Privacy

The essentials, in four sentences

Controller

malziland - learning | training | consulting e.U., owner Christoph Krieger. All contact details are in the legal notice.

Data protection contact: datenschutz@malzi.me

What happens to my photo?

1. Your browser takes the first step. Before anything reaches a server, your browser scales the photo down to a maximum of 1280 pixels and compresses it – normally as a JPEG, on some devices as a PNG. The file name? Not transmitted. GPS coordinates and the capture date? They never reach our servers – your browser reads them, and they are not included with the newly compressed photo. If GPS data is present, your browser asks OpenStreetMap directly for the address and the map – without any detour through us. Our server learns nothing about it.
2. Little goes to our server. Only the compressed image and two camera details: manufacturer and model. No GPS, no capture date, no file name, no original photo.
3. Your photo waits briefly in a queue. So that nobody gets an error when many uploads arrive at once, our server places your compressed image on a server in the EU for the short waiting period. It sits there untouched – as long as it is not its turn, it is neither looked at nor processed. As soon as your photo has been analysed, it is deleted immediately and automatically. Usually that takes only seconds, at peak times a few minutes.
4. Mistral AI analyses the photo. Our server sends the compressed image and the camera metadata to the French AI provider Mistral AI (registered office: Paris, EU). Mistral analyses the image and creates two guessed profiles from it in a single call (modes „normal“ and „Beast“). For the exaggerated Beast variant a second call to the same AI follows, asking for matching advertising categories – no image is sent with it, only the freshly generated, guessed profile details – and for that we use the capable Mistral Large model. We use Mistral's EU regional endpoint: under the contract, the image analysis therefore runs in data centres in the EU or EFTA. For ancillary services Mistral may use temporary sub-processors outside the EU, in which case with GDPR safeguards under Art. 46 (standard contractual clauses). On the paid API tier we use, inputs and outputs are, according to the provider's commitment, not used for training. In addition, Zero Data Retention is activated for our organisation (confirmed by Mistral in writing on 11 August 2026): inputs and outputs are not stored or logged for longer than generating the response technically requires. Mistral still screens requests automatically for illegal content such as child abuse or violence. Mistral only knows the data from the specific request – not your IP address, and no other user data. Facial recognition is not enabled. We last verified and documented these commitments – EU endpoint, Zero Data Retention, no training – directly in the Mistral dashboard on 11 August 2026; we re-check them regularly, at least every six months and before major releases. Further details on request.
5. After that, it is over. The finished profile arrives in your browser. So that your browser can collect it after the queue, it remains on the server for a short while – with no link to any person – and is deleted automatically a few minutes after collection; if a result is never collected, the server clears it after roughly 2 hours at the latest. Once you close the page, nothing is left in the browser.

What does not exist here

The analysis counter stores only counts: the totals per period (day, week, month, year, overall) – each with its date key, so the counter continues correctly when the day changes – and, so that the hourly limit can roll, the timestamps of the analyses from the last 60 minutes. No IP addresses, no image content, no user profiles. The counter serves cost protection and transparent usage statistics.

Our application logs contain only a random request ID, the status and technical processing steps (step name, response length, token counts) – no image content, no profiles, no IP addresses. The server-side request logs of the infrastructure (Google) – the only place where an IP address would arise – are excluded entirely and are not stored in the first place. The remaining program logs, which contain no personal data, delete themselves after 1 day. Entirely anonymous diagnostic data without personal reference (for example error type, duration, a coarse browser and operating system class such as „Safari 17 / iOS“ instead of the full user agent, a screen size class – small, medium, large – instead of the exact resolution, network class and speed, data saver setting, language setting, number of processor cores, memory class, pixel density, a coarse subject class of the image (human, animal or mixed – not the image itself) and the page visited without query parameters – no IP addresses, no images, no file names) is kept for up to 30 days so that rare device faults can be detected and fixed across several workshops. An anonymised error summary without personal data (error message and frequency only) is retained for troubleshooting – a shorter retention is not technically possible.

For the voluntary reality check we record one anonymous entry per rating (which of the AI's assessments you marked as correct or wrong) and aggregate from it how well the AI performed on average — without the photo, without the profile and without any connection to your analysis. These entries carry no identifier and are kept for up to 30 days.

Who is involved?

The legal part

Your photo is processed on the basis of your consent (Art. 6(1)(a) GDPR) – you give it by uploading a photo. No upload, no processing. The abuse protection (rate limiting) relies on our legitimate interest (Art. 6(1)(f) GDPR).

Mistral AI processes the photo data on our behalf as a processor (Art. 28 GDPR). Mistral AI is a French company (SAS) with its registered office in Paris and is directly subject to the GDPR. We use the EU regional endpoint: under the contract, the image analysis therefore runs in data centres in the EU or EFTA. Mistral may not use the data for its own purposes, and on the paid API tier we use, inputs and outputs are, according to the provider's commitment, not used for training. Temporary sub-processors may be used outside the EU, in which case with GDPR safeguards under Art. 46 (for example standard contractual clauses). Mistral provides a list of sub-processors in its Trust Center. Legal basis: Mistral Data Processing Addendum. Contact for Mistral's data protection officer: DPO@mistral.ai.

Google Ireland Limited now provides the infrastructure only: Firebase Hosting for the website, Cloud Functions for the backend processing, Cloud Storage for the brief image buffering in the queue, and Cloud Firestore for the anonymous analysis counter and the queue management. All data processing (Cloud Functions, Cloud Storage, Firestore) runs on EU servers (region europe-west1, Belgium); the static pages of the website – which contain no user data whatsoever – are delivered by Firebase Hosting through a worldwide content delivery network. Google also processes this data as a processor (Art. 28 GDPR) and may not use it for its own purposes. Legal basis: Google Cloud Data Processing Addendum. Important: since May 2026 we no longer use any Google AI services – neither Vertex AI nor Cloud Vision. The AI analysis runs exclusively through Mistral AI in the EU.

The OpenStreetMap Foundation (UK) processes GPS coordinates when resolving an address. The United Kingdom has an adequacy decision from the European Commission.

What we deliberately do not do

• No tracking – no analytics, no Facebook pixel, no Google Tag Manager
• No advertising
• No data trade
• No facial recognition – Mistral recognises that a face is present, but not whose it is. No biometric comparison against databases.
• No external scripts – fonts, maps and EXIF parsing all run locally

Do you have to trust us? No.

With most websites you have no other option. You read what the provider writes about itself – and you have no way of checking whether it is true.

With malziME you can check.

The complete blueprint is open on GitHub: the page you are looking at right now, and the part that performs the analysis. With every release we publish a fingerprint alongside it – for every single file a sequence of digits that changes as soon as even one character inside that file changes.

Anyone can look at it: malzi.me/build-info.json. It lists the date, the published version and the digit sequence of every file.

Checking it yourself takes a minute and needs nothing but a terminal – no prior knowledge, no installation:

git clone https://github.com/malziland/malzime.git
cd malzime
sh scripts/pruefe-live.sh

The program downloads every file from this website, recalculates its digit sequence and compares it with the blueprint. At the end there is one of three results: everything matches, discrepancy found – or measurement problem, if the check itself did not run cleanly. A measurement error is never reported as a passed check.

Why both routes? The button below is convenient, but it runs on this page. Anyone who had full control over this website could also serve a lying verification program. The command-line route, by contrast, starts from a fresh copy of the source code and is independent of this page. Incidentally, the button's verification program is itself part of the open source code and is itself listed in the fingerprint – it checks itself along with everything else.

So that this does not stay an empty gesture, we have tied our own hands: our publishing program refuses to start at all if we had changed something that is not openly visible.

Cookies

malziME sets no tracking cookies. Firebase Hosting may set a technical cookie (__session) to route requests – it contains no personal data.

Workshops

The AI profiles are guesses. Algorithms assert – they prove nothing. This is not automated decision-making within the meaning of Art. 22 GDPR.

Your rights

• Access (Art. 15): what we have stored about you – nothing.
• Erasure (Art. 17): already done – there is nothing to erase.
• Withdrawal of consent (Art. 7(3)): close the page, and that is that.
• Complaint (Art. 77): Austrian data protection authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna (dsb.gv.at)