This policy describes the personal data processed when you visit and use mahevi.solutions.

1. Controller

mahevi solutions, Alexander Schaffer, Austria
E-mail: alexander@mahevi.solutions, phone: +43 664 2081526. Full postal address in the imprint.

No data protection officer has been appointed; there is no legal obligation to do so.

2. Visiting the website (server and access logs)

Every request causes the server to process technical access data: IP address, timestamp, endpoint called, HTTP status, response time, referrer, user agent, language and a technical session identifier. These logs serve operation, troubleshooting and abuse prevention. To protect against overload, requests are counted and limited per IP address.

Legal basis: legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR).
Retention: automatic deletion after 90 days.

3. First-party usage measurement

If cookies are accepted, the website additionally reports the pages you open and individual interactions to our own server in order to evaluate usage and errors – exclusively within our own system. Without consent this does not happen at all. No third-party analytics services are used: no Google Analytics, no tag manager, no social media pixels, no advertising networks.

Legal basis: consent (a), revocable at any time – see cookies.

4. User account

An account requires an e-mail address, a password (stored only as a cryptographic hash), a name and the assigned roles. Registration requires acceptance of the terms of use and this privacy policy; that acceptance is logged with its timestamp and version.

Legal basis: performance of a contract (b).
Retention: until the account is deleted, thereafter until statutory retention periods expire.

5. Enquiries, forms and surveys

Information submitted through contact and questionnaire features is stored in order to process it. In calculation and analysis tools the values you enter generally stay in your browser; if results are saved or sent, they are associated with your account.

Legal basis: pre-contractual measures or performance of a contract (b), otherwise the legitimate interest in responding (f).

6. Orders and payments

For paid services we process order and invoice data. Payments are handled by Braintree/PayPal. Payment details such as full card numbers are entered directly with the payment provider and are not stored in our system; we only receive the status and reference of the transaction.

Legal basis: performance of a contract (b), legal obligation for invoices (c).
Retention: invoicing and accounting data for seven years under § 132 of the Austrian Federal Fiscal Code.

7. E-mail and newsletter

System e-mails and newsletters are sent via Azure Communication Services. The newsletter requires explicit sign-up with confirmation of the e-mail address (double opt-in); every mailing contains an unsubscribe link. For each dispatch we log which message went to which address at what time and whether delivery succeeded. Open and click tracking is disabled.

Legal basis: contract for system e-mails (b), consent for the newsletter (a).
Retention: dispatch logs 90 days; a subscription lasts until you unsubscribe.

8. Chat and AI-assisted features

If a chat or assistant feature is used, your input and the associated history are transmitted to OpenAI for processing and additionally stored in our system. Please do not enter sensitive personal data or data about third parties there.

Legal basis: consent through active use, or legitimate interest (a/f). The transfer is to the USA on the basis of standard contractual clauses.

9. Cookies and local storage

Details can be found on the cookies page.

10. Recipients and processors

• Microsoft (Azure App Service, Azure SQL, Blob Storage, Azure Communication Services) – hosting, database, media and e-mail delivery, EU data centres
• OpenAI – processing of input to AI-assisted features (USA, standard contractual clauses)
• Braintree/PayPal – payment processing

Data is neither passed on for advertising purposes nor sold.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Consent given may be withdrawn at any time with effect for the future. A message to alexander@mahevi.solutions is sufficient.

You have the right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, dsb.gv.at.

12. Changes

This policy is updated when the processing changes. The version published on this page is the authoritative one.

Last updated: July 2026