Legal

1. Who is responsible

The controller under the GDPR is skycraft GmbH, Leibnizstraße 5, 01187 Dresden, Germany, represented by its managing director, Dr. David Urbansky. Write to [email protected] with any privacy question.

2. Visiting this website

The website is served by Cloudflare. To deliver pages and protect them from attacks, Cloudflare processes your IP address and technical request data (legal basis: our legitimate interest, Art. 6(1)(f) GDPR). Fonts are served from our own domain; no Google Fonts are loaded.

We count visits with Plausible Analytics, which works without cookies and stores no personal data. It only gives us totals, such as visits per page and referring sites (Art. 6(1)(f) GDPR). Plausible is hosted in the EU.

3. The homepage demo and the Answer Lab

Questions you type into the demo are sent to the WebKnox API to answer them, which passes parts of them on as described under “API requests”. We do not store their text. Cloudflare Turnstile checks that a person, not a bot, is asking; for this it processes your IP address and technical data about your browser (Art. 6(1)(f) GDPR).

4. Your account

Sign-up and sign-in are handled by Clerk (Clerk, Inc., USA). We process your email address, your name if you give it, and, if you sign in with a social account, the basic profile data that provider passes on. We store your plan, your token balance, daily usage totals and your API keys, of which we keep only a hash (Art. 6(1)(b) GDPR: performing the contract).

The console sets Clerk's session cookies, which are needed to keep you signed in. We set no other cookies, so there is no cookie banner.

5. API requests

When your app calls the API, we process the conversation it sends in order to answer. We do not store the text of messages. An answer is kept only if you ask for a hosted embed or image, and only until the expiry time the response names (30 days); it is deleted within a day after that. It is stored with Cloudflare in the EU, Cloudflare's browser service renders the image from it, and anyone with its embed or image address can view it until then.

To answer, our servers pass parts of a question to the services that hold the answer; in these lookups they see neither your users' IP addresses nor your key. To understand a question and pick a card, its recent messages go to OpenAI, which also writes translations, definitions and comparisons. Search terms go to YouTube (Google) for videos and music, to radio-browser.info for radio stations and to Wikimedia (Wikipedia and Wikimedia Commons) for images, comparisons and “on this day”. Place names go to Open-Meteo to find a place, and its coordinates, or those your app sends, to MET Norway (the Norwegian Meteorological Institute) for the weather; food names go to USDA FoodData Central. Maths, conversions, clocks, dice, countdowns and timers that we recognise directly (asked in English or German) do not leave our servers (Art. 6(1)(b) and (f) GDPR). When a user plays a video or audio from an answer, their browser loads it from YouTube (youtube-nocookie.com) or from the audio's own server, which then sees their IP address.

For billing, support and abuse prevention we keep a request log with time, key, card type, result, tokens used and response time, but never message text. Log entries are deleted after 90 days; daily usage totals are kept as long as your account exists (Art. 6(1)(b) and (f) GDPR). To stop key guessing, the API counts requests with unknown keys per IP address in memory and forgets the address within two minutes (Art. 6(1)(f) GDPR).

For the data of your own users that your app sends us, you are the controller and we process it on your behalf. Send only what a question needs. We provide a data processing agreement on request.

6. Payments

Payments are processed by Stripe (Stripe Payments Europe Ltd., Ireland). Stripe receives your payment details, billing address and, if you give one, your VAT ID; we never see your full card number. We keep invoices and payment records for as long as German tax and commercial law requires (Art. 6(1)(b) and (c) GDPR).

7. Email

We send account and billing emails through SendGrid (Twilio Inc., USA). Messages you write through the contact page go to the WebKnox API, which sends them through SendGrid to [email protected]; Cloudflare Turnstile checks the form as described above. To limit how many messages can come from one IP address, the API keeps your IP address in memory for about an hour. Messages to [email protected] are forwarded by Cloudflare to our mailbox, which is hosted by Google. We use them only to answer you and delete them when they are no longer needed (Art. 6(1)(b) and (f) GDPR).

8. Hosting and images

The API and its database run on servers of Hetzner Online GmbH in Germany. Requests to the API, and to hosted embeds and images, pass through Cloudflare, which processes the IP address and technical request data to deliver and protect them; the embed service's request log is kept for up to 7 days. The web servers in front of the API keep an access log with the IP address, time, requested address, browser identification and referring page for about 15 days, to investigate faults and attacks; only administrators can read it, and it holds no message text (Art. 6(1)(f) GDPR).

Images in answers load through WebKnox's own media addresses, so your users' browsers do not contact the image sources directly.

9. Transfers outside the EU

Clerk, Cloudflare, SendGrid, Stripe, Google (also for YouTube) and OpenAI may process data in the USA. These transfers rely on the EU-US Data Privacy Framework or on the EU Standard Contractual Clauses. The Wikimedia Foundation and USDA FoodData Central, both in the USA, receive only the search terms a question needs.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on our legitimate interest. You can delete your account, with its keys, usage and logs, in the console at any time.

You may also complain to a supervisory authority, for example the Saxon Data Protection and Transparency Commissioner (Die Sächsische Datenschutz- und Transparenzbeauftragte) in Dresden.

11. Changes

We update this policy when the Service changes. The date at the top shows the current version. The German version is legally binding; the English version is provided for convenience.