Privacy policy

This is a translation for convenience. The German version (Datenschutzerklärung) is the legally binding one.

In short: this website uses no cookies and loads nothing from third parties. Visitor numbers are measured without cookies and only as anonymous aggregate statistics. The hosted connector keeps no accounts, receives no chat history and does not log requests.

1. Controller

The controller for data processing on this website and for the hosted connector within the meaning of the General Data Protection Regulation (GDPR) is:

Til Francis Taubert
Mittelweg 1
98617 Meiningen OT Walldorf
Germany
Email: til.taubert@studio-sera.de

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Visiting this website (hosting on Vercel)

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA and delivered through its global edge network, usually from a location near you.

When you visit the website, Vercel automatically processes data your browser sends that is technically required to deliver and secure the site, in particular your IP address, date and time of access, the page requested, the amount of data transferred, the referrer and browser and operating system information (server log files). Vercel processes this data on my behalf as a processor under a contract pursuant to Art. 28 GDPR (Data Processing Addendum). For audience measurement see section 4.

Legal basis is Art. 6(1)(f) GDPR. My legitimate interest is providing the website securely, quickly and reliably.

Transfers to third countries: Data may be transferred to the USA. Vercel Inc. is certified under the EU-US Data Privacy Framework; transfers rely on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). More information: Vercel Privacy Policy.

3. No cookies, no external content

This website uses no cookies, no marketing tools, no social media plugins and no embedded videos. Fonts and images are loaded from the same server as the website itself; nothing is loaded from Google Fonts or other third parties.

4. Audience measurement with Vercel Web Analytics

To understand how many people visit the website and which pages they view, I use Vercel Web Analytics, a service of the hosting provider Vercel Inc. named above. It works without cookies and stores no identifiers on your device.

For each page view the following is recorded: time, page viewed, referrer (the page you came from), approximate location (country, region, city), operating system, browser and device type. To group several page views of one visit, Vercel derives a hash from the incoming request; it is discarded after 24 hours. IP addresses are not stored for the statistics. I only see aggregated figures and cannot identify individual visitors.

Legal basis is Art. 6(1)(f) GDPR. My legitimate interest is measuring the project's reach and improving the website. Vercel acts as a processor for this (see section 2, including third-country transfers).

Objection: If your browser sends a Do Not Track or Global Privacy Control signal, the measurement is not loaded at all. You can also switch it off for this browser here; this only stores the entry "analytics-optout" in your browser's local storage.

Audience measurement in this browser: active
Disable

5. Language selection

On your first visit the website reads the language set in your browser to show you the German or English version. This happens only inside your browser; the information is neither transmitted nor stored.

If you actively switch the language, the website stores your choice ("de" or "en") in your browser's local storage (localStorage) so it is kept on your next visit. This entry never leaves your device and is not sent to me. Storing it is strictly necessary for the service you explicitly requested (§ 25 (2) no. 2 TDDDG); the legal basis for processing is Art. 6(1)(f) GDPR. You can delete the entry at any time by clearing this site's data in your browser.

6. Hosted connector (remote MCP server)

If you add easa-regs as a connector in Claude or another AI application (MCP client), the application calls the easa-regs tools when needed. The following is sent to the server:

• the content of the tool call, i.e. the search query or rule reference the AI derives from your question (e.g. "SEP revalidation" or "FCL.740.A") and optional filters;
• technical connection data, in particular the IP address of the calling system and the time of the request.

With Claude.ai and the Claude apps, calls are usually made from Anthropic's servers, so the server normally does not see your own IP address. With locally running applications (e.g. Claude Code, Cursor) the request is sent directly from your device.

The server answers the request from the public EASA rule index and then forgets it. It is stateless, creates no user accounts, receives no chat history and logs neither requests nor IP addresses. Still, please avoid putting unnecessary personal data into questions answered via the connector, as the AI may pass parts of your question on as a search term.

Hosting: Like this website, the server runs at Vercel Inc. (see section 2), in the Frankfurt am Main data centre region. Vercel processes the connection data as a processor under a contract pursuant to Art. 28 GDPR (Data Processing Addendum) and keeps technical request logs (e.g. time, IP address, path, status code) only briefly for operation and troubleshooting. Vercel Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

Anonymous usage statistics: To see how much the connector is used, the server only counts daily totals: the number of requests, which tools were used, which program connected (the program's own name, e.g. "claude-ai" or "cursor") and which rules were retrieved (e.g. "FCL.740.A"). Search terms, IP addresses or anything else that could identify a person are not stored. The daily counters are kept at Upstash, Inc. (Frankfurt am Main data centre) and deleted after at most 400 days.

Legal basis is Art. 6(1)(f) GDPR. My legitimate interest is delivering the rule texts you requested and operating the service securely.

The provider of the AI application itself (e.g. Anthropic for Claude) is solely responsible for how it processes your conversations, under its own privacy policy; for Anthropic, see the Anthropic Privacy Policy.

7. Claude Desktop extension and local installation

The Claude Desktop extension and the local installation run entirely on your computer; your queries are not sent to easa-regs. On first start and at most once a week afterwards, the program downloads the public rule index from GitHub. GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA technically receives your IP address and the usual connection data. The legal basis is Art. 6(1)(f) GDPR (keeping the rule texts current). GitHub, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). More information: GitHub General Privacy Statement.

8. GitHub repository and downloads

Source code, releases and the extension file are provided on GitHub. If you follow links to GitHub or download files there, GitHub, Inc. processes your data as an independent controller under the GitHub privacy statement linked in section 7.

9. Links to other websites

This website links to external sites, e.g. GitHub, EASA, Anthropic, Cursor, arXiv and Stanford University. They are only loaded when you click a link; from then on the respective provider's privacy policy applies.

10. Contact by email

If you email me, I process your email address, your name (if given) and the content of your message to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract or pre-contractual steps, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). I delete the data once your enquiry has been fully dealt with, unless statutory retention obligations apply. Emails are stored with my email provider, acting as a processor.

11. Retention

I store personal data only as long as necessary for the respective purpose or as required by statutory retention periods. The connector server stores no individual requests, only anonymous daily counters (see section 6). Vercel Web Analytics statistics contain only aggregated figures without personal reference; the hash used to group a visit is discarded after 24 hours. Hosting providers delete their server log files automatically according to their own retention periods.

12. Your rights

You have the following rights regarding personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement.

13. Further information

You are under no statutory or contractual obligation to provide personal data. Without the technically necessary connection data, however, the website or connector cannot be delivered. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

I update this privacy policy when the website, the connector or the law changes. The version published here applies.

Last updated: 30 September 2026