Legal
Privacy
Version of 12 October 2026. This page has two parts: the website you are reading, and the PrismLCA app, whose notice is reproduced here word for word as it ships with the app.
The website prismlca.com
Who is responsible
Jonas Harth, c/o IP-Management #12404, Ludwig-Erhard-Straße 18, 20459 Hamburg, Germany · [email protected].
The short version
This website itself sets no cookies; it stores only your answer to the statistics question in your browser, if you give one. Only Cloudflare, which delivers the website, may set short-lived security cookies (see below). Fonts, images, videos and scripts come from our own website address; there are no social-media widgets. The one exception is our videos, on the videos page and in the product tour on the start page: they come from YouTube and load only when you confirm one, and YouTube can then store data in your browser (see below). Hosting and delivery involve Hetzner and Cloudflare, as described below. It counts visits with a statistics tool on our own server, and only if you allow it. We do not sell visitor data or use it for advertising.
Visiting the website
The website is hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, on servers in Helsinki, Finland. Hetzner processes data on our behalf under a data processing agreement (Art. 28 GDPR).
When you open a page, your browser sends what every web request carries: your IP address, the date and time, the page requested, the page you came from (referrer) and your browser's user agent. The server needs this to deliver the page and to protect itself against attacks. Our web server keeps no access log; technical logs on our server that can contain such data are deleted after seven days at the latest. This limit applies to logs under our control; what Cloudflare does is described in the next section.
On the handbook's installation page, a script in your browser guesses your operating system from the browser's own identification, so that the matching instructions open first. The guess stays in your browser; it is neither stored nor sent to us.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in delivering the website securely.
Delivery through Cloudflare
The website reaches you through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which protects it against attacks and overload. Cloudflare therefore handles every request to this website, including the contents of messages you submit through the contact form, and processes your IP address and the request data described above on our behalf, under a data processing agreement. Cloudflare keeps such data for as long as its security functions need it, as set out in its privacy policy. Data can be processed in the USA; Cloudflare is certified under the EU–US Data Privacy Framework, for which an adequacy decision of the European Commission applies (Art. 45 GDPR), and the agreement includes the EU standard contractual clauses as a fallback. Details: Cloudflare's privacy policy.
To tell people from automated traffic, Cloudflare can set security cookies: __cf_bm, which
expires after 30 minutes without activity, and cf_clearance, which remembers a completed security
check for as long as Cloudflare's check setting allows (by default 30 minutes). These cookies can contain a
pseudonymous browser or session identifier. They serve only to protect access to the website you asked for,
which is why they are set without consent (§ 25(2) no. 2 TDDDG); they are not used for anything else.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a website that stays available and safe.
Visitor statistics
If you allow it, we count visits with a statistics tool that runs on our own server at stats.prismlca.com; no analytics data goes to another company (the requests reach our server through Cloudflare like every other request to this website). Until you decide, nothing of it loads. With your consent, a script reads your screen size and browser language and records the page you opened (its address without any query or fragment), its title and the referring website; from the request, our server derives browser, operating system, device type and an approximate location (country, region, city). Your IP address is used only for that location and for a pseudonymous visit identifier computed from it with a secret that changes regularly; the IP address itself is not stored. Visit-level data are deleted after seven days; what remains are daily page counts without a visitor identifier, kept for up to twelve months. The tool sets no cookies. If your browser sends “Do Not Track”, your visit is not counted even with consent.
We remember your answer — allowed or declined, with its date and nothing else — in your browser's local storage for twelve months, so that we do not ask on every page. If your browser sends Global Privacy Control, we treat that as a refusal and do not ask.
Legal basis: your consent, § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future, right here or through “Privacy settings” at the foot of every page.
Videos from YouTube
The videos page and the product tour on the start page show our videos with preview images from our own server. As long as you only look at these pages, nothing is loaded from YouTube and no data reaches it. A click on a video first opens a notice; only when you then choose “Load video” does your browser load the YouTube player, from www.youtube-nocookie.com (YouTube's privacy-enhanced mode). YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
From that moment on, Google receives your IP address, the address of our website, your browser's technical data and which video you watch. The player stores information in your browser (in its local storage and a browser database, and depending on your browser's settings also cookies) and can recognise your browser on other websites; if you are signed in to a Google account, YouTube can link the visit to it. Google decides on its own how it uses these data, including for statistics and advertising, and can process them in the USA; Google LLC is certified under the EU–US Data Privacy Framework, for which an adequacy decision of the European Commission applies (Art. 45 GDPR). Details: Google's privacy policy.
Legal basis: your consent, which you give with “Load video” (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). It covers that one video and is not remembered: the next video asks again. Closing the player removes it from the page, and nothing more is loaded from YouTube until you click again; what YouTube has already stored in your browser you can delete in your browser's settings.
Contact form
If you use the contact form on the imprint page, your name, email address, subject and message are sent encrypted to our server, together with technical anti-abuse data: the time taken to fill in the form and an automated spam check. The server sends accepted messages on as one email to our mailbox [email protected] (see the next section); it keeps no database of messages and writes neither the message nor your IP address to a file or a log. To cap the number of emails per day, it records only the times of send attempts, without any link to you. To prevent abuse, it keeps your IP address (for IPv6, the network prefix) and the times of your submissions in working memory only, to count how many messages come from one connection; one hour after your last submission attempt, the next cleanup run removes them, normally within about a minute. Name, email address and message are needed to answer you; the subject is optional.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in answering enquiries and in keeping the form free of abuse; where your message concerns a contract, Art. 6(1)(b) GDPR.
Emails to [email protected], including messages from the contact form, are stored in a mailbox provided by DomainFactory GmbH, c/o WeWork, Neuturmstrasse 5, 80331 Munich, Germany, which processes them on our behalf under a data processing agreement (Art. 28 GDPR), on servers in the EU. DomainFactory runs the mailbox software with Titan Solution Ltd SEZC, based in the Cayman Islands, as its subprocessor; insofar as data can be accessed from outside the EU, this is safeguarded by the EU standard contractual clauses in DomainFactory's agreement (Art. 46(2)(c) GDPR). You can ask us for a copy of these safeguards at the address above.
We use your address and message only to answer you. We delete the correspondence when the enquiry is closed and no further follow-up is to be expected. Where a message is needed to establish, exercise or defend legal claims, we keep it only until the applicable limitation period has run or the proceedings have ended.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in answering you; where your message concerns a contract, Art. 6(1)(b) GDPR.
Links to other websites
Links to GitHub, YouTube, Substack and LinkedIn are plain links. Nothing is loaded from these services and no data reaches them until you click. Once you do, the website you open applies its own privacy rules. The same holds for downloads: the installers are hosted on GitHub, Inc. (USA).
Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR). Write to [email protected]. You can also lodge a complaint with a supervisory authority, in particular the one where you live or work. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Germany (www.baden-wuerttemberg.datenschutz.de).
You are not obliged to give us any data; without the details named above we simply cannot answer a message. We make no automated decisions about anyone and do not profile anyone.
Right to object
Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation (Art. 21 GDPR). We then stop, unless we can show compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. Write to [email protected].
Changes
A changed notice carries a new date at the top of this page.
The PrismLCA app
Version of 1 November 2026. This notice ships with the app and describes the build it comes with. The website www.prismlca.com has its own notice.
Who is responsible
Jonas Harth, [email protected]. PrismLCA is a private open-source project; there is no company behind it and no data protection officer, because the law requires none for it.
The short version
PrismLCA runs on your computer. There is no account, no cloud, no telemetry, no crash reporting, no analytics and no licence server. Your models, databases, results, reports and chats are files on your machine. The online features below send the parts they name directly to the service you use; the developer of PrismLCA receives none of it.
Nothing leaves your computer unless you switch a feature on, enter an API key, or click a button that says it will contact a server. Every such feature is listed below with what it sends and to whom. Without a key and without a click, PrismLCA makes no request at all.
Connections you can switch on
Update check
Trigger: the button Check for updates under Settings → About. PrismLCA never checks on its own. Sent to: GitHub, Inc. (a Microsoft company, USA), which hosts PrismLCA's releases. GitHub takes part in the EU–US Data Privacy Framework; how long GitHub keeps request logs is described in GitHub's privacy statement. Data: your IP address and the PrismLCA version you run. No device or installation identifier. Legal basis: Art. 6(1)(b) and (f) GDPR — you ask for the check; the download starts only after you confirm it.
News on the start page
Trigger: the button Load news from prismlca.com on the start page, or the switch Load news at every start under Settings → General, which is off until you turn it on. Sent to: prismlca.com, hosted by Hetzner Online GmbH (Germany) on servers in Helsinki, Finland, and delivered through Cloudflare, Inc. (USA; Data Privacy Framework participant). Data: your IP address and the time of the request. Server logs are kept for no longer than seven days. Legal basis: Art. 6(1)(a) GDPR — your consent, given by the click or the switch, withdrawn by turning the switch off.
Search model download
Trigger: the dialog on first start. PrismLCA searches databases with a language model that runs locally; it is not part of the installer, so the first start asks whether to download it (about 2.3 GB). Without it PrismLCA does not run; the dialog offers to quit instead. Sent to: Hugging Face, Inc. (USA), huggingface.co. Data: your IP address and the download library's user agent, which names the versions of that library, of Python and of PyTorch. The library's usage telemetry and its automatic weight conversion, which would otherwise contact the site again, are switched off. Nothing about you or your workspaces. The download happens once; afterwards the model is loaded from your disk only. Who processes it: the request goes from your computer straight to Hugging Face, which handles it as the operator of its site under its own privacy policy; the developer of PrismLCA receives nothing. We point PrismLCA at that download because the search then works offline: only an IP address and a library version leave your computer, once, for a model that keeps every later search local.
AI assistant, report writer and import matching
Trigger: an API key you enter under Settings → AI → Provider, and then every message you send, every chapter you let the assistant write, every import you let it match.
Sent to: the provider you chose — OpenRouter, Inc. (USA) or OpenAI (USA). Your key means your contract: the provider processes what PrismLCA sends under its own terms and privacy policy (OpenRouter, OpenAI). PrismLCA has no server in between and never sees your key or your conversations.
Data: your message, the conversation so far, the parts of your model and results the assistant is working on, the results of the tools it calls (which can include names and values from your background databases), attachments you add, and the skills and report text involved. Web search — in the chat when it is on, and when a report's Introduction or Interpretation is written while its "Search the literature" box is ticked (as it is unless you untick it) — runs on the provider's side; PrismLCA does not choose or know the search engine behind it. A PDF attached for a model that cannot read PDFs itself is converted to text by OpenRouter's parser, which runs at Cloudflare, Inc. With OpenRouter, the requests of a chat, and those of each report chapter's writer and second reader, also carry a random routing key, so that one conversation reaches the same provider and finds its cached prompt again. The key exists only in PrismLCA's memory and is replaced after an hour without a request and whenever PrismLCA restarts; it says nothing about you or your computer. Without it, OpenRouter groups the same requests by their opening messages.
What PrismLCA does on your behalf: it asks OpenRouter for providers that do not collect data (data_collection: deny) and for endpoints that retain nothing (zdr). Anthropic, OpenAI and Google models are exempt from the second request by default, because some of them have no such endpoint; they then run under the vendor's own retention terms. That includes the default chat model on OpenRouter, OpenAI's GPT-6.1 Sol, and every Gemini model: Google serves them only from its own endpoints (Vertex AI and Google AI Studio), which keep prompts for a limited time to detect abuse. Settings → AI → Limits lets you make any of the three vendors strict. With OpenAI as your provider, PrismLCA sends requests without server-side storage (store: false). These are requests to the provider, not guarantees from PrismLCA.
Who is responsible: the developer of PrismLCA receives neither your prompts, nor your files, nor your key; your provider's terms govern what it does with them. If you send personal data about other people, you are responsible for having a legal basis for it and for any contract or transfer safeguards it needs.
Voice input
Trigger: the microphone button in the chat, while a provider key is present. Recording starts on click and stops on click. Sent to: the same provider as the assistant (OpenRouter's Whisper endpoint, or OpenAI's transcription model), under your contract with it. Data: the audio you recorded and the language you picked. The transcript is then sent as your chat message.
Transport distances
Trigger: a key or token you enter under Settings → Transport distances, then the Distances panel, its address suggestions while you type, and the assistant's distances tool. Sent to: HeiGIT gGmbH (Heidelberg, Germany) for openrouteservice, or Mapbox, Inc. (USA) if you choose it as geocoder, under your account with them. Data: the place names and addresses you type, a country code if you set one, and coordinates for routing. An address can be personal data — a supplier's site, someone's home — so type only what you need.
Waste statistics (Eurostat)
Trigger: the assistant's Eurostat tool, on while a provider key is present and until you switch it off under Settings → AI → Chat or in the chat's "+" menu. Sent to: the European Commission's Eurostat API (EU). Data: the dataset code and the filters — country, waste and material codes, years. Nothing from your workspace.
External agents (MCP)
Trigger: the switch Let external agents drive PrismLCA (MCP server) under Settings → AI → MCP, off until you turn it on. While it is on, an AI client on this computer that you connected yourself — Claude Code, Codex, Claude Desktop — can read and change your models through the same tools as the assistant. Every change is logged under the client's name and can be undone; before an operation that cannot be undone, the client has to ask you in PrismLCA. Sent to: nowhere by PrismLCA. The client runs on your computer and reaches PrismLCA over a local connection (127.0.0.1) that never leaves it. What the client does with the answers — typically, send them to its own AI provider — is governed by that client and by your contract with its provider, not by PrismLCA. Data: whatever the client asks for: model contents, search results from the background databases, calculation results, study metadata. Legal basis: Art. 6(1)(b) GDPR — you switch the connection on; the client's provider is your own contract with them.
Links
Links in PrismLCA open in your browser. From there on, the page you opened applies its own rules.
What stays on this computer
PrismLCA keeps, in your user folder and inside each workspace: your settings, your API keys (encrypted with the operating system's key store where one exists), the models and databases you imported, the search index, the complete transcripts of your chats with the assistant including what its tools returned, copies of the files you attached, the assistant's research and review notes, your reports, and an audit log of changes. Deleting a workspace removes its files; deleting the PrismLCA user folder removes the rest. PrismLCA uploads none of it on its own; only the online features above send the parts they name, and only when you use them.
What we never do
We do not sell, share or rent personal data. We do not profile anyone and make no automated decisions about anyone. We do not collect usage data. Apart from the one-time download of the search model, which PrismLCA needs to run, no feature above is required: leaving it off only means that feature is unavailable.
Your rights
Where PrismLCA's developer processes your data — the update check via GitHub and the news feed, both of which see an IP address — you have the rights of access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR), and the right to object to processing based on legitimate interests (Art. 21 GDPR). Consent you gave can be withdrawn at any time with effect for the future, by turning the feature off. You can lodge a complaint with a supervisory authority; the one responsible for PrismLCA's developer is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Germany (www.baden-wuerttemberg.datenschutz.de).
Write to [email protected]. We keep no records about app users beyond the server logs named above; if we cannot find data relating to you in them, we will tell you, and you can give us details that help us find it.
Users outside the EU
The same rules apply to everyone, wherever you are. PrismLCA sells or shares no personal information in the sense of the California Consumer Privacy Act or any similar law, and collects none it could sell.
Changes
A changed notice carries a new date at the top and appears in the app's What's-new list. The copy in the app is the one that applies to that version.