# Privacy policy This policy explains which personal data JustEvals processes, why, and for how long. JustEvals is a service of Laps Ventures UG (haftungsbeschränkt). ## Who is responsible? Laps Ventures UG (haftungsbeschränkt) Westpreussenstr. 55 81927 München Germany Email: [contact@justevals.com](mailto:contact@justevals.com) ## What happens when I visit the website? Each request reaches our server through Cloudflare. The server and Cloudflare process your IP address, the requested address, the time, the browser identification and the referring page. We need this to deliver the site and to protect it against attacks (Art. 6(1)(f) GDPR). Our web server keeps these access logs for 14 days and then deletes them. The public pages set no cookies and use no analytics or tracking. The fonts are delivered from our own server; your browser does not contact Google or another font provider. ## What happens when I use an account? To run your account we process your name, your email address, a hash of your password (never the password itself), and for each sign-in session a token, the time, your IP address and your browser identification (Art. 6(1)(b) GDPR). A session cookie keeps you signed in for up to 30 days. This cookie is necessary for the service, so we do not ask for consent (§ 25(2) TDDDG). API keys are stored only as hashes. For each key we store when it was last used, to secure access and to detect misuse (Art. 6(1)(b) and (f) GDPR). When we send you an email about your account, for example a link to set your password, we use Resend (Resend, Inc., USA) to deliver it. ## What happens to the eval data I upload? You decide which suites, cases, images and outputs you upload, and what they contain. For this content you (or your company) are usually the controller, and we process it on your behalf to provide the service. Business customers get a data processing agreement according to Art. 28 GDPR on request at [contact@justevals.com](mailto:contact@justevals.com). We do not use your content to train AI models, we do not sell it, and we do not put it into analytics. Your judgments (votes, ratings, notes) are stored with your user account so your team can see who decided what. ## Which service providers do we use? - **Hetzner Online GmbH**, Industriestr. 25, 91710 Gunzenhausen, Germany: server for the application and the database, in a data center in Nuremberg. Hetzner keeps daily backups of the server in the same German data center. - **Cloudflare, Inc.**, 101 Townsend St, San Francisco, CA 94107, USA: routing and protection of the website traffic, and file storage in Cloudflare R2 with the EU jurisdiction setting, so the stored files stay in the EU. Traffic routing can involve Cloudflare systems outside the EU. Cloudflare is certified under the EU-U.S. Data Privacy Framework, and we have a data processing agreement with Cloudflare. - **Resend, Inc.**, USA: delivery of account emails. Transfers to the USA rely on the EU-U.S. Data Privacy Framework or on standard contractual clauses. Each provider gets only the data it needs for its task. ## How long do we keep data? - Access logs: 14 days. - Account data: as long as the account exists. - Eval data: until you delete it or until your account ends. - Database backups: we make a database backup every night and keep each one for 14 days. Hetzner's server backups follow Hetzner's cycle. Data that the law requires us to keep longer stays stored for that period. ## What are my rights? You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To use these rights, write to [contact@justevals.com](mailto:contact@justevals.com). You can also complain to a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.