Privacy Policy

This Privacy Policy explains how personal data is handled when you visit the XIVU website, contact us, report a security issue or work with us. We built this site to collect as little as possible. The sections below describe, in plain language, each situation in which data is processed, why, on which legal basis, who receives it and how long it is kept.

1. Controller

The controller responsible for data processing on this website is:

Chan Vu Luu, trading as XIVU (sole proprietorship, Einzelunternehmen)
Oberfürberger Straße 16, 90768 Fürth, Germany
Email: contact@xivu.io · Phone: +49 1525 4100697

We have not appointed a Data Protection Officer. For all privacy questions or requests, please use the email address above.

2. Our approach in short

• No ads and no tracking cookies. We use no advertising networks, cross-site trackers or social media pixels. Our hosting chain sets two technically necessary cookies (Section 4).
• No third-party scripts. When a page loads, your browser loads no scripts, fonts or images from third-party servers. Only sending a form contacts our form service (Section 5).
• Self-hosted fonts. Fonts are served from this website; no external font service receives your IP address.
• No analytics. No analytics or visit statistics tool runs on this website, neither ours nor our hosting provider’s.
• No social media plugins. Links to LinkedIn and other sites are plain links (Section 8).

3. Hosting, delivery and server logs

This website is hosted by Lovable (Lovable Labs Sweden AB, Stockholm, Sweden, together with its US affiliate Lovable Labs Incorporated, Boston, USA). Lovable delivers the website through the network of Cloudflare, Inc. (San Francisco, USA), which sits in front of the website to deliver pages quickly and to protect it against attacks and automated abuse. Cloudflare works for Lovable as its sub-processor.

When you open a page, this hosting chain automatically processes technical access data: your IP address, browser type and version (user agent), the page requested, the referring page if your browser sends it, and the date and time of the request. This is necessary to deliver the website and to detect and block attacks.

• Purpose: delivering the website, keeping it stable and secure, defending against abuse.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to provide a working and secure website.
• Retention: we have no access to these logs ourselves. Lovable and Cloudflare keep them only as long as needed for delivery and security.
• Is it required? Yes. Without this data the website cannot be shown to you.
• Role: Lovable processes this data on our behalf as our hosting provider.
• Third countries: Lovable Labs Incorporated and Cloudflare, Inc. are based in the USA, so data may be processed outside the EU/EEA. Lovable bases such transfers on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR) and also uses the EU Standard Contractual Clauses.

4. Cookies

The cookies on this website are set by our hosting chain, not by our own code. There are two, and both are technically necessary to deliver the website:

• __cf_bm, set by Cloudflare for our hosting provider: bot protection. It helps tell real visitors apart from malicious automated traffic. Its content is encrypted, it is specific to this website, it is not used to follow you across other websites, and it expires after 30 minutes of inactivity.
• __dpl, set by Lovable: deployment routing. It sends your browser to the correct published version of the website and expires after about 24 hours.

Because both cookies are strictly necessary to provide the website you asked for, storing and reading them does not require your consent (§ 25(2) No. 2 TDDDG). For the same reason we do not show a cookie banner. Any personal data connected with them is processed on the basis of our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). You can delete or block cookies in your browser settings at any time; parts of the website may then not work as intended.

5. Contact form and project drawer

The website offers a contact form on the /contact page and a short project form in a side drawer that can be opened on every page.

Data you provide. Contact form: name, email address and message (required), and optionally company, budget range and area of interest. Project drawer: name, email address and a short description of your project. Please provide only what is needed for your inquiry, and do not send passwords, access data or details of an unfixed security vulnerability through the forms (see Section 7).

What we store. For each accepted submission we store: your name, your email address, your message (with company, budget and interest added to it if you filled them in), which form you used, a processing status, the time of submission, and a hash value of your email address and message that we use to filter out accidental double submissions.

Information next to the forms. Both forms show a short notice with a link to this Privacy Policy next to the Send button. We do not ask for your consent to send an inquiry, because we process it on the legal bases described below.

Spam protection and abuse prevention. The forms use a hidden honeypot field, a check of how quickly the form was sent, and per-IP rate limiting. To enforce the rate limits we do not store your IP address. Instead we store a salted cryptographic hash of it together with a timestamp. This is a pseudonymised value: it does not show your IP address, but it is still treated as personal data. These records contain no name, email or message and are automatically deleted after 48 hours. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is to protect the forms and our inbox from spam and abuse.

How your submission is processed. When you send a form, it goes to a server function we operate on Supabase in the Frankfurt, Germany region, which checks it and stores it in our database in the same region. The database cannot be read from the public internet; only our server function writes to it. We are then notified by email: the submission is sent from a dedicated sending mailbox (forms@xivu.io) to our inbox through the mail service of Hostinger, our email provider. The notification contains the same data as the stored submission.

Technical logs. Our server function writes operational logs that contain no name, email address or message text, only event types, the form used, error codes and a short fragment of the IP hash. Supabase’s own platform logs may briefly record the IP address of requests to our backend. Supabase keeps these platform logs for 1 day.

Legal basis.

• If you contact us about a possible contract with you personally (for example as a self-employed client), we process your data to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• If you contact us on behalf of a company, or with any other request, we process your data on the basis of our legitimate interest in answering inquiries and communicating with prospective business customers and their contacts (Art. 6(1)(f) GDPR).

Is it required? Providing your data is voluntary and is neither legally nor contractually required. Without at least your name, email address and a message we cannot answer you. If you prefer not to use a form, email us directly at contact@xivu.io (Section 6).

If the form service is not available. If the form service cannot be reached, the form sends nothing and shows our email address instead.

Retention. Submissions in our database are deleted as soon as they are no longer needed and automatically after 12 months at the latest. If our form service is temporarily paused, the scheduled deletion runs as soon as it is active again. The notification email in our inbox is deleted on the same principle: if your inquiry does not lead to a business relationship, we delete it no later than 12 months after our last contact. If a business relationship results, Section 9 applies.

Processors and third countries. Supabase and Hostinger act as our processors under their data processing agreements (Art. 28 GDPR). Our Supabase project is hosted in Frankfurt. Supabase’s contracting entity is Supabase Pte. Ltd., Singapore; access from outside the EU/EEA, for example for support, cannot be ruled out and is covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Our email provider is Hostinger International Ltd., Larnaca, Cyprus (EU). Hostinger uses sub-processors, some of them outside the EU, under the EU Standard Contractual Clauses. You can request a copy of the safeguards by emailing contact@xivu.io.

6. Contact by email or phone

If you email us at contact@xivu.io or call us, we process your email address or phone number, your name, the content of your message and the time of contact, plus any data you choose to share.

• Purpose: answering your request.
• Legal basis: Art. 6(1)(b) GDPR where your request concerns a possible or existing contract with you; otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in answering inquiries and communicating with business contacts.
• Recipient: for emails, Hostinger (our email provider, Section 5) as our processor.
• Retention: as for form inquiries: deleted no later than 12 months after the last contact if no business relationship results; otherwise Section 9 applies.
• Is it required? No, contacting us is voluntary.

7. Reporting a security vulnerability

Our Trust page and our security.txt file (xivu.io/.well-known/security.txt) invite you to report security issues to contact@xivu.io. When you do, we process your name or alias, your email address, the content of your report and our correspondence with you.

• Purpose: confirming, investigating and fixing the issue, and keeping you updated.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the security of our website and services and of the data entrusted to us.
• Crediting you: we name you publicly only if you ask us to and tell us how you want to be named (Art. 6(1)(a) GDPR, consent). You can withdraw this consent at any time with effect for the future, and we will remove the credit.
• Retention: we keep reports until the issue is closed and then for 24 months to document our security work, unless a longer period is needed to document a personal data breach (Art. 33(5) GDPR).

8. Links to other websites

This website contains plain links, for example to our LinkedIn profile and to niu-ju.com. No data is sent to these sites when you load our pages. Only when you click a link does your browser connect to the other site, and that site’s own privacy policy applies.

9. Clients and business partners

If we work together, we process the business contact data of your company’s contact persons (name, business email and phone, role, correspondence) and the data needed for quotes, contracts, invoices and payments.

• Legal basis: Art. 6(1)(b) GDPR where you are our contract partner personally; Art. 6(1)(f) GDPR for contact persons of a client company (our legitimate interest is carrying out the contract with that company); Art. 6(1)(c) GDPR for statutory retention.
• Recipients: our tax adviser, our bank and the providers of software we use for accounting and video calls, each only as far as needed, and authorities where required by law.
• Retention: project correspondence is deleted when no longer needed, subject to statutory retention periods under German tax and commercial law: invoices and other accounting vouchers 8 years, books and annual records 10 years, business letters 6 years, each counted from the end of the calendar year (§ 147 AO, § 14b UStG).

Executive Portrait Program. When a client company sends us employee photos for AI portraits, we process them on behalf of and under the instructions of that company (Art. 28 GDPR). The client company is the controller, and its own privacy notice applies to its employees. We sign a data processing agreement with every client, and the client collects each employee’s documented consent before sending us a photo. In short: photos are stored in the EU (Ireland); the AI image step runs at Google on a global endpoint and can take place outside the EU, mainly in the US, under a data processing agreement and the EU Standard Contractual Clauses; Google does not use the photos to train its models; uploaded photos are deleted 7 days after upload; results are marked as AI-generated. Employees can direct questions to their employer or to us.

10. Recipients at a glance

We do not sell personal data and do not share it for advertising.

11. Your rights

Under the GDPR you have the following rights regarding your personal data:

• Access (Art. 15): confirmation of whether we process your data, and a copy of it.
• Rectification (Art. 16): correction of inaccurate and completion of incomplete data.
• Erasure (Art. 17): deletion where the legal conditions are met.
• Restriction (Art. 18): limiting processing in certain circumstances.
• Notification (Art. 19): we inform recipients of any rectification, erasure or restriction unless this is impossible or disproportionate.
• Data portability (Art. 20): receiving data you provided to us on the basis of a contract or consent in a structured, commonly used, machine-readable format.
• Objection (Art. 21): see the box below.
• Automated decisions (Art. 22): we do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you.
• Withdrawal of consent (Art. 7(3)): where we rely on your consent (Section 7, crediting), you can withdraw it at any time with effect for the future. Processing before the withdrawal stays lawful.

To exercise any of these rights, email contact@xivu.io. We answer within one month (Art. 12(3) GDPR).

12. Your right to object (Art. 21 GDPR)

13. Right to lodge a complaint

If you believe our processing infringes the GDPR, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany

You may also contact the supervisory authority in the EU member state where you live or work, or where the alleged infringement took place.

14. Data security

This website is only available over encrypted HTTPS. Form data is sent encrypted to our backend, checked on the server, and stored in a database that cannot be read from the public internet. Notification emails are sent over an encrypted connection. We collect only what a feature needs and delete it on a fixed schedule.

15. Changes to this policy

We update this Privacy Policy when the website, our providers or the law change. The current version always applies and is identified by the date at the top. Where a change is significant (for example adding analytics, online booking or a new hosting or email provider), we update this policy before the change takes effect.

16. Contact for privacy matters

For any questions about this Privacy Policy, or to exercise your rights, please contact:

Chan Vu Luu, XIVU
Oberfürberger Straße 16, 90768 Fürth, Germany
Email: contact@xivu.io · Phone: +49 1525 4100697