---
title: "Privacy Policy"
canonical: "https://stddev-01.web.app/legal/privacy-policy"
date_published: "2024-06-17T07:34:51+00:00"
date_modified: "2026-10-11T18:58:23+00:00"
tokens: 1838
content-signal: "ai-train=yes, search=yes, ai-input=yes"
---

> Documentation Index  
> Fetch the complete documentation index at: https://stddev-01.web.app/llms.txt  
> Use this file to discover all available pages before exploring further.

**Privacy Policy**

 

**Last updated: 2025/25/11**

**1. Controller**

 

This website is operated by: **STD.DEV / Standard Deviation / Standardabweichung**

Represented by: **Daniel Kuhnlein****Herzogstr. 115****80796 Munich, Germany**

Email: 
[design@standardabweichung.de](mailto:design@standardabweichung.de)

**2. Purpose of the Website**

 

This website is designed to provide interested visitors and potential business partners with information about the competencies, services, and solutions offered by STD.DEV. 

It focuses on the interplay between visual design and modern Web-, Cloud-, and XR technologies to create digital products that are aesthetically sophisticated, interactive, and technologically advanced. 

Content is presented through a **voice-controlled real-time knowledge graph**, which analyzes user requests and visually displays relevant topics dynamically.

**3. Processing of Audio, Text, and Usage Data**

 

**3.1 Speech Input (voluntary) **

When you activate the voice assistant, your device captures short audio fragments identified as speech by the local Voice Activity Detection (VAD). These fragments are transmitted in encrypted form to STD.DEV’s server solely for the purpose of forwarding them to **OpenAI Whisper** (OpenAI, L.L.C., USA) for speech-to-text conversion. 

The following data is processed: 

1. Audio fragments containing spoken content 
2. The resulting transcription generated by OpenAI Whisper 

STD.DEV does not store audio data. Audio fragments exist only transiently in server memory for the duration of the technical processing step required to relay them to OpenAI Whisper.

Once the transcription request is completed, they are immediately discarded. Only the transcribed text is used to continue the interaction.

**Legal basis: **

1. Consent (Art. 6(1)(a) GDPR)

**3.2 Session and Chat Data (ephemeral processing)** 

To enable the interaction, the system processes the following temporarily during the active session: 

1. Transcribed user inputs 
2. System responses 
3. Technical metadata (timestamps, internal session identifiers) 

Sessions are *strictly ephemeral*. Data is stored only for the duration of active use. 

**Automatic deletion: ****If no activity occurs for *10 minutes*, the system: 

1. Generates a fully anonymized summary for internal analytics 
2. Permanently deletes the entire chat history 

After deletion, *no personal data remains.* 

Legal bases:** 

1. Contractual necessity (Art. 6(1)(b) GDPR — responding to your inquiry) 
2. Legitimate interest (Art. 6(1)(f) GDPR — ensuring system stability)

**3.3 Processing by Google AI**

For generating contextual responses, the website uses the *Google AI API (Gemini)* to process: 

1. The text content of your current message 
2. Relevant parts of the temporary chat history 

No audio data, personal identifiers, cookies, or persistent user profiles are transmitted. 

Once your session expires and is deleted, *no further processing takes place.* 

**Legal basis:**

1. Consent (Art. 6(1)(a) GDPR) 

Further information:
[https://policies.google.com/privacy](https://policies.google.com/privacy)

**3.4 Usage Data (Google Analytics 4 — optional) **

If you consent, this website uses *Google Analytics 4 (GA4)* to measure and analyze usage patterns. 

Processed data may include: 

1. Browser and device information 
2. Interaction data 
3. Pseudonymized analytics identifiers

Data may be transferred to the United States. 

**Legal basis:**

1. Consent (Art. 6(1)(a) GDPR) 

Privacy information: 
[https://policies.google.com/privacy](https://policies.google.com/privacy)

**3.5 Usage Data (Microsoft Clarity — optional)**

If you consent, this website uses *Microsoft Clarity* to analyze user interaction and improve usability.

Processed data may include: 

1. Interaction and movement data (scrolling, clicks, cursor paths) 
2. Device and browser data Anonymous or pseudonymized session replays 
3. Viewed content and page elements 

Data may be transferred to the United States. 

**Legal basis:**

1. Consent (Art. 6(1)(a) GDPR) 

Privacy information: 
[https://privacy.microsoft.com/privacystatement](https://privacy.microsoft.com/privacystatement)

**3.6 Bot Protection (Cloudflare Turnstile)**

This website uses Cloudflare Turnstile for bot detection and security purposes. 

Turnstile may process: 

1. Browser and device characteristics 
2. Interaction patterns 
3. Technical metadata 

No personal identifiers are used, and no cookies are set for advertising.

**Legal basis:** 

1. Legitimate interest (Art. 6(1)(f) GDPR — prevention of abuse and system security) 

Privacy information: 
[https://www.cloudflare.com/trust-hub/privacy-and-data-protection/](https://www.cloudflare.com/trust-hub/privacy-and-data-protection/)

**4. International Data Transfers**

 

Data transfers to the USA may occur in the context of: 

1. OpenAI 
2. Google AI 
3. Google Analytics 
4. Microsoft Clarity 
5. Cloudflare Turnstile 

All transfers rely on the *EU–US Data Privacy Framework.*

**9. Automated Processing**

 

The website uses automated processing solely to enable the technical functions of the voice interface: 

1. Speech-to-text processing via OpenAI Whisper (OpenAI, L.L.C.) 
2. Generation of contextual responses using Google AI (Gemini) 

No automated decision-making with legal or similar effects occurs, and no user profiling is performed.

**8. Security**

 

STD.DEV uses comprehensive technical and organizational security measures, including: 

1. TLS encryption Ephemeral sessions (automatic deletion after 10 minutes) 
2. Strict access controls 
3. No audio storage 
4. No profiling or personalized targeting 
5. No use of third-party frontend libraries that could introduce security risks

**7. Withdrawal of Consent**

 

You may withdraw your consent at any time by:

1.  Disabling microphone access in your browser 
2. Changing your cookie and analytics preferences 
3. Ending your use of the service

**6. Your Rights**

 

You have the following rights at any time: 

1. Access (Art. 15 GDPR) 
2. Rectification (Art. 16 GDPR) 
3. Erasure (Art. 17 GDPR) 
4. Restriction (Art. 18 GDPR) 
5. Data portability (Art. 20 GDPR) 
6. Objection (Art. 21 GDPR) 
7. Withdrawal of consent (Art. 7 GDPR) 

Because all session data is deleted after 10 minutes of inactivity, requests will often be answered with: 
*"No personal data is stored at this time."*

**5. Processors**

**Service****Purpose****Location****Legal Basis**OpenAI Whisper (OpenAI, L.L.C.)Speech-to-TextUSAConsentGoogle AI / GeminiLLM processingEU/USAConsentGoogle Analytics (Google Ireland / Google LLC)AnalyticsEU/USAConsentMicrosoft Clarity (Microsoft Corp.)UX analyticsUSAConsentCloudflare TurnstileBot protectionEU/USALegitimate interest

Appropriate data processing agreements are in place with all providers.

```json
{
    "@context": "https://schema.org",
    "@type": "WebPage",
    "headline": "Privacy Policy",
    "description": "",
    "url": "https://stddev-01.web.app/legal/privacy-policy",
    "inLanguage": "en",
    "datePublished": "2024-06-17T07:34:51+00:00",
    "dateModified": "2026-10-11T18:58:23+00:00"
}
```