Privacy Policy

1. Controller

We are not required to appoint a Data Protection Officer under Art. 37 GDPR or § 38 BDSG and have not appointed one. Please direct privacy enquiries to the address above.

2. Scope

This policy applies to the company website pi-optimal.com. The product website pi-automate.com has a separate privacy policy. The sites use separate PostHog projects and do not create a cross-site identity.

3. Hosting and server logs

This static website is delivered through Azure Static Web Apps by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Microsoft processes data for us under an Art. 28 GDPR data processing agreement. A request necessarily processes the IP address, time, requested file, referrer, and browser and operating-system version. We use this data to deliver and secure the site under Art. 6(1)(f) GDPR and retain server logs for no longer than 90 days.

Azure Static Web Apps uses a global delivery network. Visitors outside the EEA may be served from a nearer Microsoft region. EU Standard Contractual Clauses under Art. 46 GDPR apply to transfers outside the EEA.

4. PostHog analytics, Core Web Vitals, and session replay

Only with your explicit consent, we use PostHog to understand and improve use and performance of this website. PostHog, Inc. processes the data for us under our Art. 28 GDPR data processing agreement. This website's separate PostHog Cloud EU project is hosted in Frankfurt, Germany. The legal bases are Art. 6(1)(a) GDPR and § 25(1) TDDDG.

The following data categories may be processed:

• random anonymous visitor and session identifiers, timestamps, and pageviews;
• semantic events such as qualified section views, navigation, and contact or product clicks;
• sanitized page path, referring domain, and separate campaign fields such as UTM source, medium, and campaign;
• browser, operating system, device class, language, viewport, and screen size;
• approximate country, continent, and first-level region; and
• numeric Core Web Vitals: First Contentful Paint, Largest Contentful Paint, Cumulative Layout Shift, and Interaction to Next Paint.

We disable autocapture and do not create identified person profiles. Names, email addresses, form data, link text, free text, pointer movement, and canvas content are not sent as event properties. Query strings and URL fragments are removed before sending, referrers are reduced to their origin, and timezone fields are deleted. The IP address is not stored with the event; city, postal code, coordinates, lower-level subdivisions, GeoIP timezone, and accuracy radius are removed during processing. Core Web Vitals contain numeric measurements only; element attribution is disabled.

Session replay also starts only after consent. Every input and all page text are masked. Console logs, request headers, request and response bodies, and captured network payloads are disabled. Analytics events are retained for no longer than 24 months, enforced by replacing and deleting the dedicated project in time. Masked recordings are deleted after 30 days.

Providing this data is voluntary. You can grant or withdraw consent at any time through “Cookie settings”. On withdrawal, analytics and replay stop and PostHog browser storage is removed. Withdrawal does not affect the lawfulness of processing already carried out.

More information: PostHog Trust Center and PostHog Privacy Policy.

5. Cookies and local storage

This site sets no analytics cookies without your consent. To honour your choice, we store only one necessary, versioned decision with a timestamp in your browser for up to 365 days; it is never sent to us. The legal basis is § 25(2) no. 2 TDDDG. If you consent to PostHog, PostHog stores its own cookies and local-storage values to recognize the anonymous session. The legal bases are § 25(1) TDDDG and Art. 6(1)(a) GDPR.

6. Email contact

If you contact us by email, we process your address, the details you provide, message content, and metadata to answer you. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR. General correspondence is retained for no longer than three years unless a statutory period requires longer.

7. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction, portability, and objection, and may withdraw consent. Contact hello@pi-optimal.com to exercise them. You may also complain to the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg: baden-wuerttemberg.datenschutz.de.

8. Children and changes

This company website is not directed to children. We update this notice when processing, law, or our services change. The date above identifies the current version.