Datenschutzerklärung

Privacy Policy

Last updated 14 September 2026 · Information pursuant to Art. 13 and 14 GDPR

The short version: this site sets no cookies, loads nothing from third parties, and carries no tracking pixels. The one thing that is measured is the interactive demo at demo.virellstudio.com: no cookie, no IP address, nothing written to your device, nothing shared with anyone. If you reached the demo through a link in an email I sent you, that link tells me the visit was yours — that one case aside, a visit is not connected to a person (section 5). Beyond that, the only personal data involved is what your browser must send to load a page, and whatever you choose to tell me.

1. Who is responsible

The controller for the processing described here, within the meaning of Art. 4(7) GDPR, is:

No data protection officer has been appointed. The statutory thresholds in § 38 BDSG are not met — this is a one-person business.

2. What this policy covers

This policy applies to this website and to the interactive demo at demo.virellstudio.com — both the sixty-second tour and a personalised demo I may send you a private link to. It does not cover the AI lead-response service itself, which runs inside a client's own email and calendar systems. Where Virell processes data on a client's behalf as part of that service, it does so as a processor under Art. 28 GDPR, governed by a separate data processing agreement with that client.

3. Server log data

Every time a page is loaded, the hosting provider automatically records technical data that your browser transmits:

• your IP address
• the date and time of the request
• the page or file requested
• the referring page, if any
• your browser type, version and operating system

Purpose

Delivering the site, keeping it stable, and detecting and defending against abuse.

Legal basis

Art. 6(1)(f) GDPR. The legitimate interest is operating a functioning and secure website — a site cannot be served at all without processing an IP address.

Retention

Log data is held for a short period by the hosting provider for operational and security purposes and is then deleted or aggregated. It is not combined with any other data and is not used to build a profile of you.

4. Hosting

This site is hosted by Netlify, Inc., San Francisco, California, USA, which processes the log data described above on my instructions as a processor under Art. 28 GDPR.

This involves a transfer of personal data to the United States. The transfer is safeguarded by the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR, together with the provider's certification under the EU–US Data Privacy Framework (Art. 45 GDPR). Despite these safeguards, US authorities may in principle be able to access data held there, and enforcing your rights against a US recipient may be harder than against an EU one.

5. Cookies, tracking, and how the demo is measured

This site sets no cookies. There is no tag manager, no advertising pixel, no fingerprinting, and no embedded third-party content that could observe you. Nothing is written to or read from your device beyond what your browser does on its own to display a page.

The demo

The demo at demo.virellstudio.com/tour is a sixty-second walkthrough. To learn whether it works — where people stop watching, which of the three lines they pick for the buyer — the page sends a few events to my own server while you watch:

• a random visit number, made up by the page and held in memory only — it is forgotten the moment you close or reload the tab, so two visits can never be joined
• which scene of the tour was reached, and how many seconds after opening
• which line you picked for the buyer, and whether you clicked the button at the end
• whether the screen was phone-sized or desktop-sized, and the host name of the site that linked you here, if any
• only if you arrived through a link in an email I sent you: a reference that link carried, which tells me the visit was yours. It is a random identifier from my own system — not your name, address or anything readable — and I hold the list that connects it back to you. The page reads it from the web address, removes it from the address bar immediately, and never writes it to your device; reloading the page loses it. Nobody who did not receive one of my emails has one.

What is not recorded: your IP address (the server does not look at it), your browser or device details, your location, and anything typed into a form. No cookie is set and nothing is stored on or read from your device, so no consent under § 25 TDDDG is required and there is no banner. The data is not shared with anyone and no third-party analytics service is involved.

Purpose

Seeing whether the demo is understood and improving it.

Legal basis

Art. 6(1)(f) GDPR — my legitimate interest in knowing whether a page I built works, and, where the visit came from an email I sent, whether the person I wrote to found it useful. Pursued in the least intrusive way I could find. You can object at any time (section 9): for an ordinary visit there is no identifier in the record to trace back to you, and for a visit that came from one of my emails I will delete the record on request.

Storage and retention

Stored with the hosting provider named in section 4, in a store that only this demo writes to. Visit records are deleted automatically after 90 days.

6. Getting in touch

The message form

If you use the form at the bottom of the home page, you send me three things: your name, your email address, and your message. Nothing else is collected — there is no hidden field capturing your IP, your location, your browser, or which pages you looked at before writing.

The form does not use reCAPTCHA or any similar service. Spam is filtered with a hidden field that only automated submissions fill in, so no data about you is sent anywhere for a check. Your message is passed to my inbox by Resend (Plus Five Five, Inc., 2261 Market Street, San Francisco, CA 94114, USA), acting as a processor under Art. 28 GDPR, with the US transfer safeguarded as described in section 4.

The trial form

At the end of the demo you can ask for a free 14-day trial. The form asks for your name, your email address, where your leads come from and who your broker is; the line you picked for the buyer during the demo is sent along with it, because it tells me what to prepare for the setup call. Nothing else is collected. Like the message form, it uses a hidden honeypot field rather than a spam service, and it is passed to my inbox by Resend (see above) — not by the hosting provider's form service. Legal basis is Art. 6(1)(b) GDPR (steps prior to entering a contract). If a trial follows, the terms said out loud on the form apply; if it doesn't, the message is deleted once the exchange is over.

Email

If you email me directly instead, I receive whatever you send: your email address, your name if you give it, and the content of your message. Email runs on Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), acting as a processor under Art. 28 GDPR.

Purpose

Answering you, and if it leads somewhere, discussing and carrying out work together.

Legal basis

Art. 6(1)(b) GDPR where the exchange concerns a contract or steps taken before entering one, otherwise Art. 6(1)(f) GDPR — my legitimate interest in responding to the people who write to me.

Retention

Correspondence is kept while the matter is live and for as long as it may be needed afterwards. Where commercial or tax retention duties apply (§ 257 HGB, § 147 AO), the applicable statutory period governs. Otherwise correspondence is deleted once it no longer serves a purpose.

Ordinary email is not end-to-end encrypted and can in principle be read in transit. Please don't send anything genuinely sensitive by email — to me or to anyone.

7. Booking a call

The buttons inviting you to book a call take you to a scheduling page operated by Calendly LLC, 271 17th St NW, Atlanta, GA 30363, USA. That page is not embedded here — you leave this site to reach it, and nothing whatsoever is loaded from Calendly unless and until you choose to go there. Simply reading this site sends Calendly nothing.

If you book, you provide your name, email address and chosen time. This is used solely to arrange and hold the call, and to place the appointment in my calendar. Legal basis is Art. 6(1)(b) GDPR (steps prior to entering a contract). Calendly acts as a processor under Art. 28 GDPR; the transfer to the United States is safeguarded as described in section 4. Calendly's own handling of data on its site is governed by its privacy policy.

8. Who receives your data

Your data is not sold, rented, or shared for anyone else's marketing. Beyond the processors above, it is disclosed only where I am legally obliged to do so, or to my tax adviser or authorities where required by tax and accounting law.

9. Your rights

Under the GDPR you have the right to:

• Access — ask whether I hold data about you and get a copy (Art. 15)
• Rectification — have inaccurate data corrected (Art. 16)
• Erasure — have data deleted where the conditions are met (Art. 17)
• Restriction — have processing limited (Art. 18)
• Portability — receive data you provided in a machine-readable form (Art. 20)
• Objection — object at any time to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21)
• Withdraw consent at any time, with effect for the future, where processing rests on consent (Art. 7(3))

To exercise any of these, email jan@virellhq.com. It reaches me directly and costs you nothing.

10. Complaints

You can complain to a supervisory authority, in particular in the member state of your residence, place of work, or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for me is:

11. Artificial intelligence, and automated decision-making

Virell builds and sells an AI system, and uses one in its own work. Where you are reading or hearing something an AI produced, you should be told so rather than having to guess.

• This website and the sixty-second tour contain no AI. Every word on them was written by a person, and the tour is a fixed animation — the emails it shows are scripted, not generated while you watch.
• A personalised demo is generated by an AI. If I send you a private demo link, the reply you see on it is written on the spot by a large language model run by Anthropic PBC (San Francisco, USA), acting as a processor under Art. 28 GDPR. What is sent to produce it is the publicly available business information already shown on that page. Anthropic does not use it to train models.
• Emails I send you may be written by an AI, and an AI may write the reply when you answer. That is the product; it would be a strange thing to hide. A real person — me — reads the conversation and takes over whenever it matters, and you can reach me directly at any time on the address in section 9. Ask to be taken off the list and it stops.
• No decision about you is made by a machine alone. Nothing on this site or in that correspondence produces a legal or similarly significant effect within the meaning of Art. 22 GDPR, and no profiling in that sense takes place.

12. Is providing data required?

No. You are under no statutory or contractual obligation to provide any personal data. The technical data in section 3 is unavoidable if you want to view the site at all; everything else is entirely your choice. Not providing it has no consequence other than my being unable to reply to you.

13. Security

This site is served exclusively over an encrypted TLS connection (HTTPS), which you can verify by the padlock in your browser's address bar. Appropriate technical and organisational measures under Art. 32 GDPR are in place to protect data against accidental or unlawful loss, alteration or unauthorised access.

14. A note for visitors in the United States

Virell is operated from Germany and applies the GDPR to everyone, wherever they are. Personal information is not sold and not shared for cross-context behavioural advertising, as those terms are used under US state privacy laws. If you are in the US and want to know what I hold about you or want it deleted, use the same email address above — you get the same answer and the same treatment.

15. Changes to this policy

This policy will be updated when the site or the services behind it change — for example if a contact form or a new tool is added. The current version always applies and is dated at the top of this page.

See also the Legal Notice for provider identification.