Privacy policy
Who is responsible
Trainarea Ltd., 27 July Street 28, office 1, 9000 Varna, Bulgaria, is the controller for the personal data described here. Andreas Lohr runs the company and delivers its services, so this policy says “I” and “me”. You can reach me through the contact form, by post, or by email at the address in the legal notice.
Visiting this site
The site runs on Cloudflare. To deliver and protect it, Cloudflare processes technical data such as your IP address, browser type and the pages you request. This site sets no cookies and uses no analytics or advertising trackers. Legal basis: my legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).
Leak Check
When you run the Next-Tab Leak Check, I store your answers (your AI feature, your product's web address and the numbers you enter), your email address, role and company size, and the country your connection comes from. I use them to show and email you the result and to follow up about it. Legal basis: steps taken at your request before a contract (Art. 6(1)(b) GDPR).
The result appears on the page right away. By email, you first get only a link to confirm that the address is yours. Only once you click it do I email you the result, see your check as a lead and send any follow-ups you asked for.
If you tick the box for follow-up emails, I send you two short emails about your result after you confirm. Each one has a link to stop them. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
The result page link works for 90 days. If you never confirm your email address, your answers are deleted after 90 days; otherwise after 12 months.
Contact forms
When you send a message through the contact form, or a question from the Adoption Fix Sprint or Next-Tab Advisor page, I receive what you enter: your name, email address and message, the topic, and on those two pages your company website if you give one and whether you’ve had the audit. I also see the country your connection comes from. Your message reaches me by email and isn’t stored on the website. I use it only to answer you. Legal basis: steps taken at your request before a contract (Art. 6(1)(b) GDPR), or my legitimate interest in answering your message (Art. 6(1)(f) GDPR).
Spam protection on the forms
The contact forms and the Next-Tab Leak Check use Cloudflare Turnstile to tell people from spam bots. It loads only once you start filling in a form, not while you just read a page. Turnstile then runs a check in your browser and sends Cloudflare technical data such as your IP address and information about your browser and device. It doesn’t read what you type into the form, and it sets no cookies on this site. Cloudflare explains how it handles this data in its Turnstile privacy addendum. Legal basis: my legitimate interest in keeping the forms free of spam and abuse (Art. 6(1)(f) GDPR).
Purchases
Payments are handled by Stripe. I don't see or store your card details. I receive your name, email address, billing address and VAT ID, if you give one, to deliver the service and issue invoices. Legal basis: performance of a contract and legal obligations (Art. 6(1)(b) and (c) GDPR). Invoices and accounting records are kept for as long as tax and accounting law requires.
Materials you send
Texts, screenshots, recordings and files you send through the intake form are used only to deliver the service you bought. They are stored privately and deleted automatically 90 days after you send them. Please remove personal data about your own users from them wherever you can.
Mail to addresses at andreaslohr.com is received through Cloudflare and forwarded to my mailbox at Google Ireland Limited (Gmail). A backup copy is kept for 90 days. I use your messages only to reply and to deliver what you asked for. Legal basis: Art. 6(1)(b) and (f) GDPR.
Service providers
- Cloudflare, Inc. (hosting, security, spam protection for the forms, email routing and sending, file storage).
- Stripe Payments Europe, Limited (payments and receipts). Stripe also processes data as an independent controller, for example to prevent fraud.
- Google Ireland Limited (Gmail) (my mailbox).
- My accountant (invoices, bookkeeping and tax filings).
Some of these providers process data in the United States. Transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
Your rights
You can ask for access to your data, its correction or deletion, restriction of processing and a portable copy, and you can object to processing based on legitimate interests. Ask through the contact form or by post to the address above. You can also complain to a data protection authority, for example the Commission for Personal Data Protection (CPDP), Sofia, Bulgaria, www.cpdp.bg.
I don't use automated decision-making or profiling.
Last updated 18 October 2026.