Privacy policy
Terms of Action works without user accounts, advertising trackers or analytics services. Fonts and scripts are served by this website. The controller is the operator named above. You can contact us at the email address above about privacy matters.
Visiting the website
To deliver the website, our server processes your IP address and the technical information sent with your HTTP request. We use a hosting provider in Germany, with a server located in Germany. Processing serves our legitimate interest in providing a reliable and secure website (Article 6(1)(f) GDPR). The application does not attach visitor IP addresses to contributions.
Language, time zone and cookies
The page language is selected from your browser's language preferences or the language in the URL. JavaScript reads your browser's time zone and sends it to our server so that the instruction and contribution form follow your local calendar day. These values are used to provide those functions, not to create visitor profiles. We do not set cookies or use local storage for tracking. The legal basis is our legitimate interest in providing these language and daily functions (Article 6(1)(f) GDPR); access to the time zone serves the requested local-day function under section 25(2)(2) TDDDG.
Protection against spam
When you submit a contribution, the server temporarily derives a keyed check value from your IP address to limit repeated submissions. The value and its key are held only in memory and expire within 15 minutes. They are not stored with the contribution. The legal basis is our legitimate interest in protecting the service from abuse (Article 6(1)(f) GDPR).
Submitting a contribution
Submitting a contribution is voluntary. Please do not include names, contact details or other information that could identify you or someone else. We temporarily store the submitted text, its day, a random identifier, a content hash, a hashed status token, and processing timestamps to review it. The review combines local rules and automated checks by OpenAI. It decides whether the contribution is published. This is content moderation, not a decision producing legal or similarly significant effects under Article 22 GDPR. The legal basis for reviewing and protecting the collection is Article 6(1)(f) GDPR.
Automated review with OpenAI
Texts that pass the local checks may be sent to OpenAI Ireland Limited, a processor, through the Moderations and Responses APIs. We send the contribution text and review instructions, not your IP address, time zone or status token. Zero Data Retention (ZDR) is enabled for the API project used for this review. Content retention follows OpenAI's ZDR conditions for the supported services; necessary technical usage and billing data are separate. OpenAI does not use API content for model training by default.
OpenAI may process data outside the European Economic Area. Its Data Processing Addendum provides safeguards for these transfers, including EU Standard Contractual Clauses or an applicable adequacy decision. The provider's conditions and data controls are available here:
Publication and retention
Approved contributions are publicly readable, including in the daily archive and by search engines. They are intended to be anonymous: we keep no author account or link to an IP address. Truly anonymous contributions may remain in the archive permanently. When a submission is rejected, its original text and content hash are removed from the active database. This also applies when an expired review is processed. Text-free technical status records remain for status queries and submission limits. While a review is pending, its text remains in the review queue.
Backups can contain earlier data. When a backup is restored, the rejection cleanup must be applied again before the service resumes. Backups that are no longer needed must be deleted. If a published contribution nevertheless identifies a person, please contact us so that we can review it and, where required, remove the personal data.
Contact by email
If you email us, we process your email address and the information you provide to answer your request. The legal basis is our legitimate interest in handling enquiries (Article 6(1)(f) GDPR), or Article 6(1)(b) GDPR for contractual enquiries. We keep the correspondence until the matter is resolved and any applicable legal retention obligations have ended.
Your rights
Where we process personal data, you have rights to access, rectification, erasure, restriction of processing and, where applicable, data portability. You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. Contact the operator above to exercise your rights. Under Article 11 GDPR we do not collect additional identity data solely to identify the authors of anonymous contributions. If you provide information that makes a personal connection identifiable, we will assess your request on that basis.
You may lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work or where you believe a violation occurred. The authority responsible for the operator in Bremen is:
The Bremen State Commissioner for Data Protection and Freedom of Information