Privacy Policy

Astrava UG (haftungsbeschränkt) ("intrvll", "we", "us"), Kleinensee 12, 23569 Lübeck, Germany, operates the website intrvll.com and the customer console at client.intrvll.com. This policy explains what happens to personal data in both places, in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable German law.

The short version: this website collects nothing. There are no cookies, no analytics, no tracking pixels, no embedded fonts loaded from third parties, and no contact form. The only party that records anything when you load this page is the hosting provider, and only at the level any web server must in order to serve a request. The customer console is a different matter and is described separately in section 3.

1. Controller

2. This website (intrvll.com)

2.1 What we collect ourselves

Nothing. This site is a set of static pages. We operate no analytics, set no cookies of our own, use no tracking or advertising technology, run no A/B testing, embed no third-party widgets, and load no fonts, scripts, or images from external services at page load. We do not build profiles of visitors, and we have no visitor database to build one from.

There is deliberately no contact form. If you write to us, you do so from your own mail client to an address published in the imprint, which means the message and your address sit in our mailbox and in your sent folder — see section 4.

2.2 What our hosting provider records

intrvll.com is hosted on Cloudflare Pages, operated by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) and its EU affiliate. To deliver a page to your browser, Cloudflare processes connection data such as your IP address, the requested URL, the time of the request, your browser's user-agent string, and data required to mitigate attacks. This is technically unavoidable for any website: a server cannot answer a request without knowing where to send the response.

This processing happens on Cloudflare's infrastructure under their own terms. We do not receive, query, export, or store these logs, and we have no analytics dashboard fed by them.

Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in delivering and securing the site. Cloudflare acts as our processor under Art. 28 GDPR on the basis of a data processing agreement, and relies on the EU Standard Contractual Clauses together with the EU–US Data Privacy Framework for transfers to the United States. Cloudflare's own privacy policy is available at cloudflare.com/privacypolicy.

2.3 Cookies

This website sets no cookies at all — neither necessary, functional, statistical, nor marketing. That is also why you are not asked for cookie consent when you arrive: there is nothing to consent to. Cloudflare may set a strictly necessary security cookie when its bot-mitigation is triggered; it contains no advertising identifier and is not used by us.

3. The customer console (client.intrvll.com)

The console is the authenticated application where customers manage their services. Unlike this website, it necessarily processes personal data. If you are only reading intrvll.com, none of this applies to you.

• Session cookie. A strictly necessary cookie that keeps you signed in. It holds an opaque session identifier — no personal data is stored in the cookie itself — and it is not used for tracking or analytics. It expires when the session ends.
• IP address and activity log. We record the IP address together with security-relevant actions (sign-in, configuration changes, and similar) so that account holders and we can reconstruct who did what. These entries are retained for one month and then deleted.
• Account and billing data. The details you supply to open an account and be invoiced, retained for as long as the account exists and thereafter for the statutory retention periods described in section 5.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for the session cookie and account data; legitimate interests (Art. 6(1)(f) GDPR) in the security of the platform for the activity log; and legal obligation (Art. 6(1)(c) GDPR) for invoicing records.

4. If you write to us

When you send us an e-mail, we process your address, your name if you give it, and whatever you choose to put in the message, for the purpose of answering you. Correspondence is kept for as long as needed to deal with the matter and to answer follow-up questions. Business correspondence may be subject to the statutory retention periods in section 5.

Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in responding to enquiries, or performance of a contract (Art. 6(1)(b) GDPR) where the message concerns one.

5. Retention

• Website: nothing retained by us.
• Console activity log and IP addresses: one month.
• Session cookie: until the session ends.
• Account data: for the life of the account.
• Invoices and accounting records: ten years, as required by § 147 AO and § 257 HGB. Commercial correspondence: six years.

6. Sharing

We do not sell personal data, and we do not share it for advertising. Data is disclosed only to processors who help us operate the service — currently our hosting provider (Cloudflare, for this website) and, for the console, our payment and infrastructure providers — each under a data processing agreement, and to public authorities where we are legally required to.

7. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15)
• Have inaccurate data corrected (Art. 16)
• Have data erased (Art. 17)
• Restrict processing (Art. 18)
• Receive your data in a portable format (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time, where processing is based on consent (Art. 7(3))

To exercise any of these, write to [email protected]. Because this website holds no visitor data, a request about your visit to intrvll.com will simply be answered to that effect.

You also have the right to lodge a complaint with a supervisory authority. Ours is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

8. Security

The site is served over TLS. Console access is protected by authenticated sessions, and security-relevant actions are logged as described in section 3. Our infrastructure sits in data centres in Germany, Finland and Switzerland on hardware we own.

9. Changes to this policy

If what we process changes, this page changes with it, and the date at the top is updated. We do not notify visitors of changes, because we hold no contact details for anyone who has merely read the website.

10. Contact

Questions about this policy go to [email protected], or by post to Astrava UG (haftungsbeschränkt), Kleinensee 12, 23569 Lübeck, Germany.