Privacy policy

The most important points in brief

• You do not need an account. We do not set advertising cookies and do not track you across other websites.
• Your entries stay in your browser until you press “Check” or use the microphone.
• If you check your own text, your description goes to an AI service. This only happens with your explicit consent, because it is health data.
• If you use the microphone, the recording goes to OpenAI and is converted into text there. This only happens with your explicit consent. We do not store the recording, and by its own account OpenAI does not either.
• Our server keeps the result in memory for at most 30 minutes and does not write your text down.
• The example cases are made-up families for trying the tool. Their descriptions are already assigned, so nothing goes to an AI when you try them. That is why they need no consent.

Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Name

Bernhard Götzendorfer

Address

Rittingergasse 15/11, 1210 Wien, Österreich

Email

office@gotzendorfer.at

Further details in the legal notice

What stays in your browser

Your details about the Bescheid (official decision), your description, your answers to follow-up questions and the result are stored by the browser in the session storage of this tab (sessionStorage). That is how “Back” takes you to your details again. When you close the tab, the browser deletes this data. We cannot read it.

This storage is technically necessary for the site to work. It is not used for advertising or for recognising you.

What happens when you check

When you press “Check”, your browser sends the details to our server at Vercel. The server itself calculates the level, the hours and the delivery date according to fixed rules. Only your description and the information on whether a Bescheid exists go to the AI model.

The AI model assigns your words to the rules and quotes the matching passages word for word. It does not calculate and does not decide. We reach the model via the Vercel AI Gateway. Which model reads your text is shown at the input.

The server keeps the result with the quotes in memory for at most 30 minutes, so that follow-up questions can be calculated without a new AI call. A restart of the server deletes it earlier. In addition, the result goes back to your browser with a signature. This signature is valid for 24 hours and is kept only in your tab.

For each AI call, our call log records only the time, the model, a checksum of the request, the duration, the cost and whether it succeeded. It does not contain your text or your IP address. Server error messages never include your text.

Voice input

Voice input is voluntary. When you tap “Dictate (German)”, we first ask for your consent. Then your browser records until you press “Done”, for at most 5 minutes at a time.

The recording goes to our server at Vercel in Frankfurt and from there to OpenAI. OpenAI converts it into text, and the text appears in your description field. The recording is only kept in memory during this process. We write neither the recording nor the text to a log or a database.

By its own account, OpenAI does not store recordings for this conversion and does not use them for training. The OpenAI usage policies apply.

Limits against misuse apply here too: as with checking, we use the checksum of your IP address to count how often a connection records per hour. In addition, we count the number of recordings per day and their length, without any link to you.

OpenAI usage policies

Limits against misuse

Every check of your own text costs us money. That is why we count how often a connection checks per hour. For this, we create a checksum (HMAC-SHA256) from your IP address with a secret key. With IPv6, only the part that identifies your connection counts. We do not store the IP address itself.

The checksum is kept as a counter at Upstash (a Redis database). The counting window lasts one hour. About two hours after your last check, the entry expires by itself.

When you visit the site

Whenever a page is requested, our hosting provider Vercel processes technical data such as IP address, browser and time, in order to deliver the page and protect it against attacks.

To count visits, we use Vercel Web Analytics. It sets no cookies and creates no profile across several pages. We only see combined figures such as pages viewed, country and device type.

In addition, we count three steps: a check was started, a result was shown, the cheat sheet was opened. For this, Vercel receives the name of the step, the time, the address of the open page and technical data of the request such as browser, device and approximate location. Your text, your details, the result and the level are not included. To count visits, Vercel creates a checksum from the request, which expires after 24 hours.

Purposes and legal bases

• Checking your own text: your explicit consent under Art. 9(2)(a) and Art. 6(1)(a) GDPR, because information about care is health data.
• Voice input: your explicit consent under Art. 9(2)(a) and Art. 6(1)(a) GDPR, because your description may contain health data.
• Delivering the site, protection against misuse, counters for the limits and visitor statistics: our legitimate interest under Art. 6(1)(f) GDPR in a secure free service whose costs we can bear.
• Session storage in the browser: strictly necessary for the service you request (§ 165 Abs. 3 Telekommunikationsgesetz 2021, Austrian Telecommunications Act).

Consent and withdrawal

Before checking your own text, we ask you explicitly. Without the tick, your text is not sent. Consent is voluntary. Without it, you can still check the example cases.

Before the first recording with the microphone, we also ask you explicitly. Without your “I agree, record”, the browser records nothing.

You can withdraw your consent at any time with effect for the future: close the tab or send us an email. What happened before the withdrawal is not affected.

Who receives your data

• Vercel Inc., USA: hosting of the site and the server functions, the AI Gateway to the AI model, and Web Analytics. The server functions run in the Frankfurt am Main region.
• Google (Gemini): provider of the AI model that reads your description, reached via the Vercel AI Gateway.
• Upstash Inc., USA: database for the counters of the limits, only with the checksum, never with your text.
• OpenAI, USA: converts recordings from voice input into text, only if you use the microphone.

Transfer to the USA

Vercel, Google, Upstash and OpenAI are companies based in the USA. We base a transfer there on the adequacy decision of the European Commission on the EU-US Data Privacy Framework of 10 July 2023, insofar as the recipient is certified under it, and otherwise on the standard contractual clauses of the European Commission in the contract with the provider.

How long we store data

• Session storage in the browser: until you close the tab.
• Result in the memory of the server: at most 30 minutes.
• Signed result in your tab: valid for 24 hours, deleted with the tab.
• Counter with the checksum of your IP address: expires about two hours after the last check.
• Recording from voice input: not stored by us, and by its own account not by OpenAI either.
• At the AI provider and at Vercel: according to their contract terms.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). To do so, send an email to the address above.

Because you have no account and we store neither names nor IP addresses, we usually cannot link stored data to a person (Art. 11 GDPR). You delete your text in your browser yourself by closing the tab.

No automated decision

Pflegegeld-Prüfer makes no decision about you. It provides an estimate and drafts. You decide whether you take any action. The Pensionsversicherungsträger (pension insurance institution) or the court decides on your Pflegegeld (long-term care allowance).

Complaint

If you believe that we do not process your data correctly, you can lodge a complaint with the Österreichische Datenschutzbehörde (Austrian Data Protection Authority): Barichgasse 40 bis 42, 1030 Wien.

www.dsb.gv.at