Scope and responsible person
Assad Dar
Am Brückensteg 33, 41065 Mönchengladbach, Deutschland
E-Mail: hello@assad-dar.de
Telefon: +49 173 8665472
The above provider and contact details are confirmed for the prepared Knowstamp draft. This draft describes the locally developed pilot. Further information on the actual processing, role distribution and, if necessary, a data protection officer must be checked and supplemented before collecting real data.
The current wizard searches for appropriate text passages in shared sources. No external generative model service is activated. This description must be checked again every time the operation is changed.
The lead upload to the source agent uses a limited local sample check in the browser and a new server-side check when saving. Additional test terms and the original text input are not stored as source or in the audit by this process; a document is temporarily processed for extraction in a local work file. Only the explicitly confirmed corrected version is used as a private knowledge source. The audit records owner, source, check rule version and time, no remote text passages. The audit does not recognise all names, companies, secrets or identifiable case combinations and does not confirm complete anonymity or GDPR conformity. Health/patient data are excluded for this process. Existing manual source paths are not subsequently declared as scanned.
Account and use
For accounts, the application processes name, email address, role, salted password hash, the time of registration and the confirmed version of the pilot instructions. Passwords are not stored in plain text in the application database.
A new registration via the current form will additionally save a personal account attachment and note receipt: at that time declared name, email address and role, date, complete confirmed pilot information and privacy information including draft status as well as technical content verification amounts. You can retrieve this own document in the account area and save it as text. It does not confirm an verified identity, effective contract or delivery. No retroactive evidence is invented for older accounts. Processing basis and intended actual use must be examined separately before collecting real data.
Talks with questions, displayed excerpts and references as well as favorites and feedback are stored in the account. Expert profiles, product descriptions, own source texts and release decisions are processed for the respective expert product. Only profile and product details specifically intended for publication may appear publicly.
Experts can retrieve pooled inventory numbers for their own products to account, conversation, question and positive or negative reviews. Own tests are separate from other accounts; other accounts can also be test accounts. This view does not reveal customer names, questions, answers or feedback notes and does not store additional usage events. If the account or conversation is deleted, the numbers may decrease.
For explicitly awarded free pilot entries, product, owner and recipient account identifier, verified product revision, start, expiry, if applicable withdrawal date and a technical binding to the confirmed order are stored. The customer can voluntarily communicate his own identifier to the agreed expert; the award does not trigger any message or payment. Experts see the recipient identifiers used by them, no additional dissolved names or e-mail addresses. Access ends after seven times 24 hours and does not extend automatically.
The legal basis for the processes required for the desired account and pilot use is Art. 6 (1) (b) GDPR. The necessity must be examined per operation; the acceptance of pilot statements is not a general consent to advertising or optional data processing.
Freiwillige Empfehlungsangabe
The recommendation page shows an invitation draft and a registration link to the current application. Only a conscious copy click passes the text to the clipboard. The application does not record recipients, recommending persons, personal codes or click histories and does not send a message.
When registering, you can voluntarily specify, separately from the pilot instructions required, that you have become aware of them by means of a personal recommendation. The confirmed text version is stored in the account; the field remains empty without selection. The administration sees aggregated unchecked accounts according to current role, including possible test accounts. This does not result in advertising or newsletter permits, confirmed recommendations or customers.
In your own account, you can consciously load and remove this information; you cannot reschedule existing accounts there. Local account closure will empty the current field. An active privacy lock will require the existing verification process. The removal will be logged with account, action and time minimal. This will not automatically rewrite frozen information and backups; their storage and removal must be specified separately before real operation. The complete legal review including legal basis, revocation and retention remains part of the open release release release.
Meeting and technical security
For certain unexpected API errors, the application runs a limited total counter for each fixed function area, as well as the first and last time. No account or product identifiers, request texts, URLs, error names or error messages are stored. These technical aggregates are only visible for administration and are part of the local database backups. They are retained via restarts; an automatic reset is not set up. A fixed console message also contains only area, category and success of storage. This does not replace complete monitoring of the application or later host.
The login uses the necessary session cookie ei_session with a maximum runtime of seven days, HttpOnly and SameSite=Lax; Secure is set at configured HTTPS address. A server-side session stores the hash of the token and its expiration time. The process prevents access, but does not delete the database entry at present automatically.
A protected administrative maintenance path can remove expired sessions, request windows and OAuth requests after explicit checking of a limited preview. It does not run automatically. Its operating record contains process identifier, administrative actor, time and deletion numbers, no deleted session tokens or contents. The purpose-related storage of these operating records must be specified before real operation.
The application logs certain account, source and administration actions with identification and time and leads limiting request counters. For necessary protection measures Art. 6 (1) f GDPR with documented balance of interests is provided. Concrete server protocols and storage periods of the later host are not yet specified.
The exception for strictly necessary terminal access pursuant to § 25 para. 2 TDDDG is to be checked for the session cookie on actual use. In the current application code no marketing pixels or external analysis services are provided. Optional terminal accesses are activated only after a necessary effective consent.
Voluntary usage statistics – prepared, by default
The separate statistics settings allow a conscious consent for a short-lived measurement visit. Without this consent no measurement cookie is set. Product access, account use, pilot and newsletter do not depend on it. The previous local default does not charge visits; synthetic test values are not real visitors or customers.
The separate cookie ks_measurement is valid for a maximum of 24 hours, HttpOnly, SameSite=Strict and limited to /api; if HTTPS is configured, Secure is set. The measurement function only stores the hash of a random identifier, information collection, origin class, order, start and expiry time as well as the characteristics of a server-side successful new registration and possibly selected expert role. IP address, browser features, URLs, referrer, name, email addresses, account, product or lead identifiers and content are not stored in this measurement inventory. The assignment of the registration is pseudonymous processing, no anonymity or personal verification.
The separate revocation in the statistics settings removes the assigned measurement visit and its registration features atomic. Only a hash with expiration remains as necessary lock against delayed re-installation until the original expiry; for an unconfirmed own order the lock can be required up to 24 hours after revocation. Revocation remains possible with the disabled collection. Consent and measurement visit do not extend automatically.
Expired measurement records and short revocation locks are cleaned up at the next measurement access or conscious administrative report. No immediate physical deletion is claimed without the ongoing process. Because of the lack of permanent account links, an account deletion does not replace the statistical revocation; an account information cannot reconstruct the measurement visit from the account ID. Ex post assignment is not possible without an own measurement cookie or open order anchor.
The administration only sees separate combined current measurement cohorts and the registration rate of the same valid visits. Several account facilities within a measurement visit count once for this quota. Non-participating use and legacy stock origin remain unknown; this does not result in a quota of all visitors, expert activation or market validation. Before real activation, the concrete consent information and the provided legal basis according to Art. 6 para. 1 letter a GDPR, hosting and proxy protocols, maintenance and fuses including deletion periods are to be examined and released separately. A technical configuration switch does not replace this examination.
Waiting list and business inquiries
The waiting list function stores e-mail address, interest as an expert or customer, time and text version of the request. The status remains unconfirmed at first. A confirmation message must be checked separately and released individually. Personal links are kept encrypted until the claimed dispatch; minimal order data document the local condition. Consent is only obtained by a valid conscious confirmation click. The pilot notice is not a newsletter registration. A provider acceptance does not yet occupy a mailbox delivery.
A later consent for product messages must specify the designated sender, purpose, scope and a simple revocation route. Account use and advertising are separated. For desired concrete requests the appropriate legal basis is documented.
In the internal CRM, required public business information with source link, search date, contact status and permission receipt can be stored. Public findability does not allow any re-use or advertising email. In the case of indirect data collection, the information obligations under Art. 14 GDPR in particular must be checked.
Recipients and data transfers
The tested application stores its data in a local SQLite database. A publicly used hosting provider, location, processor and recipient group are not yet released. An encrypted hard drive or full encryption of stored data is not claimed here.
A Gmail OAuth integration is technically prepared, but disabled and without tokens. A connection in a chat does not transmit Google permissions to the platform. Stripe is only intended for a test integration to be set up separately. For tests only intended test data may be used.
Before an external model, e-mail, analysis or payment service, recipients, roles, necessary contracts and, where applicable, third country transfers are examined and updated. Without an actual check, no EU-only operation or exclusion of any third country transfer is guaranteed.
Vorbereitete E-Mail-Funktion
Only after a separate secure Google release can an administrator synchronize project-related messages of a specified Gmail label. The requested read permission is technically further than a label; the limitation to this label is done in the application. Only messages of already assigned lead addresses are imported.
The local storage of subject, text limited to 4,000 characters, message/thread identifier and a classification proposal is prepared. Such signals are not confirmed interest and not instruction. A detected deregistration signal sets a contact lock defensively; the remaining content does not trigger dispatch or other autonomous actions.
OAuth tokens are stored encrypted after setup with AES-256-GCM. This does not result in any encryption commitment for all mail texts or the entire database. Local messages older than 30 days are currently cleaned up when synced, unless an active internal data protection case holds them. There is no independent running deletion service. Storage of local drafts and necessary shipping documents must be added concretely before activation.
The general CRM dispatch requires documented contact permission, missing contact lock and the explicit release of the specific recipient, subject and text version. Daily limits and duplicate check are prepared. For pilot notice and newsletter a separate individual dispatch with release of the concrete version is implemented. It remains disabled without released configuration and own Gmail connection; external delivery is not proven. Confirmation emails for consumer processes are not connected.
Storage and deletion
You can delete individual conversations, export your account data and use the account deletion offered. In the case of active payment test subscriptions and administrator accounts, a separate processing process applies. This technical restriction does not restrict legal data protection rights.
When a source is withdrawn, new answers are blocked; stored wizard responses with this source identifier are replaced. Deactivation is not yet complete deletion from source inventory, search index or backup copies. The final source deletion and handling of backups must be checked separately.
The technical account data export receives its own questions and conversation data. Saved assistant texts and source extracts are replaced by a note if no current product access or invalid source release is available. A temporary withdrawal of access does not delete these stored answers automatically. This technical export does not replace the processing of legal data subject requests to be checked separately.
Own received and granted pilot releases appear minimized in the account data export without foreign recipient or owner account identifiers. Expiration or revocation do not delete the award receipt automatically. A pure usage adjustment receives pilot rights like other access anchors; the targeted local account closure removes affected releases after current examination and quantity confirmation. Purposes and retention periods must be specified before real operation.
The personal account attachment and note receipt is contained in the own data export and in the local account information channels provided for it. It is only used for redaction the data. If self-deleted or targeted local account closure is released, it is removed with the associated personal data; active data protection cases can block this removal during the examination. No additional flat-rate retention period is claimed for this document. Backup copies and already created information copies must be processed separately.
Before external use, data categories, purpose, erasure times, security periods and possible statutory retention obligations must be defined and technically implemented. The current code does not have a complete automatic erasure plan. No already functioning flat-rate erasure after an invented deadline is promised.
Internal data protection cases hold selected local data back during the check before normal maintenance and store a limited personal copy for this. Information drafts and individual deletion steps require documented identity, assignment and scope checks. Own account use can be cleaned separately from subscriptions and expert works; this is not a complete account closure. A downloaded draft is not yet a transmitted or complete information.
If a waiting list reservation, mail copy or declaration is deleted, a hated dedicated identifier will remain for new unconfirmed entry, reimport or repetition. Case copies will be removed at the documented completion; minimal case and operation proofs will remain. For selected lead profiles and linked documents, mail copies, draft and identity content, a specifically released local editorship will be implemented. Required lock and operation anchors as well as unselected data will remain unchanged. Further data classes, concrete purposes and deadlines, actual secure transfer and provider and backup processes must be specified and completed separately before real requests are made.
The local cancellation test stores name, confirmation address, contract name, type of termination, if necessary reason, desired time, as well as receipt and processing note. An e-mail entered does not prove any account affiliation. Inputs are not automatically assigned to an account or removed when it is deleted. Before real inputs, legal basis, storage and secure information/disclosure must be specified separately. For repetitions after connection errors, the browser keeps the submitted version tablocal until the receipt download is triggered; when closing the tab, this local restoration is omitted.
The separate local revocation test stores the name, confirmation address and contract name as well as the scope of the revocation; only in the case of a partial revocation is the description of this part added. Proof, editing note and unconfirmed identity are treated according to the same principles as in the termination test. For an expressly triggered repetition, it uses its own tab-local memory, which is retained until the start of the receipt download.
Your Rights
In accordance with the GDPR, there are in particular rights to information, correction, deletion, restriction and data portability. When processing on the basis of legitimate interests, you can object to your particular situation; you can object to direct advertising at any time. Consent can be revoked with effect for the future.
You can complain to a data protection supervisory authority. The competent authority appropriate to the actual operation must be completed before public operation. For data protection requests the above mentioned contact details are provided; the actual processing must be ensured organizationally. Requests are processed immediately and within one month; legal requirements for an extension must be examined separately.
The pilot does not make automated decisions about you alone with legal or comparable significant effect. Please do not enter health data, access data or confidential information from third parties in demonstrations.
Originality declarations and local AI-text screening
Before publication, contributors declare original substantive expertise, disclose AI assistance and provide a private provenance statement. The application stores the declaration, source digest and version, detector and policy identifiers, result, score and check time. These records support the source review and publication gate; they do not prove authorship.
A local detector processes the source text on the application server using pre-downloaded model files. Source text is not sent to an external detection API or used to train detection models. A score strictly above 50%, or a missing, failed, stale or unassessable check, blocks publication. The score is a statistical suspicion signal and does not measure the fraction of AI-written words.
Screening records and provenance statements are private, accessible to the source owner and authorised publication reviewers. They are included in the owner’s account download and removed with the source. Changes invalidate earlier checks. Local processing does not replace the outstanding legal, hosting, retention, backup and privacy review of the actual operation.