Privacy Policy
In short: Beckmann (beckmann.ai) is a statically served website with no ad tracking. For audience measurement we run a self-hosted, cookieless solution that stores no personal data (section 7a). We only use Google Analytics if you explicitly consent via the cookie banner — without consent the site stays cookie-free (section 7b, including the opt-out). Otherwise, data is only processed where technically necessary — and for features you actively use (search, account/MCP hub, newsletter).
1. Controller
2. Hosting & server logs
The website runs on our own server (VPS) at STRATO AG, Pascalstraße 10, 10587 Berlin, Germany — server location Germany. When you access pages (beckmann.ai) or services (api.beckmann.ai, mcp.beckmann.ai), the web server technically processes: IP address, timestamp, requested URL, HTTP status, referrer and user agent (access/error logs). Purpose: delivery, stability, debugging and abuse prevention (e.g. rate limits). Legal basis: Art. 6(1)(f) GDPR. Retention: logs rotate daily and are deleted automatically after 14 days at the latest.
3. Local storage in your browser
The site stores a few settings locally in your browser only (localStorage/sessionStorage): the
color scheme (theme), the language version (lang, detected from your
browser language or switched by you), a sign-in hint and a small profile snapshot (name, avatar
URL) for instant display after login (bmcp-*), plus a short-lived configuration
cache. We also store your cookie-banner decision locally (cookie-consent, with a
timestamp; after 12 months we ask again) so we don't have to ask on every visit. These values
are never transmitted to us and solely serve the
feature you requested (§ 25(2) no. 2 German TDDDG); you can delete them anytime via your
browser settings. We only set tracking cookies with your consent (section 7b); for Clerk's
necessary login cookies see section 5.
4. Blog search & knowledge base (RAG)
Search queries are sent to our own API (api.beckmann.ai). For semantic search the query text — without any name, account or contact data — is transmitted to OpenAI, L.L.C. (USA) to compute an embedding; OpenAI is certified under the EU-US Data Privacy Framework. Results are cached server-side briefly (approx. 60 seconds); IP-based rate limiting protects against abuse. Legal basis: Art. 6(1)(b)/(f) GDPR.
The Graph page loads a precomputed overview file (post titles, connections, coordinates) from api.beckmann.ai — without any input from you and without personal data; the server logs described in section 2 apply.
5. Account & sign-in (Clerk)
You can create an account for the MCP hub (“My MCP Server”). Sign-in is handled by our
processor Clerk, Inc. (USA; certified under the EU-US Data Privacy Framework). Clerk processes
e-mail address, name, profile picture (if any) and IP address, and sets strictly necessary
authentication cookies (e.g. __session, __client_uat) under
beckmann.ai — without signing in, no Clerk scripts are loaded and no cookies are set. On our
server we only store your Clerk user ID and your tool selection. Legal basis: Art. 6(1)(b)
GDPR. Retention: until you delete your account (via “Manage profile” or by e-mail).
6. Personal MCP server (mcp.beckmann.ai)
When you connect an AI client (e.g. Claude, ChatGPT), it receives an access token (valid 30 days) after your sign-in, stored by your client. Our server only processes the individual tool calls (e.g. a query of the knowledge-base search — then as in section 4 incl. the OpenAI embedding) plus technical connection data (section 2). We do not receive the rest of your conversations with the AI client. Legal basis: Art. 6(1)(b) GDPR.
7. Newsletter
For the newsletter we run a self-hosted instance of the open-source software Listmonk on our own server – no data is shared with third-party providers. Sign-up uses double opt-in: we store your email address, the sign-up and confirmation timestamps and your subscription status; sending only starts after confirmation. Every email contains a one-click unsubscribe link; your data is then deleted. Legal basis: Art. 6 (1) (a) GDPR (consent).
7a. Audience measurement (Umami, cookieless)
To measure reach (page views, referrers, coarse device class) we run a self-hosted instance of the open-source software Umami on our own server. Umami sets no cookies, builds no user profiles and stores no personal data; IP addresses are not stored and visitors are only counted as anonymous daily aggregates. We additionally count individual interactions as anonymous events (e.g. clicks on share buttons, browsing post sliders, or newsletter sign-ups) – likewise without any personal reference and without search terms or input content. No data is shared with third parties. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in anonymous audience measurement); no consent is required for this.
7b. Google Analytics 4 (only with consent)
We additionally use Google Analytics 4 — only if you consent via the cookie
banner. Without consent, no Google script is loaded and no cookie is set (Google
Consent Mode v2, default "denied"). Provider: Google Ireland Limited, Gordon House, Barrow
Street, Dublin 4, Ireland. After consent, Google Analytics sets cookies (_ga,
_ga_*, lifetime up to 2 years) and processes pseudonymised usage data (pages
viewed, time on page, coarse location, device class); Google Analytics 4 does not store IP
addresses. Data may be transferred to Google LLC in the USA; Google is certified under the
EU-US Data Privacy Framework. Analytics data is deleted after 14 months at the latest.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) German TDDDG (consent). In the banner you can select categories individually ("Adjust settings"); "Reject all" sits next to "Accept all" with equal prominence. You can withdraw or re-give your consent at any time with effect for the future — via the "Cookie settings" link in the footer of every page or right here; on withdrawal, the Google Analytics cookies are deleted from your browser:
Current status: No decision made yet – Google Analytics is disabled.
8. E-mail contact
If you write to us, we process your details to handle the request (Art. 6(1)(b)/(f) GDPR) and delete them once no longer required, unless retention obligations apply.
9. Recipients & third-country transfers
Service providers: STRATO AG (hosting, Germany), Clerk, Inc. (sign-in, USA), OpenAI, L.L.C. (search embeddings, USA) and — only with your consent — Google Ireland Limited (Google Analytics, Ireland/USA; section 7b). Transfers to the USA rely on the adequacy decision for the EU-US Data Privacy Framework. No data is shared for advertising purposes; there is no automated decision-making within the meaning of Art. 22 GDPR.
10. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). You may also lodge a complaint with a data protection authority — e.g. the State Commissioner for Data Protection of Lower Saxony, Germany. The German version of this policy is authoritative.
11. Version
August 2026. This policy will be updated when features or service providers change.