This policy describes the personal data processed when you visit and use mahevi.solutions.
1. Controller
mahevi solutions, Alexander Schaffer, Austria
E-mail: alexander@mahevi.solutions, phone: +43 664 2081526. Full postal address in the imprint.
No data protection officer has been appointed; there is no legal obligation to do so.
2. Visiting the website (server and access logs)
Every request causes the server to process technical access data: IP address, timestamp, endpoint called, HTTP status, response time, referrer, user agent, language and a technical session identifier. These logs serve operation, troubleshooting and abuse prevention. To protect against overload, requests are counted and limited per IP address.
Legal basis: legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR).
Retention: automatic deletion after 90 days.
3. First-party usage measurement
If cookies are accepted, the website additionally reports the pages you open and individual interactions to our own server in order to evaluate usage and errors – exclusively within our own system. Without consent this does not happen at all. No third-party analytics services are used: no Google Analytics, no tag manager, no social media pixels, no advertising networks.
Legal basis: consent (a), revocable at any time – see cookies.
4. User account
An account requires an e-mail address, a password (stored only as a cryptographic hash), a name and the assigned roles. Registration requires acceptance of the terms of use and this privacy policy; that acceptance is logged with its timestamp and version.
Legal basis: performance of a contract (b).
Retention: until the account is deleted, thereafter until statutory retention periods expire.
5. Enquiries, forms and surveys
Information submitted through contact and questionnaire features is stored in order to process it. In calculation and analysis tools the values you enter generally stay in your browser; if results are saved or sent, they are associated with your account.
Legal basis: pre-contractual measures or performance of a contract (b), otherwise the legitimate interest in responding (f).
6. Reporting a problem (tickets)
Through “Report a problem” you can report a bug, a wish or a question. We store the title and description, every later addition and – without signing in – your name and e-mail address, or, when signed in, the link to your account. So that we can reproduce the problem, we also store the page the report was sent from, the window size, the browser identifier (user agent), the IP address and the technical session identifier.
Screenshot and attachments: When the dialog opens, a picture of the page currently shown is taken. It can show anything that was on screen at that moment. You see it before sending and can mark it up, crop it or remove it; it is only transmitted when you send the report. Without signing in you can add one picture; signed in, pictures and videos (including a screen recording). Pictures sent without an account are re-encoded (removing their metadata) and stored privately; attachments of signed-in users are files of their own account and can be deleted there.
Confirmation: Without signing in, a report is only handled once you have confirmed it through the link in the confirmation e-mail. You then receive news about your report by e-mail, each time with a personal link valid for five days. Your consent in the dialog is kept in your browser (local storage), the link for the duration of the session.
Recipients: the operators of this website (owners and administrators) and the platform operator; e-mail notifications go to them and to you.
Legal basis: your consent in the dialog (lit. a); for signed-in users also performance of a contract (lit. b) or our legitimate interest in fixing faults (lit. f).
Retention: Unconfirmed reports and their pictures are deleted after seven days. IP address, browser identifier and session identifier are removed after 90 days. Confirmed reports are kept until they are resolved and deleted; on request we delete them earlier.
7. Orders and payments
Paid services are currently not available and no payment provider is connected. No payments are therefore processed and no payment data is collected.
Order and invoice data from earlier purchases is still stored; full card numbers were not held in our system then either.
Legal basis: legal obligation for invoices (c).
Retention: invoicing and accounting data for seven years under § 132 of the Austrian Federal Fiscal Code.
8. E-mail and newsletter
System e-mails and newsletters are sent via Azure Communication Services. The newsletter requires explicit sign-up with confirmation of the e-mail address (double opt-in); every mailing contains an unsubscribe link. For each dispatch we log which message went to which address at what time and whether delivery succeeded. Open and click tracking is disabled.
Legal basis: contract for system e-mails (b), consent for the newsletter (a).
Retention: dispatch logs 90 days; a subscription lasts until you unsubscribe.
9. Chat and AI-assisted features
If a chat or assistant feature is used, your input and the associated history are transmitted to Microsoft's Azure OpenAI Service for processing and additionally stored in our system. Please do not enter sensitive personal data or data about third parties there.
Legal basis: consent through active use, or legitimate interest (a/f). Processing takes place in a data centre in Sweden (EU); no transfer to OpenAI or to the USA takes place.
10. Cookies and local storage
Details can be found on the cookies page.
11. Recipients and processors
- Microsoft (Azure App Service, Azure SQL, Blob Storage, Azure Communication Services) – hosting, database, media and e-mail delivery, EU data centres
- Microsoft Azure OpenAI Service – processing of input to AI-assisted features (Sweden, EU)
Data is neither passed on for advertising purposes nor sold.
12. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Consent given may be withdrawn at any time with effect for the future. A message to alexander@mahevi.solutions is sufficient.
You have the right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, dsb.gv.at.
13. Changes
This policy is updated when the processing changes. The version published on this page is the authoritative one.
Last updated: September 2026