← Back

Privacy Policy

This statement provides information about which personal data is processed when using the service SpamProtec and this website, for which purposes, and on what legal basis.

1. Controller

MessingerDesign — Philipp & Werner Messinger GbR
Dahmestraße 10, 12526 Berlin
Telephone: · E-mail: pmessinger (at) messingerdesign (punkt) de

2. Role and legal bases (consumers / businesses)

The core of the service is the automated screening of incoming e-mails for spam, phishing and malicious content. To this end, SpamProtec accesses the mailboxes connected by the customer via IMAP and processes e-mail content and metadata (sender, recipient, subject, headers, message body).

Consumers (B2C): Vis-à-vis consumers, the provider itself determines the means and purposes of the processing required to deliver the service and is therefore an independent controller (Art. 4 No. 7 DSGVO (GDPR)); no data processing agreement is concluded with consumers. The legal basis is Art. 6 Abs. 1 lit. b DSGVO (GDPR) (performance of a contract) and, with regard to third-party data — in particular the senders of incoming messages — Art. 6 Abs. 1 lit. f DSGVO (GDPR) (legitimate interest in e-mail/IT security and spam/phishing defense, Recital 49).

Businesses (B2B): If a business processes personal data of third parties via the service in the course of its activities, the customer is the controller and the provider is the processor (Art. 28 DSGVO (GDPR)) on the basis of a data processing agreement to be concluded separately (view DPA). In this case, data subjects (e.g. the customer's communication partners) should primarily contact the respective customer to exercise their rights.

3. Data-minimizing AI screening with pre-anonymization

Part of the classification is performed by external AI models. A strict data protection concept applies here:

• Pre-anonymization: Before any transmission to an external AI, a model operated on our own infrastructure removes or replaces personal data — names (including those of third parties), postal addresses, telephone numbers, bank details, e-mail address components, ID and vehicle registration numbers.
• Fail-closed control: An independent second screening stage ("leak gate") completely blocks the external transmission if residual data is nonetheless detected; the screening is then carried out exclusively locally.
• Two screening modes: In the standard mode "Highest detection", the pre-anonymized text is transmitted to the external AI (highest accuracy). In the "Strictly local" mode (professional-secrecy mode, included in the Business plan), no content data whatsoever is transmitted to external AI providers (Anthropic, OpenAI); the classification is carried out exclusively on our own infrastructure in Germany/EU (local spam engine rspamd, sender authenticity SPF/DKIM/DMARC, domain age, brand-impersonation and swarm signals). The mode can be configured per mailbox, per user or group-wide. For persons bound by professional secrecy (§ 203 StGB (German Criminal Code) — lawyers, doctors, tax advisors, HR departments) this mode is the recommended choice, since the mandate/treatment relationship as such is not disclosed to third parties.
• Self-learning quality improvement (outside the "Strictly local" mode only): To continuously improve our own filter, the already pre-anonymized content (subject and body) is converted into a purely numerical vector representation ("embedding") on our own hardware operated in Germany. Only this numerical vector is stored, together with the screening result (spam / not spam); the readable text is not stored and no transfer to third parties or to external AI providers takes place. Legal basis: our legitimate interest in improving spam/phishing detection (Art. 6 Abs. 1 lit. f DSGVO (GDPR)). In the "Strictly local" mode (professional secrecy) this vectorization likewise takes place exclusively on our own hardware in Germany; external AI providers are not involved at any point.

4. Recipients and sub-processors

• Hosting: netcup GmbH, Karlsruhe, Germany — server location Germany.
• AI classification (pre-anonymized content only): Anthropic PBC (Claude) and OpenAI L.L.C. — exclusively in the standard mode "Highest detection"; in the "Strictly local" mode these AI providers are not used and no transmission to them takes place. In standard mode, a transfer to the USA may take place. Insofar as the respective provider is certified under the EU-US Data Privacy Framework, the transfer is based on the adequacy decision of the EU Commission (Art. 45 DSGVO (GDPR)); additionally, there are EU standard contractual clauses (Art. 46 Abs. 2 lit. c DSGVO (GDPR)). As an additional measure, content is anonymized prior to transmission. Access by US authorities cannot be fully excluded in legal terms (residual risk); we will provide a copy of the safeguards on request.
• Local processing without transmission: rspamd, reputation and keyword screening, the anonymization models as well as the vectorization (embedding) for filter self-improvement run entirely on our own infrastructure in Germany; no transfer to external providers takes place.

The respective current list of sub-processors is maintained in the DPA.

5. Account and usage data of the web interface

For the operation and protection of the web interface, we process:

• Login data: e-mail address, optionally a password (only as a hash), one-time codes (only as a hash, valid for 10 minutes), optionally a 2FA secret — legal basis Art. 6 Abs. 1 lit. b DSGVO (GDPR).
• IMAP credentials of the connected mailboxes, stored encrypted (AES-256-GCM) — Art. 6 Abs. 1 lit. b DSGVO (GDPR).
• Technical logs: IP address and timestamp for login processes and code requests for abuse prevention (rate limiting, blocking logic) — Art. 6 Abs. 1 lit. f DSGVO (GDPR) (legitimate interest: security of the service); retention max. 24 hours or until the expiry of the blocking periods.
• Cookies: one technically necessary session cookie for login (§ 25 Abs. 2 Nr. 2 TDDDG (German Telecommunications Digital Services Data Protection Act)). Cookies or comparable storage access for reach measurement are set exclusively after your consent (see section "Reach measurement of the website"); without consent, no cookie-based analysis and no integration of external providers takes place.

6. Reach measurement of the website (meinKI Analytics)

For the statistical evaluation and improvement of this website, we use meinKI Analytics — a reach measurement operated on our own infrastructure. No data is passed on to external analytics service providers and no transfer to third countries takes place. The measurement is carried out in two stages:

• Basic mode (without consent): cookie-free, aggregated reach measurement (e.g. page views, time on page, approximate region of origin, device type, referring page) without access to information on your end device, without cross-site tracking and without profiling — legal basis Art. 6 Abs. 1 lit. f DSGVO (GDPR) (legitimate interest in a data-minimizing reach measurement).
• Full mode (only with consent): Only after your express consent via the consent banner will supplementary, session-related information be stored on or read from your end device (§ 25 Abs. 1 TDDDG (German Telecommunications Digital Services Data Protection Act)) — legal basis Art. 6 Abs. 1 lit. a DSGVO (GDPR). Consent is voluntary and can be withdrawn at any time with effect for the future (via the banner or by declining); the lawfulness of the processing carried out up to the withdrawal remains unaffected. No consolidation into user profiles takes place.

Advertising performance measurement (Google Ads): If you reach our website via one of our ads, we process the click and campaign identifiers passed in the address (e.g. Google gclid, utm_*) in order to measure the effectiveness of our advertising; if you later start a free trial, we attribute it to that ad. Without your consent, this happens only for the session via a non-persistent, purely functional first-party cookie (sp_attr) that is normally deleted when you close your browser (Art. 6 Abs. 1 lit. f DSGVO (GDPR)). Only with your consent is this identifier stored persistently (up to 90 days) so that later visits can be attributed too (§ 25 Abs. 1 TDDDG, Art. 6 Abs. 1 lit. a DSGVO (GDPR)); withdrawal takes effect for the future (the cookie is then downgraded to the current session). If you sign up for a free trial, we additionally store the click identifier transaction-related in the contract data (only until account setup is completed) and as a pseudonymous event in our self-operated statistics system (Art. 6(1)(b) and (f) GDPR). For measurement, the click identifier together with the fact that a trial was started may be transmitted to Google (Google Ads); no e-mail or message content is transmitted. No cookies of the advertising platform are set.

7. Reports and system e-mails

As part of the service, we send system e-mails (e.g. quarantine reports, login codes, invitations) to the stored addresses. The legal basis is Art. 6 Abs. 1 lit. b DSGVO (GDPR); reports can be deactivated in the settings.

8. Storage period

• Messages sorted out as spam remain in the customer's spam folder for the retention period set per account (default: 30 days) and are then deleted there.
• Classification metadata (e.g. subject, sender domain, rating) is stored for statistics and learning behavior for up to 12 months and subsequently deleted or anonymized.
• Vector data for filter self-improvement (numerical embedding + result, no readable text) is stored for a maximum of 180 days — or 365 days if you have corrected a classification, so the correction can be learned — and is deleted automatically thereafter.
• One-time codes, expired invitations and rate-limit entries are automatically deleted daily.
• After the end of the contract, credentials and stored content are deleted in accordance with the DPA.

9. Your rights

You have the rights under Art. 15–21 DSGVO (GDPR): access, rectification, erasure, restriction of processing, data portability, as well as the right to object to processing on the basis of Art. 6 Abs. 1 lit. f DSGVO (GDPR). In addition, there is a right to lodge a complaint with a data protection supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information. Insofar as data is processed on behalf of a customer, we forward requests from data subjects to the responsible customer or assist them in responding.

10. Data security

We employ measures corresponding to the state of the art, including TLS transport encryption, encrypted storage of credentials, a roles and permissions concept, tenant separation, logging of security-relevant events, daily backups and automatic monitoring.

11. Contact for data protection matters

pmessinger (at) messingerdesign (punkt) de

As of: June 2026 · SpamProtec · MessingerDesign GbR