Privacy Policy
The short version
Visiting this website stores nothing about you. There are no cookies, no analytics, no tracking and no content from other companies: every file comes from our own server in Germany.
To deliver a page, the server has to see your IP address and the request your browser sends. It uses them to answer and then forgets them, because it keeps no access log.
If you email us, we use your message only to reply, and to tell you about the launch if you ask for it.
The rest of this page is the complete version.
Who is responsible
Leeos is a product of heuser.design. The controller for personal data on this website (Art. 4(7) GDPR) is:
Leo Heuser
heuser.design (sole proprietorship)
Frettholt 10
48739 Legden
Germany
Email: leo@heuser.design
Phone: +49 163 1957214
No data protection officer is appointed. Neither Art. 37 GDPR nor § 38(1) BDSG requires one, because fewer than 20 people regularly process personal data by automated means.
What this policy covers
This policy covers the website www.leeos.app, including leeos.app, which only leads there. The Leeos Box and the Leeos apps will get their own privacy policy before they launch.
Links to other websites, such as heuser.design, lead to pages with their own privacy policies. This website tells them nothing about you: it sends no referrer, so they do not learn that you came from here.
When you visit the website
For every page and file, your browser sends a request to our server. To answer it, the server has to process:
- your IP address
- the date and time
- the address requested
- the technical details your browser sends along, such as browser type and preferred languages
The server uses this only to deliver the page. Your browser's preferred languages also decide whether www.leeos.app opens in German or English. Nothing of this is written to an access log: once the answer is sent, the request is forgotten.
One exception: if the server itself fails to answer (a server error), it records that request, including the IP address, in its error log so the fault can be found. These entries are deleted automatically after 14 days at the latest.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to deliver the website and keep it running and secure. Without your IP address the page cannot reach you, so the website cannot be used without it.
Hosting
The website runs on a cloud server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data center in Falkenstein, Germany. Hetzner processes data only on our behalf, under a data processing agreement according to Art. 28 GDPR. Your data does not leave the EU.
No cookies, no tracking
This website sets no cookies and stores nothing in your browser's storage. There is no analytics, no tracking pixel, no advertising and no social media plugin.
Fonts, images and scripts all come from our own server, so the website makes your browser contact no one else. Since nothing is stored on or read from your device beyond what is strictly necessary to show the website, no consent is needed under § 25 TDDDG, and there is no cookie banner.
When you email us
If you write to leo@heuser.design, we receive your email address, your message and whatever you include. We use them only to answer you and handle your request.
The legal basis is Art. 6(1)(b) GDPR if your message concerns a contract or its preparation, such as a question about buying Leeos. Otherwise it is Art. 6(1)(f) GDPR, our legitimate interest in answering you.
If you ask us to let you know when Leeos launches, we email you once at launch. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to us.
Emails are stored on mail servers of wint.global GmbH, In der Steele 35, 40599 Düsseldorf, Germany, which processes them only on our behalf under a data processing agreement according to Art. 28 GDPR.
How long data is kept
- Requests to the website: not stored, only held while they are answered.
- Error log entries after a server error: 14 days at most.
- Emails: three years after the conversation ends, so we can pick it up again, unless you ask us to delete them sooner. Emails that are business letters are kept for six years, and those that are accounting records for eight years, as German law requires (§ 257 HGB, § 147 AO).
- Launch notice requests: used only for the one email at launch, and no longer once you withdraw your consent. The email itself is kept as above.
Who else sees data
Only Hetzner (hosting) and wint.global (email), both only on our behalf. We do not sell or share personal data, and we make no automated decisions or profiles about you (Art. 22 GDPR).
Your rights
Under the GDPR you have the right to:
- access the data we hold about you (Art. 15)
- have it corrected (Art. 16)
- have it deleted (Art. 17)
- restrict its processing (Art. 18)
- receive it in a portable format (Art. 20)
Write to leo@heuser.design. We answer within one month (Art. 12(3) GDPR). In complex cases this can be extended, and we tell you if it is.
Because the website stores nothing about visitors, we usually hold no data about a visit and cannot link one to a person (Art. 11 GDPR). For emails, all of these rights apply in full.
Your right to object
Where we process data based on Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation (Art. 21 GDPR). We then stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves legal claims. This right also applies where we cannot identify you.
Complaints
You can complain to a data protection supervisory authority (Art. 77 GDPR), in particular the one where you live or work. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Düsseldorf
Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
https://www.ldi.nrw.de
Outside the EU
We apply the standard described here to every visitor, wherever you live. Wherever you are, you can write to leo@heuser.design to use the rights your local law gives you, and we will handle your request under that law.
Security
The website can only be reached over encrypted HTTPS, and your browser remembers to always use it. A strict content security policy keeps the pages from loading anything from other servers. The website has no server code, no database and no user accounts, so there is no collection of visitor data that could leak. No system is perfectly secure, but data that is never collected cannot be lost.
Changes
When the website changes how it handles data, we update this policy before the change goes live.
This version is effective from October 1, 2026. It exists in German and English; the German version prevails.