hatch Street Upper, Dublin 2, Ireland). If you open a project page with such a video, your browser loads it from Dropbox servers; your IP address is transmitted to Dropbox in the process, possibly also to the USA.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is showing our work in good quality. Any transfer to the USA is based on the EU-U.S. Data Privacy Framework or the EU standard contractual clauses.

10. Live view of client websites

On some project pages we show a client's website not just as an image but live, in a browser or smartphone frame. This only happens on larger screens; on smartphones you see a screenshot from our own storage.

With the live view, your browser loads the client's website directly from its servers. Data such as your IP address and device and browser information is then transmitted to the operator of that website and its service providers; we do not send the address of our page along. The website shown may use its own scripts, cookies or cookie banner. Its operator is responsible for that, and its privacy policy applies, which you can reach through the link to the website.

The legal basis for loading it is Art. 6(1)(f) GDPR; our legitimate interest is showing our work the way it works in use.

11. Videos from YouTube and Vimeo

On some project pages we show videos hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or Vimeo (Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA). Until you press play, you only see a preview image from our own storage; no connection to YouTube, Google or Vimeo is made.

Only when you click do we load the player, for YouTube in privacy-enhanced mode (youtube-nocookie.com), for Vimeo with the Do Not Track setting enabled. Data such as your IP address, device and browser information and the page the video plays on is then transmitted to the respective provider, including to the USA. The providers may use cookies or similar technologies.

The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The transfer to the USA is based on the EU-U.S. Data Privacy Framework. More in the privacy policies of Google (https://policies.google.com/privacy) and Vimeo (https://vimeo.com/privacy).

12. Shop: purchase, licenses and activation

When you buy in the shop, we send you to Stripe Checkout to pay. The merchant of record is Link, a Stripe service. Link processes your payment and billing data under its own responsibility to handle the purchase, pay the taxes and send you the receipt and invoice; the privacy policies of Link and Stripe apply (https://link.com/privacy, https://stripe.com/privacy). Data may also be transferred to the USA; Stripe relies on the EU-U.S. Data Privacy Framework and the EU standard contractual clauses for this. We do not receive your payment details, such as card numbers.

After the purchase, Stripe sends us your name, email address, country, the products bought and the amounts. With these we create your order and license keys in our own management system (Supabase, Frankfurt am Main) and email you the keys and the link to your order page through Resend. With the order we store which version of the license terms you accepted and when. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and, for keeping records, Art. 6(1)(c) GDPR.

Through the link to your order page you see your keys, download the products and release devices. Anyone who has this link can do the same, so please do not share it. If you lose the link, we send it on request to the email address you bought with. The website always gives the same answer, so nobody can find out whether an address has bought anything.

When you activate a product, it sends us the license key, a hashed identifier of the device (not the hardware identifier itself), the device name, the operating system and the product version, and on later checks also the time. This lets us check the number of devices per license and lets you release devices on your order page. The legal basis is Art. 6(1)(b) GDPR.

To prevent misuse, we limit the number of requests to the shop per connection; for this, your IP address is processed briefly in memory (Art. 6(1)(f) GDPR). Your cart is stored only by your browser (see section 13).

13. Browser storage and cookies

We set no cookies for analytics or advertising and embed no analytics or advertising services. For the website to work, it keeps a few details in your browser's storage (local storage and session storage). These details stay on your device:

• mms-lang (local storage): the language you chose, until you clear your browser storage.
• mds-code-hint (local storage): that you have seen the hint for the terminal on the home page, until you clear your browser storage.
• mds-cart (local storage): the contents of your shop cart, until you order or empty it.
• mds-shop-demo and mds-shop-demo-order (session storage): only in the shop's demo mode: that it is on and the demo order, until you close the tab.

This storage is strictly necessary to provide the service you requested (§ 25(2) no. 2 TDDDG); any further processing is based on Art. 6(1)(f) GDPR. For the Vercel BotID check, see section 8.

When you use a form, Cloudflare Turnstile may also store and read information in your browser to protect against spam, for example in the embedded check window from challenges.cloudflare.com (see section 6). This serves solely to protect the form you are using and is strictly necessary for it (§ 25(2) no. 2 TDDDG).

Apart from this check, third-party cookies can only arise when you play a video from YouTube or Vimeo (section 11) or see the live view of a client website (section 10). We use no advertising cookies.

14. Our social media profiles

We have our own profiles on Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) and LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland). The links on our website are plain links; no data flows to the platforms until you click one.

When you visit our profiles, the platforms process your data under their own privacy terms, including in the USA. Where the platforms provide us with statistics on the use of our profiles, we are jointly responsible with them for creating these statistics (Art. 26 GDPR); LinkedIn provides information at https://legal.linkedin.com/pages-joint-controller-addendum and Meta at https://www.facebook.com/legal/terms/page_controller_addendum. If you message us there, we process your message to answer it.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is showing our work and communicating with prospects. You can exercise your rights against us and directly with the respective platform, which has direct access to your data.

15. Clients and business partners

When you engage us, we process the data of your contact persons needed for the offer, the work and invoicing, such as name, role, contact details, correspondence and billing data. The legal basis is Art. 6(1)(b) GDPR and, for keeping business records, Art. 6(1)(c) GDPR in conjunction with § 257 HGB and § 147 AO.

Where necessary, we pass data on to tax advisors, banks and payment providers and to freelancers and service providers we engage for your project. If we process personal data on your behalf as part of a project, for example when hosting or maintaining a website or app or running an AI solution, we conclude a data processing agreement for it (Art. 28 GDPR).

16. Recipients at a glance

These service providers receive data from us or from your browser, each only to the extent described:

• Vercel Inc., USA: website hosting, the terminal's server function and bot protection (Vercel BotID).
• Supabase Pte. Ltd., Singapore, data center in Frankfurt am Main: backend, customer management, shop management and media storage.
• Resend, Inc., USA: sending confirmations, reminders and order mails by email.
• Cloudflare, Inc., USA: spam protection for the forms (Cloudflare Turnstile), only once you use a form.
• Google Ireland Limited, Ireland, and Google LLC, USA: Google Workspace (email, calendar, Meet), YouTube only after your click.
• Anthropic Ireland, Limited, Ireland, and Anthropic PBC, USA: the terminal's replies on the home page.
• Stripe and Link (a Stripe service): payment, invoice and taxes in the shop, as independent controllers.
• Dropbox International Unlimited Company, Ireland: delivery of some project videos.
• Vimeo.com, Inc., USA: videos, only after your click.
• Operators of the client websites shown: live view on some project pages.

Beyond this, we only pass on data if you have consented, if it is necessary to perform a contract or if we are legally obliged to. We do not sell data.

17. Transfers to third countries

Some of the providers named are based outside the EU, for example in the USA or Singapore, or may transfer data there. For companies certified under the EU-U.S. Data Privacy Framework, the European Commission has found an adequate level of data protection (Art. 45 GDPR). Where no such decision applies, we agree the EU standard contractual clauses with the provider (Art. 46(2)(c) GDPR). You can obtain a copy of these safeguards on request.

18. Storage period

We only keep personal data for as long as the respective purpose requires or statutory obligations demand:

• Requests, configurations, call-back requests and bookings: 24 months after the last contact or after the appointment. We then delete the data or anonymise it so that it can no longer be linked to a person. If the request led to an engagement, the storage period for clients applies.
• Shop orders and licenses: as long as the license can be used, and beyond that under statutory retention obligations.
• Hashes of IP addresses: 48 hours.
• IP addresses for limiting requests: only briefly in memory.
• Entries in the terminal: not stored.
• Server log files: as long as needed for operation and security (see section 3).
• Browser storage: see section 13.
• Contract and accounting records: six, eight or ten years under commercial and tax retention obligations (§ 257 HGB, § 147 AO).

If you withdraw consent or object to processing, we delete the data concerned unless a legal obligation or another legal basis requires otherwise.

19. Obligation to provide data

You are under no statutory or contractual obligation to provide us with personal data. Without the details marked as required, however, we cannot handle your request, booking or order, and products from the shop cannot be unlocked without activation. Processing the connection data is technically necessary to visit the website.

20. Automated decisions

We do not make solely automated decisions within the meaning of Art. 22 GDPR that produce legal effects for you or similarly significantly affect you. The terminal's replies are generated by an AI; they have no effect for you.

One exception is the license check in the shop: it automatically checks whether a key is valid and on how many devices it is active, and unlocks the product or not accordingly. This is necessary to perform the license contract (Art. 22(2)(a) GDPR). You can ask for a person to review the decision, express your point of view and contest the decision; a message to hello@mad-mirror-studios.com is enough.

21. Your rights

You have the following rights towards us:

• Access (Art. 15 GDPR): you can ask whether and which data we process about you.
• Rectification (Art. 16 GDPR): you can ask us to correct inaccurate data and complete incomplete data.
• Erasure (Art. 17 GDPR): you can ask us to delete your data unless we are obliged to keep it.
• Restriction (Art. 18 GDPR): you can ask us to restrict processing where the legal requirements are met.
• Data portability (Art. 20 GDPR): you can receive data you provided to us in a common machine-readable format or have it transmitted to another controller.
• Withdrawal (Art. 7(3) GDPR): you can withdraw consent at any time with effect for the future; processing up to that point remains lawful.
• Objection (Art. 21 GDPR): see the following notice.

An informal message to hello@mad-mirror-studios.com is enough.

22. Right to lodge a complaint

You can lodge a complaint with any data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information)
Wilhelmstraße 7, 65185 Wiesbaden, Germany
Phone: +49 611 1408 0
Email: poststelle@datenschutz.hessen.de

23. Encryption

We transmit the website and all forms in encrypted form (TLS). You can tell by the address in your browser starting with https.

24. Changes

This privacy policy applies from 21 October 2026 and replaces all earlier versions. We update it when the website, our service providers or the law change. The current version is always available on this page.