Privacy notice
1. Controller
The controller within the meaning of the GDPR is:
Sebastian Faber · SabFabDev
Am Pichelssee 57c
13595 Berlin · Germany
Email: alerts@sabfab.dev
Telephone: +49 174 2444410
2. Data minimisation
Search requests are sent over an encrypted connection to our own recall-catalog search endpoint. They are not sent to an AI provider and are not stored as a permanent personal search history in the current version. Personal data is processed only as needed for secure technical delivery, responding to contact requests or, after separate consent, advertising.
3. Hosting and delivery
The service is delivered through Cloudflare, Inc. for hosting, DNS, security and content delivery. Requests can generate necessary connection and log data such as IP address, time, requested resource, referrer, browser or device information and security events.
Processing is based on Article 6(1)(f) GDPR for secure, reliable service operation. Transfers outside the EEA take place only using an applicable adequacy decision or safeguards such as the EU Standard Contractual Clauses. Required data-processing agreements are concluded with processors actually used.
No separate visitor analytics
No separate visitor analytics script is currently active. Operational traffic data is evaluated only in Cloudflare's aggregated service analytics where available.
4. Local settings
The selected market, saved notices and interface settings may be stored locally on the device to restore user-requested functions. Camera-based barcode recognition is performed on the device; the camera image is not uploaded. The legal basis for device access is section 25(2)(2) TDDDG and Article 6(1)(f) GDPR for the subsequent processing. Browser site data can be deleted at any time.
5. External original sources
External sites are contacted only when a user opens their link. From that point, the respective operator is responsible for its processing under its own privacy notice.
6. Contact
Email or telephone details are used to handle the request. The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual matters and otherwise Article 6(1)(f) GDPR. Data is deleted when no longer required unless statutory retention duties apply.
7. Google AdSense and consent
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Depending on the choice, identifiers, IP address, device, browser, usage and ad-interaction data may be processed. The legal basis is consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent can be changed or withdrawn for the future through “Privacy settings”. The live consent interface will show the current vendors and purposes.
8. Retention
Logs are retained only as long as needed for security, fault analysis and abuse prevention or according to the documented processor settings. Contact records are deleted when their purpose ends, subject to legal retention. Consent records are kept for the period required to demonstrate the choice.
9. Your rights
Subject to the GDPR, you may request access, rectification, erasure, restriction, portability and object to processing. Consent can be withdrawn for the future. You may also complain to a data protection authority; the Berlin Commissioner for Data Protection and Freedom of Information is generally responsible for us.
10. Security and changes
Appropriate technical and organisational measures are used. This notice must be updated whenever functions, providers, retention settings or the legal position change.
Version
31 July 2026