Privacy Policy

Privacy policy for help.bpanda.com: which personal data the help processes under the GDPR – server log files, cookies and local storage, AI assistant – and which rights you have.

1. Controller and Data Protection Officer

The controller for the data processing on this website (help.bpanda.com) within the meaning of the General Data Protection Regulation (GDPR) is:

MID GmbH
Kressengartenstraße 10
90402 Nürnberg, Germany
Phone: +49 911 968 36-0
E-mail: datenschutz@mid.de
Represented by the managing directors Dr. Martin Müller (Chairman) and Andreas Ditze
Register court: Amtsgericht Nürnberg, HRB 21108

You can reach our data protection officer at: MID GmbH, Der Datenschutzbeauftragte, Kressengartenstraße 10, 90402 Nürnberg, e-mail: datenschutz@mid.de.

2. General Information on Data Processing

This website is the help and documentation site for Bpanda. You can use it without registering. We process your personal data only to the extent necessary for the operation of the site, its security and its functions.

Legal bases. We base the processing on:

Art. 6 para. 1 lit. f GDPR (legitimate interest): secure and stable operation of the website as well as the provision of the AI assistant as a help function.

Storage period. We delete your data as soon as the purpose no longer applies and no statutory retention obligations stand in the way. You will find the specific periods with the individual processing operations.

3. Hosting and Server Log Files

The website is built with the open source documentation framework Blume.
Blume is software that we operate ourselves; the maker of Blume does not receive any data from you.

We host the site with IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, in a data center in Frankfurt am Main. A data processing agreement in accordance with Art. 28 GDPR is in place with IONOS.

When you call up the site, the server automatically processes the following data:

IP address of your device
date and time of access
URL called up and referrer URL
browser type, operating system and language (user agent)
HTTP status code and amount of data transferred

The purpose is to deliver the site as well as to defend against and investigate attacks. The legal basis is Art. 6 para. 1 lit. f GDPR. The log files are deleted after 7 days, unless they are needed for longer to investigate a specific security incident.

4. Cookies, Local Storage and Search

We do not use any cookies for advertising or tracking purposes. The site stores technically necessary settings, such as the selected color scheme (light/dark), in your browser’s local storage. This data does not leave your device. The legal basis is Section 25 para. 2 no. 2 TDDDG.

Search. The full-text search runs locally in your browser based on an index that is generated when the site is built. Your search terms are not transmitted to us or to third parties.

Fonts. Fonts are delivered from our own server. There is no connection to Google Fonts or other external font services.

5. AI Assistant

On this site you can ask an AI assistant questions about the Bpanda documentation. Use is voluntary; data is only processed if you actively send a question. The answers are based on the contents of this documentation, but may nevertheless be incorrect.

Which data is processed. When you send a question, the following is transmitted to our server at IONOS:

the text of your question and the previous course of the current conversation (at most 40 messages)
the path of the page you are currently on
for technical reasons, your IP address and your user agent (see section 3)

Our server supplements the request with suitable excerpts from the documentation and forwards it to the language model. We do not pass on your IP address to the AI service.

Please do not enter any personal or confidential data, such as names, customer data, passwords or access keys. We cannot technically prevent such data from being entered.

Service provider: OpenRouter. We use OpenRouter, Inc. (USA) to connect to the language model. We use exclusively the EU in-region routing via the endpoint eu.openrouter.ai. Your requests are decrypted and processed within the EU, and only model providers with data centers in the EU may answer them. If no EU provider is available, the request is rejected instead of being processed outside the EU. As the language model we use GPT-6 from OpenAI, delivered via a model provider with a data center in the EU. In addition, we have activated Zero Data Retention: requests are only routed to providers that do not store your questions and the answers after processing. Use for training AI models is excluded. OpenRouter may store metadata of the request, such as time, model and token count, for billing purposes.
A data processing agreement in accordance with Art. 28 GDPR is in place with OpenRouter.

Purpose and legal basis. The purpose is to answer your questions about using Bpanda. The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in offering you a fast help function tailored to your needs. Your interests are safeguarded because use is voluntary, the processing takes place in the EU and content is not stored at the model provider.

Storage period. The conversation history is kept in your browser and discarded when you close the page or via “Clear conversation”. We do not store questions and answers permanently on our server; technically necessary logs are deleted after 7 days at the latest.

Objection. You can object to the processing at any time (Art. 21 GDPR), most easily by not using the assistant. The rest of the website remains fully usable.

6. Other Functions of the Site

No web analytics. We do not use any analytics or tracking tool.

“Was this page helpful?” feedback. Your rating is only displayed in your browser and is not transmitted to us or to third parties.

Machine-readable interfaces. The documentation is additionally available as Markdown, via llms.txt and a JSON interface, so that search engines and AI tools can read it. Section 3 applies accordingly to these retrievals.

“Open in chat” and external links. The site offers buttons with which you can open a page in an external AI chat (e.g. ChatGPT or Claude). You only leave our site when you click; the respective provider is then responsible for the further processing. The same applies to links to external websites.

7. Recipients and Transfer to Third Countries

The recipients of your data are exclusively our processors: IONOS SE (hosting, Germany) and OpenRouter, Inc. (USA) with the downstream model provider for GPT-6. They act on our instructions.

Thanks to EU in-region routing, your requests to the AI assistant are processed within the EU. However, OpenRouter is based in the USA. Access from the USA, for example to metadata or in the context of support, can therefore not be completely ruled out. For this case we have agreed the EU standard contractual clauses (Module 2, controller to processor) in accordance with Art. 46 para. 2 lit. c GDPR with OpenRouter. In addition, EU routing, Zero Data Retention and encrypted transmission protect your data. You can obtain a copy of the standard contractual clauses on request via the contact details in section 1.

8. Your Rights

You have the following rights vis-à-vis us with regard to your personal data:

access (Art. 15 GDPR)
rectification (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)

Right to object (Art. 21 GDPR). Insofar as we process your data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation.

To exercise your rights, a message to datenschutz@mid.de is sufficient.

Right to lodge a complaint (Art. 77 GDPR).
You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.

9. Obligation to Provide Data and Automated Decision-Making

You are not obliged to provide us with data. Without the technically necessary connection data, however, we cannot deliver the site to you. Automated decision-making including profiling in accordance with Art. 22 GDPR does not take place.

10. Changes to This Privacy Policy

We adapt this policy when the website or the legal situation changes.
The version published here at the time applies.

Last updated: September 2026