Privacy Policy (Datenschutzerklärung)

Last updated: 17 June 2026

This Privacy Policy explains, in plain language, what personal data we handle, why, on what legal basis, and what rights you have. It covers this website (volcanicwolves.com) and the Quote Recovery Sprint service provided by Anatolii Kharchuk (Marburg, Germany) — referred to here as "we," "us," and "our."

We handle as little personal data as possible. Because two very different kinds of data are involved, this policy is split into two parts:

• Data about visitors to this website and people who book a call — here we decide how the data is used, so we are the controller (Sections 1–12).
• Data we access inside a client's CRM while delivering a sprint — here the client decides, and we act only on their instructions, so we are a processor (Section 9).

If you are a resident of the United States, please also read Section 13 (U.S. state privacy rights).

1. Controller

The controller responsible for this website and for our own processing within the meaning of Art. 4 (7) GDPR is:

Anatolii Kharchuk
Sudetenstraße 15
35039 Marburg, Germany
Email: ai.kharchuk@gmail.com

For personal data inside a client's CRM, the client is the controller and we act as their processor (see Section 9).

2. General notes

• Scope. This policy applies only to processing for which we are responsible. It does not cover websites we link to; please read their own policies.
• No automated decision-making. We do not use automated decision-making or profiling that produces legal or similarly significant effects within the meaning of Art. 22 GDPR.
• Encryption. This site uses SSL/TLS encryption (HTTPS) to protect data in transit.

3. Hosting and server log files (Vercel)

This site is hosted by Vercel Inc. (San Francisco, USA), which delivers it to your browser. When you visit, your browser necessarily transmits technical data that our hosting provider processes to deliver and secure the site, typically including: your IP address (often shortened/anonymised), the date and time of the request, the page or file requested, your browser type and version, your operating system, and the referring URL.

This data is processed to display the site reliably and to protect it against misuse and attacks.

Legal basis: our legitimate interest in operating and securing the website (Art. 6 (1) (f) GDPR). Because Vercel is a U.S. provider, this can involve a transfer to the USA — see Section 8.

4. Cookies and consent management (Cookiebot / Usercentrics)

We use Cookiebot, a consent-management platform operated by Usercentrics A/S (Copenhagen, Denmark), to obtain and document your cookie choices.

On your first visit, a banner asks whether you accept analytics and/or marketing cookies. The categories are separate and not pre-ticked, and a "Reject all" option is shown just as prominently as "Accept." No analytics or marketing tool runs until you opt in. You can change or withdraw your choice at any time via "Cookie settings" in the footer. Cookiebot stores a record of your consent (e.g. a consent ID and your selections) so that we can demonstrate that consent was given.

• Legal basis for storing/reading information on your device: § 25 TDDDG (the German Telecommunications Digital Services Data Protection Act, formerly TTDSG). Strictly necessary cookies — including the consent record itself — are placed without consent under § 25 (2) TDDDG; all others require your prior opt-in.
• Legal basis for the consent record: our legal obligation and legitimate interest in documenting consent (Art. 6 (1) (c) and (f) GDPR).

5. Cookieless website analytics (Vercel Analytics)

We use Vercel Analytics for aggregate, anonymous page metrics. It does not set cookies and does not identify you individually. Because no data that identifies you is processed for this purpose, it runs without requiring consent.

Legal basis: our legitimate interest in understanding aggregate site usage (Art. 6 (1) (f) GDPR).

6. Google Analytics 4 — only with your consent

Only if you consent to analytics, we load Google Analytics 4, a service of Google Ireland Ltd (Dublin, Ireland), with data potentially processed by Google LLC (USA). Google Analytics helps us understand how the site is used. It sets cookies and may transfer data to Google servers, including in the USA. We use Google Consent Mode v2, which keeps these tags denied by default until you opt in. Without analytics consent, Google Analytics is not loaded.

Legal basis: your consent (Art. 6 (1) (a) GDPR) for the processing and § 25 (1) TDDDG for the cookies — withdrawable at any time via "Cookie settings."

7. Meta Pixel — only with your consent

Only if you consent to marketing, we load the Meta Pixel, a service of Meta Platforms Ireland Ltd (Dublin, Ireland), with data potentially processed by Meta Platforms, Inc. (USA). We use it to measure the reach and effectiveness of advertising. It sets cookies and may transfer data to Meta servers, including in the USA. Without marketing consent the Pixel is never loaded. For data processed via the Pixel, Meta and we are joint controllers within the meaning of Art. 26 GDPR to the extent set out in Meta's controller addendum; Meta is responsible for fulfilling data-subject rights in respect of the data it processes for its own purposes.

Legal basis: your consent (Art. 6 (1) (a) GDPR) for the processing and § 25 (1) TDDDG for the cookies — withdrawable at any time.

8. Transfers to the USA and other third countries

Some providers above (Vercel, Google, Meta, and the providers in Section 9 / Section 11) may process personal data in the United States or other countries outside the EU/EEA.

• Where a provider is certified under the EU–U.S. Data Privacy Framework (DPF), the European Commission's adequacy decision permits the transfer.
• Where the DPF does not apply, we rely on the EU Standard Contractual Clauses (SCCs) and, where appropriate, additional safeguards.

The USA does not, in general, offer a level of data protection equivalent to the EU's. For analytics and marketing tools, we ask for your explicit consent before any such transfer (Art. 49 (1) (a) GDPR may also apply).

9. Contact, bookings, and data we access during a sprint

Contacting us. If you email us, or book a call via Calendly (Calendly LLC, Atlanta, USA), we process your name, email address, and anything you choose to tell us, in order to reply, assess whether the service is a fit, and prepare for the call. Legal basis: steps taken at your request prior to a contract and our legitimate interest in responding to enquiries (Art. 6 (1) (b) and (f) GDPR).

Payments. When you engage us, invoicing and payment are handled by Stripe (Stripe, Inc., USA, and/or Stripe Payments Europe Ltd, Ireland). Legal basis: performance of our contract (Art. 6 (1) (b) GDPR) and our legal obligations under German commercial and tax law (Art. 6 (1) (c) GDPR).

Data inside your CRM (we act as processor). When you hire us, we receive read-only access to your HubSpot or Pipedrive — deals, contacts, quote dates, and notes. Some of that is personal data about your own contacts and customers. For this data you are the controller and we act only as your processor (Art. 28 GDPR) — and, where U.S. state privacy laws apply, as your service provider. We process it solely to deliver the sprint you hired us for, on your documented instructions, and for no other purpose. We never use it for our own marketing, we never sell or share it, and we do not use it to train any public AI model. We are glad to sign a Data Processing Agreement and an NDA before access begins. We work inside your CRM with read-only access: we do not copy or export your customer database; any working notes are kept to the minimum needed and deleted after the sprint; we cannot change anything in your CRM, and we never touch your drawings, specs, or files. If you are a customer of one of our clients and want to exercise your rights, please contact that company — they are the controller; we will support them in responding.

10. Legal bases at a glance (Art. 6 GDPR)

Where processing rests on consent (Art. 6 (1) (a)), you may withdraw it at any time with effect for the future, without affecting the lawfulness of processing before withdrawal.

11. Recipients / processors

We do not sell your personal data and we do not share it for cross-context behavioural advertising. We rely on a small number of service providers ("processors" under Art. 28 GDPR): Vercel (hosting and cookieless analytics), Usercentrics / Cookiebot (consent management), Google (Analytics 4 — only with your consent), Meta (Pixel — only with your consent), Calendly (scheduling), and Stripe (invoicing and payment). Each processes data under its own terms and under a data-processing agreement with us where required. Some are based outside the EU/EEA (see Section 8). We may also disclose data where the law requires it.

12. How long we keep data

• Website analytics: aggregate and anonymous; not tied to you.
• Enquiries and booking details: kept only as long as needed to follow up, then deleted.
• Client CRM access: read-only, revoked at the end of the sprint; working notes deleted within 30 days.
• Business records (e.g. invoices): retained as long as German commercial and tax law require (generally up to 10 years, §§ 147 AO, 257 HGB).
• Consent records: retained as long as needed to demonstrate compliance.

When a retention period ends, the data is deleted or anonymised.

13. Your rights

Under the GDPR (EU/EEA)

You have the right to access your personal data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), to object to processing based on legitimate interest (Art. 21), and — where processing is based on consent — to withdraw that consent at any time (Art. 7 (3)). To exercise any of these for data on this website or your booking, email ai.kharchuk@gmail.com.

Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interest, you may object at any time on grounds relating to your particular situation. We will then stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise, or defend legal claims.

Right to complain. You may lodge a complaint with a data-protection supervisory authority. Ours is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Wiesbaden — datenschutz.hessen.de.

U.S. state privacy rights (e.g. California)

If you are a U.S. resident, the following applies to the extent a U.S. state privacy law (such as the California Consumer Privacy Act, CCPA/CPRA) applies to us:

• Categories of personal information we collect: identifiers (such as name, email, IP address), internet activity (such as aggregate site-usage data), and information you voluntarily provide when you contact us or book a call. We collect this to operate the site, respond to you, and provide our service.
• We do not "sell" your personal information, and we do not "share" it for cross-context behavioural advertising, as those terms are defined under California law.
• Your rights (where the law applies): to know/access the personal information we hold about you, to request its deletion, to request correction, to opt out of any sale or sharing, and to be free from discrimination for exercising these rights.
• Global Privacy Control. We treat a recognised opt-out preference signal (such as Global Privacy Control) as a valid request to opt out where required.
• How to exercise your rights: email ai.kharchuk@gmail.com. We will verify your request as required by law and respond within the applicable time limits.

Regardless of jurisdiction, we maintain this policy and respond to privacy requests as a matter of good practice.

14. Children

This website and service are for businesses and are not directed to children. We do not knowingly collect data from anyone under 16.

15. Changes to this policy

We may update this policy as the business changes. We will post the new version here with an updated date.

16. Contact

Questions about your data: ai.kharchuk@gmail.com.

17. Cookie Declaration

The list below is generated and kept up to date automatically by Cookiebot and shows every cookie this site uses, by category.

This policy was self-prepared to give clear, honest information about our data handling. It is written to meet German and EU requirements and to address U.S. state privacy expectations; it is not legal advice.