Privacy notice

Controller

The controller responsible for processing personal data on this website is HarborBit, which owns the XhaoLab brand:

Visiting the website

When you open the site, our server processes the data your browser sends for technical reasons, in particular your IP address. The log contains only the time, the address requested, the status, the amount of data and the response time; instead of your IP address it holds a check value (hash) whose key changes every 24 hours. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

The website, the contact form and our email mailboxes run on our rented server in Germany; the hosting provider processes data only on our behalf (Art. 28 GDPR). We embed no third-party content such as external fonts, maps, videos or social media buttons; links to other services transmit nothing until you click them. To prevent misuse of the chat and the form, the server counts requests per IP address in memory only; these counters are deleted no later than 61 minutes after the last request.

Storage in your browser

We do not set cookies. In your browser’s storage we keep only what you set yourself: your language (“xhaolab-locale”) – permanently if you choose it in the language menu, otherwise only for this tab if you arrive via a link that specifies a language –, the “Pause motion” setting (“xhaolab-motion-v1”) and your choice in the consent dialog with its date and text version (“xhaolab-consent-v1”); with the comparison switch “?vorschau=0” the tab also remembers the older version of the site until you close it (“xhaolab-alte-fassung”). These entries never leave your browser, and you can delete them at any time by clearing the site data in your browser. No consent is required because they are strictly necessary for the function you asked for (Section 25(2) no. 2 TDDDG; Art. 6(1)(f) GDPR).

Analytics

The consent dialog is prepared for visitor statistics with our own software, SiteDeck. It is currently switched off: even with your consent, nothing is loaded and nothing is collected. Before we switch it on, we will update this notice and ask you again.

AI Concierge (AI chat)

The AI Concierge is an AI system: its replies are generated by a language model, not by a person. When you send a question, our server passes it – with at most eight previous messages from the conversation and the selected language – to OpenRouter, Inc. (New York, USA), which, as our processor, has it answered by Google Cloud (Vertex AI) or Amazon Web Services (Bedrock). We do not pass on your IP address. We only allow operators that do not store inputs after the reply and do not use them for training; we do not store questions or replies either. OpenRouter also assigns inputs anonymously to a topic under its own responsibility to compile its own usage statistics (openrouter.ai/privacy).

Please do not enter personal details – the chat does not need any. The conversation is held only in your browser and is gone when you reload; the chat makes no automated decisions about you (Art. 22 GDPR). The legal basis is our legitimate interest in answering questions about our services immediately and in your language (Art. 6(1)(f) GDPR); this also covers OpenRouter’s anonymous topic assignment, which we cannot switch off.

When you contact us

If you write to us via the contact form, by email or via WhatsApp, we process your details – for the form, your name, email address and message – in order to reply; without them we cannot. The form sends your enquiry as an email to our mailbox on our own mail server in Germany; emails to us stay there and are not passed on to other services. To fend off spam, the mail server checks the address of the delivering server and links in emails against public blocklists. The legal basis is the initiation or performance of a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in replying (Art. 6(1)(f) GDPR).

The phone number above is a link to WhatsApp (WhatsApp Ireland Limited, Dublin). Only when you click it does WhatsApp receive data such as your IP address; if you write to us there, we receive your number, your profile name and your messages. WhatsApp is itself responsible for its own processing (whatsapp.com/legal/privacy-policy-eea). If you prefer not to use it, use the form or send us an email.

Orders and payment

For quotes and orders we process what we need for coordination, delivery, invoicing and record-keeping, including access credentials and content you provide for the project (Art. 6(1)(b) GDPR; for invoices and accounting records, the statutory retention obligations under point (c)).

You pay for the project blueprint on a payment page of Stripe (Stripe Payments Europe, Limited, Dublin, Ireland). There you enter your email address, your business, a short description of your project and your payment details; without them no booking is possible. Stripe processes the payment on our behalf and processes data for its own purposes, such as fraud prevention, as an independent controller (stripe.com/privacy); if you choose PayPal or Link, PayPal or Stripe respectively is responsible for that. We receive your details, the package booked and the payment status – never your full card or account details; our server notifies us of incoming payments by email to our own mailbox. The legal basis is the contract (Art. 6(1)(b) GDPR) or, if you book for a business, our legitimate interest in processing the order (point (f)).

Recipients and transfers outside the EU

Data is received only by the parties named here: our hosting provider in Germany, OpenRouter with the respective model operator (only if you use the chat), Stripe (only for a payment) and WhatsApp (only if you write to us there); beyond that only where an order requires it, for example our tax advisor, or where the law requires it. We do not sell data.

Data reaches the USA only through these services. For the chat, OpenRouter and the model operator may process your input in the USA; OpenRouter is not certified under the EU-US Data Privacy Framework, so we safeguard this with the European Commission’s standard contractual clauses (copy on request). Stripe may transfer data to Stripe, LLC, and WhatsApp to WhatsApp LLC and Meta Platforms, Inc.; these companies are certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023). Authorities in the USA may demand access there. Contact enquiries and emails to us do not leave Germany.

How long we keep data

We delete server logs after 7 days at the latest, and they are not included in any backup; misuse counters are gone after at most 61 minutes, and we do not store chat content at all. If the form cannot deliver an enquiry immediately, it stays on the server until delivery, for at most twelve months. Enquiries that do not lead to an order are deleted no later than twelve months after the last message. For orders, the statutory periods apply: invoices and accounting vouchers 8 years, business letters 6 years, books 10 years (Section 147(3) German Fiscal Code, Section 14b(1) German VAT Act). Backups are overwritten after five weeks at the latest.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). An informal message to info@harborbit.de is enough; we reply within one month.

Your right to object

You may object at any time, on grounds relating to your particular situation, to processing that we base on our legitimate interest (Art. 6(1)(f) GDPR) (Art. 21(1) GDPR). We will then stop processing the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Der Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany.

This version: 17 October 2026. If anything changes, we will update this notice.

Questions about data protection?

Get in touch