Privacy policy

This policy covers begala.io and brain.begala.io.

1. Controller

Philipp Begala, Köppchenweg 4, 61389 Schmitten im Taunus, Germany. Email: philipp@begala.io.

2. What these sites don't do

The public pages set no cookies, use no analytics or tracking services, build no user profiles and therefore show no consent banner. They load no fonts, scripts or images from other providers; opening them creates no connection to Google, Adobe or any other third party. There is no contact form.

3. Hosting and server logs

Both sites are operated with Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany (parent company: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). A data processing agreement under Art. 28 GDPR is in place with Cloudflare.

When you open a page, data your browser sends is processed automatically: IP address, date and time, requested address, amount of data transferred, referrer, browser type and operating system. This is technically necessary to deliver the pages and to keep them secure. Cloudflare keeps these logs only as long as needed for delivery and security and then deletes them; I do not keep these logs myself.

The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest is the secure and reliable operation of the sites. The data is not combined with other sources and not used for advertising.

Because Cloudflare runs a globally distributed network, a transfer to the USA cannot be ruled out entirely. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; the European Commission's standard contractual clauses apply in addition.

4. Redirect to LinkedIn

The address begala.io currently forwards to my LinkedIn profile. Once you arrive there, LinkedIn's own privacy policy applies.

5. brain.begala.io

The public page on brain.begala.io is a static animation. It sets no cookies and loads nothing from other providers.

The same address also runs a private service that only I use, which connects my AI tools to my own notes. Signing in to it uses my Google account and sets technically necessary cookies for that sign-in only (session binding and protection against cross-site request forgery). The service reads and writes my own GitHub repository and my own Google Drive. It processes no data of visitors.

6. Google user data

The private service on brain.begala.io ("Brain") uses Google APIs. Only my own Google account can sign in; it accesses no other person's Google account.

What it accesses: the email address of the signed-in account, to check that it is mine; Google Drive, to save files I ask it to save; and Google Contacts, to create contacts I ask it to create and to look up existing ones so it does not create duplicates.

How it is used: only to carry out the action I request from my own AI assistant at that moment. The data is not sold, not shared with third parties, not used for advertising and not used to train AI models. It is not combined with other data except my own notes in the same request.

Storage and deletion: Brain does not keep copies of my Drive files or contacts; they stay in my Google account. It stores only the sign-in tokens needed to act on my behalf, encrypted in Cloudflare storage, until I sign out or revoke access. Access can be revoked at any time atmyaccount.google.com/connections, which makes the stored tokens useless.

The use of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

7. Email

Messages to philipp@begala.io are forwarded by Cloudflare Email Routing to a mailbox at Google (Gmail) and stored there. I use them only to answer your request and do not pass them on. The legal basis is Art. 6 (1) (b) GDPR where your message aims at a contract, otherwise Art. 6 (1) (f) GDPR — my legitimate interest in answering enquiries. I delete messages once the matter is settled and no statutory retention period applies.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6 (1) (f) GDPR (Art. 21). Contact me at the address above.

You can also lodge a complaint with a data protection supervisory authority, for example the one competent for Hesse:

9. Encryption

Pages are served over TLS-encrypted connections (HTTPS).

10. Changes

Version of 17 October 2026. I update this policy when the sites change.