Privacy policy
Pursuant to the GDPR & Legislative Decree 196/2003 · As of October 2026
§ 1Data controller
HenselX · Marc Hensel
Contrada Aria delle Donne 39 · 87041 Acri (CS) · Italy
ciao@votano.de · +39 324 2511 984
§ 2Legal basis for processing
Processing is based on the GDPR & Legislative Decree 196/2003:
- Art. 6(1)(a) GDPR – Consent
- Art. 6(1)(b) GDPR – Performance of a contract
- Art. 6(1)(c) GDPR – Legal obligation
- Art. 6(1)(f) GDPR – Legitimate interest
§ 3Hosting and technical infrastructure
Votano is operated in the EU:
- Server: Aruba S.p.A., Italy (processor under Art. 28 GDPR)
- Network access: IONOS SE, Germany – forwards connections to the server through a tunnel, processing IP addresses in particular (processor under Art. 28 GDPR)
- Database & backend: PocketBase, self-operated on this server
- Email delivery: our own mail server – no external email service provider
- Fonts and images are served from our own server – no content delivery networks, no tracking or analytics services
Data is transferred to countries outside the EU only for the optional AI features (see 4.6).
§ 4Collection and processing of personal data
4.1When you visit our website
Server logs record: IP address, date/time, requested address, status code and browser identifier – for troubleshooting and abuse prevention.
Legal basis: Art. 6(1)(f) GDPR · Deletion: 5 days
4.2Registration and user account
We collect: name, email address, organisation, use case (teaching, training or business) and language. You choose your password only when confirming your email address; we store it as a hash only. We send you an email to confirm your address.
Unconfirmed accounts are deleted automatically after 7 days. To prevent abuse, we limit requests per IP address (Art. 6(1)(f) GDPR).
Legal basis: Art. 6(1)(b) GDPR · Deletion: on request via the contact form or by email, at the latest when the account is terminated
4.3Presentations and content
We store the decks, slides, categories and settings you create in your account in order to provide the service.
Legal basis: Art. 6(1)(b) GDPR · Deletion: when you delete the content or your account is terminated
4.4Taking part in votes
Participants need no account and give no name. So that each device votes only once per question, we set a technically necessary cookie (pulse_pt) containing a random identifier; only its hash is stored. Votes and answers are stored together with the presentation.
Please do not enter personal data in free-text answers. The presenting person or organisation is responsible for the content of a presentation and the answers collected in it; we process this data on their behalf (Art. 28 GDPR).
Legal basis: Art. 6(1)(f) GDPR (running the vote)
4.5Contact form
We collect: name, email address and your message – solely to answer your request.
Legal basis: Art. 6(1)(b) or (f) GDPR · Deletion: once your request has been handled, unless a retention obligation applies
4.6Optional AI features
AI analysis: if a presenter stores their own OpenRouter key (OpenRouter, Inc., USA) and starts the analysis, we send the free-text answers of that slide to OpenRouter and the language model selected there, in order to group them into themes. This involves a transfer of data to the USA. No data is sent to OpenRouter without this explicit action. We store the key encrypted.
Claude connector: if you connect Claude (Anthropic) to your account via the Votano connector, Anthropic processes the content you create or retrieve in Claude under your own agreement with Anthropic.
Legal basis: Art. 6(1)(b) GDPR (feature triggered by the account holder)
4.7Cookies and local storage
We do not use tracking or advertising cookies. Technically necessary are the participation cookie (see 4.4) and, for signed-in users, the sign-in state and preferences such as language and appearance, which are kept in your browser’s local storage.
Legal basis: Art. 6(1)(f) GDPR (technically necessary storage)
4.8Pilot programme
If you sign up through our pilot page, in addition to your account data (see 4.2) we store your participation in the pilot and – if you provide it – the address of your LinkedIn profile. Both are visible only to the Votano team. After 60 days we send you a questionnaire by email once; answering it is voluntary.
Legal basis: Art. 6(1)(a) GDPR (your consent when signing up, revocable at any time) · Deletion: on request or when the account ends
§ 5Your rights under the GDPR
- Access (Art. 15)
- Rectification (Art. 16)
- Erasure (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Objection (Art. 21)
- Withdrawal of consent (Art. 7(3))
Requests to: ciao@votano.de
§ 6Right to lodge a complaint
Competent supervisory authority in Italy:
Garante per la Protezione dei Dati Personali
www.garanteprivacy.it
§ 7Data security
- SSL/TLS encryption (HTTPS) on all pages
- Passwords stored as hashes only, AI keys encrypted
- Server and database in Italy (EU)
- No tracking or analytics services