Privacy policy: what this website stores and what it does not

Serving the website

For your browser to receive the page, our server processes your IP address and writes the usual access logs.

Data

IP address, date and time, page requested, referring page, browser and operating system, bytes transferred, status code

Purpose

delivering the page, operational security, defending against attacks, troubleshooting

Legal basis

Art. 6 (1) (f) GDPR (legitimate interest in secure operation)

Recipients

hosting provider as processor: Amazon Web Services EMEA SARL, Luxembourg, data center in Frankfurt am Main, Germany (region eu-central-1), managed via Laravel Forge, Art. 28 GDPR agreement

Retention

server logs 14 days. Server backups are kept encrypted at AWS in Frankfurt and Paris and deleted automatically after 30 days; data we delete therefore disappears from the backups within 30 days at the latest

Counting page views

We measure the use of the website ourselves, without cookies and without a third-party service. Two small scripts hosted on our server report the following: when you leave a page, which page was open for how long and how far it was read; and when you click a button or fill in a form, that this step happened, never the content of your input. Neither script reads device characteristics or creates an identifier in your browser; the opt-out switch below turns both off. To add up the views of one visit, the server builds a hash from IP address, browser and a random value that changes every day. The IP address is processed at the moment of the request but not stored; the random value is deleted after 32 days, after which the hash can no longer be attributed. Until then the hash is a pseudonymous value, not an anonymous one. We use the same daily hash to relate a chat conversation or a meeting request of the same day to the page views (source and pages read); beyond that day no attribution is possible.

Data

page viewed, referring page (address only, without parameters), campaign tag from the link (UTM), scroll depth, time on page, a daily hash, the country (derived by our server from the IP address using its own copy of the MaxMind GeoLite2 country list, without querying any third party); plus interaction events without content: click on a call-to-action button, click on a sales contact address, start, submit or error of a form, start, completion or error of a meeting booking, newsletter sign-up, each with page, button identifier, chosen plan or product, channel and campaign

Purpose

knowing which pages are read and how visitors find us

Legal basis

Art. 6 (1) (f) GDPR (legitimate interest in evaluating our own site). The script stores nothing on your device and reads no information stored there (no cookies, no storage, no device identifiers); it only determines the state of the displayed page (scroll position, duration). In our assessment Section 25 TDDDG is therefore not engaged; the assessment is with the data protection officer

Recipients

none; the evaluation runs on our own server

Retention

views and events 24 months (automatic deletion run); the random value used to build the daily hash is deleted after 32 days, and until then we treat the hash as pseudonymous data

Attributing a visit to a company

AirLST serves businesses. Many companies run their network under their own publicly registered address block. When a page is requested, our server compares your IP address with its own copy of this registry data; only if the block is still unknown does it query the registry and reverse DNS for the address. If it falls into a company block, we note the company name with the page view. Connections of private individuals, mobile networks, home offices and data centers are discarded; the IP address is never stored.

Data

your IP address at the moment of the request (not stored); it is sent to the public network registry and resolved to a host name via reverse DNS; what we store is the network block, the name of the company or network operator that owns the block according to the registry, the domain of the host name, and the company name attached to the page view. For very small companies the company name may allow inferences about individuals, which is why we treat the attribution as personal data, not as anonymous. We do not store personal names from the registry

Purpose

knowing which companies are interested in AirLST so we can approach them (B2B sales)

Legal basis

Art. 6 (1) (f) GDPR (legitimate interest in marketing to businesses); the balancing of interests is documented and held by the data protection officer. The registry data on network blocks comes from public sources (Art. 14 GDPR); it mostly concerns companies and network operators. Where it allows inferences about natural persons, for example sole proprietors, we treat that data as personal data

Recipients

RIPE NCC (Amsterdam, Netherlands), operator of the public registry, receives the IP address; if the block belongs to another world region, RIPE forwards the query to the registry responsible there (ARIN in the USA, APNIC, LACNIC, AFRINIC). For the reverse DNS lookup our server queries the name servers responsible for the address, usually those of your network operator. The company name is not linked to contact data from forms or the CRM unless you contact us yourself on behalf of that company

Retention

company name per page view 12 months; registry data on network blocks 30 days

Dealfront company database

Data

your IP address, sent from our server to Dealfront once per visit and day; we store only the answer (company name, website, industry, employee range, country, match confidence) with the page view, never the address

Purpose

identifying companies whose employees browse through an internet provider connection, which the network registry lookup therefore cannot find (B2B sales); the result is companies, not people

Legal basis

Art. 6 (1) (f) GDPR (legitimate interest in B2B sales); the lookup runs on our server, nothing is stored on or read from your browser, there is no script and there are no cookies

Recipients

Dealfront Group GmbH, Durlacher Allee 73, 76131 Karlsruhe, Germany, as a processor under Art. 28 GDPR

Retention

the answers for 12 months, then deleted automatically; if you object to visit counting, our server does not query

Company profile for an identified company

When a team member opens an identified company in the back end, the server compiles a short profile from public sources. This happens only on that request, never on a page view, and concerns the company, not the person who read our pages.

Data

for the company name from the registry: website, short description, headcount, revenue and founding year from Wikidata; title and description of the company website; from its legal notice the commercial register number, the address and the names of the managing directors as published there; a company logo, as a copy on our server

Purpose

showing the sales team at a glance which company it is before reaching out

Legal basis

Art. 6 (1) (f) GDPR (legitimate interest in B2B sales); the details come exclusively from sources the company itself has published (Art. 14 GDPR, information through this policy). Names of managing directors are mandatory legal-notice information and are not enriched with further data

Recipients

Wikidata (Wikimedia Foundation, USA) and the company website receive only the company name or a request for their public pages, no data about you or your visit

Retention

30 days from building the profile; it is then deleted together with the logo copy and rebuilt when needed

Detecting and excluding suspicious ad clicks

When an unusual number of clicks on our ads comes from the same network, for example a data center or without any sign of reading, it is usually not a person. To recognize such networks, our server notes the truncated network range for visits through an ad, never the individual address. Many people share such a range; on its own it does not identify you. Networks of mobile and internet providers are only excluded when clicks pile up clearly. The opt-out switch in the visit counting section applies here as well.

Data

only if you arrive through one of our Google ads (recognizable by the click ID or campaign tag in the address): the truncated network range of your IP address (the first three blocks for IPv4, the first 64 bits for IPv6), the time, and whether a click ID was present; linked to the page view from visit counting (page, country, device type, scroll depth, time on page) and to the type of network block from company identification. The full IP address is not stored

Purpose

detecting click fraud and automated clicks on our ads and excluding the affected network ranges from ad delivery, so our advertising budget is not spent on bots

Legal basis

Art. 6 (1) (f) GDPR (legitimate interest in preventing abuse and in spending on advertising efficiently). Nothing is stored on or read from your device; the processing runs on our server

Recipients

if we exclude a suspicious network range, Google (Google Ireland Limited, Dublin, Ireland) as the provider of our advertising account receives exactly that truncated network range as an IP exclusion, no data about individual visits

Retention

network ranges of ad clicks 35 days (automatic deletion); an exclusion at Google is lifted automatically after 30 days

Website chat

The chat in the bottom right corner answers questions first through an AI assistant. The chat window says so before you send the first message; that notice is information, not consent, and the processing rests on the legal bases named above. If you want to talk to a person, the AirLST team reads along and takes over; the AI then stops answering.

Data

your messages, the replies, the page on which you opened the chat, timestamps; plus the daily hash from visit counting so our team can relate the chat to a visit and, if company identification found a company for that visit, its name next to the conversation in the back end

Purpose

answering your questions about AirLST, handover to a team member on request

Legal basis

Art. 6 (1) (b) GDPR (pre-contractual inquiry), otherwise (f) (legitimate interest in answering inquiries). The transfer to the USA rests on the European Commission standard contractual clauses (Art. 46 (2) (c) GDPR) as part of the Data Processing Addendum of Anthropic; to our knowledge (as of October 9, 2026) Anthropic holds no certification under the EU-US Data Privacy Framework

Recipients

Anthropic, PBC, San Francisco, USA, directly through the Anthropic API (operator of the Claude language model, processor under its Commercial Terms and Data Processing Addendum); only the conversation text is transmitted, no IP address. Anthropic does not use API inputs to train its models. The AirLST team can read all conversations in our own back end, not only after a handover

Retention

conversations on our server 6 months; at Anthropic, API inputs and outputs are deleted by default within 30 days according to its documentation; the token in your browser until you delete it

Newsletter

Sign-up uses double opt-in: you receive a confirmation link, and only after clicking it are you subscribed. Every issue contains an unsubscribe link.

Data

email address, time of sign-up and of confirmation, page of sign-up

Purpose

sending our newsletter with news about AirLST and attendee management

Legal basis

Art. 6 (1) (a) GDPR (consent, evidenced by the confirmation click)

Recipients

email delivery through Amazon Simple Email Service (Amazon Web Services EMEA SARL, Frankfurt region) as processor

Retention

until you unsubscribe; unconfirmed sign-ups 14 days

Contact form and meeting booking

Data

name, company, email address, topic and message; for a meeting booking also the requested slot, time zone, a note and, optionally, up to three email addresses of additional guests that you enter yourself (please inform those people; we use the addresses only for the invitation to this meeting); plus the campaign tag if it was part of the link to the form, and for a meeting request the source (channel, campaign, landing page) from the same day's page views via the daily hash

Purpose

handling your inquiry, holding the meeting, follow-up questions

Legal basis

Art. 6 (1) (b) GDPR (pre-contractual inquiry), otherwise (f) (answering inquiries)

Recipients

email delivery as for the newsletter (Amazon SES). The booking itself is managed by our own server, not by Calendly or another scheduling service. The booked meeting is also entered in the Microsoft 365 calendar of the person holding it, with your name, email address and note; Microsoft generates the Teams link for the call. Microsoft 365 is the workplace service of AirLST (Microsoft Ireland Operations Ltd., processor under an Art. 28 GDPR agreement, the Microsoft Data Protection Addendum)

Retention

contact inquiries 12 months after receipt; meetings with confirmation and cancellation 12 months after the meeting; the calendar entry at Microsoft follows the mailbox settings

Free trial

The link "Start free trial" leads to the AirLST platform at airlst.app. The privacy policy there and the terms apply to the platform.

Data

the details you enter when registering on the AirLST platform

Purpose

setting up your account

Legal basis

Art. 6 (1) (b) GDPR (contract)

Recipients

none; the platform is operated by AirLST

Retention

according to the platform terms