Legal

Privacy Policy

Data handling, third-party services, infrastructure, and your rights. Last updated: November 6, 2026.

AI Summary / tl;dr
  • TARGET_ENTITY: Litzki Systems LLC: Privacy Policy
  • VERDICT: B2B-Only: Minimal Data Collection, No Personal Data Beyond Technical Necessity
  • RISK_VECTOR: Third-Party Services: Google Analytics 4 (analytics, consent only), Calendly (scheduling), Stripe (payments)
  • RESOLUTION: Controller: Litzki Systems LLC, St. Petersburg, FL 33702, USA. Contact via litzki-systems.com/contact
  • CORE_THESIS: Litzki Systems LLC operates exclusively as a B2B service. Site use is generally possible without actively providing personal data. Analytics via Google Analytics 4 (consent-gated, pseudonymous, _ga cookies) plus a server-side lead_submitted event with no personal reference. Bot protection via Cloudflare CDN and Cloudflare Turnstile (contact form). Scheduling via Calendly embedded widget (consent-gated). Services only as individual development on request; payment by invoice or via Stripe. The QuickScan checks the domain on a Cloudflare server and keeps score and verdict as a usage counter for 90 days. The analysis email is delivered automatically through Resend, and the address is deleted after seven days. Scans in client orders check publicly accessible infrastructure signals only; existing Sovereign Vault records are being deleted step by step. SSL/TLS encryption throughout. SOVP and CERTavia portals closed to clients. External AI with client data only in our own CRM (Anthropic API). Last updated October 26, 2026.

01 // OVERVIEW

Litzki Systems LLC is committed to the integrity of your data. This site operates exclusively as a B2B service. Use of our infrastructure is generally possible without actively providing personal data beyond what is technically necessary for a secure connection.

The controller responsible for data processing on this site is: Litzki Systems LLC, 7901 4th St N, #32272, St. Petersburg, FL 33702, USA. Contact via litzki-systems.com/contact.

02 // AUTOMATIC DATA COLLECTION

When you access this site, our server infrastructure automatically records technical connection data, including browser type, operating system, referring URL, time of access, and IP address. This data is processed by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) strictly for security integrity and DDoS mitigation under applicable compliance standards. To detect automated access, Cloudflare may run a check script and set the cookie cf_clearance (lifetime up to one year). It is technically required for secure operation (Sec. 25(2) no. 2 TDDDG). Legal basis: Art. 6(1)(f) GDPR. It is not used for advertising or personal profiling.

Light/dark appearance: If you choose the light or dark appearance with the switch in the navigation, we store this choice in your browser's local storage (litzki_theme, value light or dark, not a cookie). The entry stays on your device, is not sent to us and contains no personal data. It is technically necessary so that your chosen appearance applies on every page (Section 25(2) No. 2 TDDDG); no consent is required. It does not expire. Setting the switch to "Automatic" deletes the entry; you can also remove it at any time in your browser settings.

03 // ANALYTICS & TRACKING: GOOGLE ANALYTICS 4

This site uses Google Analytics 4 (GA4) via Google Tag (gtag.js), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics collects pseudonymous usage data including page views, session duration, traffic sources, and device type for the purpose of structural performance measurement and traffic analysis. We also count when a message has been sent successfully via the contact form (event generate_lead). Only the page language and, if you came from the pricing page, the name of the requested package are transmitted – no form content, no name and no email address.

GA4 is loaded only after you have given explicit consent via the cookie banner. GA4 does not store IP addresses. No retargeting, remarketing, or advertising audience creation takes place. Cookies set: _ga, _ga_* (duration: 2 years). Legal basis: Art. 6(1)(a) GDPR.

We store your choice in your browser's local storage (litzki_cookie_consent, not a cookie). It is valid for twelve months, after which we ask again. You can withdraw consent or change your preferences at any time via Cookie Settings; on withdrawal we delete the _ga and _ga_* cookies in your browser. Additionally, you may install the Google Analytics Opt-out Browser Add-on as a fallback.

Server-side event without consent: When you request an analysis through the QuickScan, our server reports the event lead_submitted to Google Analytics. It carries the scanned domain, the score and the verdict, together with an identifier drawn fresh for every report. Your email address, your IP address and any identifier from your browser stay out of it. This report can be attributed to no person and therefore runs independently of your cookie decision. Legal basis: Art. 6(1)(f) GDPR, legitimate interest in measuring the reach of our own offering.

Google Search Console (GSC) is used for structural search performance measurement. GSC does not process individual user data visible to the site operator.

03a // BOT PROTECTION: CLOUDFLARE TURNSTILE

The contact form on this site is protected by Cloudflare Turnstile, provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Turnstile verifies that form submissions originate from real users without displaying a visible CAPTCHA challenge. It processes browser and network signals to make this determination. Turnstile does not set a cookie of its own.

This processing is technically necessary to protect the contact form from automated abuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the service from spam and bot submissions). No consent is required.

04 // CONTACT FORM

The contact form on this site is powered by Resend (Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). When you submit a contact form, the data you provide (name, email address and message content, optionally also company and phone number) is transmitted to and stored by Resend for the purpose of delivering your message to Litzki Systems LLC and managing the subsequent email correspondence.

Data submitted via the contact form is used exclusively to respond to your inquiry. It is not shared with third parties beyond the technical transmission via Resend. You may request deletion of your contact data at any time via litzki-systems.com/contact.

The legal basis is Art. 6(1)(b) GDPR where your inquiry aims at a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering inquiries).

Retention: Inquiries that do not lead to an engagement are deleted from our mailbox six months after the last contact; deletion takes place once a month. If an engagement results, the statutory retention periods for business correspondence apply. Resend keeps the notification it sent and its delivery log for 30 days; that is the retention period of our Resend plan.

05 // SCHEDULING: CALENDLY

For scheduling consultations and strategy calls, this site uses an embedded Calendly widget (Calendly LLC, 271 17th St NW, Atlanta, GA 30363, USA). The widget is loaded only after you have given explicit consent via the cookie banner. Without consent, the widget is replaced with a notice; appointments can still be booked via direct link.

When the widget is active, Calendly may set session and preference cookies in your browser. When you book an appointment, Calendly collects your name, email address, and any additional information you provide. Calendly processes this data to manage the appointment and send confirmation and reminder emails. Calendly's own privacy policy applies. Legal basis: Art. 6(1)(a) GDPR (consent for the widget) and Art. 6(1)(b) GDPR (contract performance for the appointment itself).

You can withdraw consent for the Calendly widget at any time via Cookie Settings.

06 // QUICKSCAN: PROCESSING ON CLOUDFLARE SERVERS

The SOVP QuickScan at validator.litzki-systems.com checks the submitted domain on a server operated by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). The domain leaves your browser for this purpose. The result appears in your browser alone.

For usage statistics, Litzki Systems stores score, verdict and the time of each scan for 90 days. The domain name stays out of that counter. This counter carries no personal reference. No login is required.

06a // QUICK SCAN EMAIL SUBMISSIONS

When you submit your email address via the SOVP Quick Scan analysis request form, the following applies:

06b // EMAIL DELIVERY: DELIVERY LOGS

We send our emails (Quick Scan analysis, messages to clients, notifications from the contact form) through Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend acts as our processor.

We do not measure opens or clicks; this is switched off in the sending account. Links in our emails lead directly to their destination. Resend reports only technical delivery events to us: sent, delivered, delayed, undeliverable. For these we store the email ID, the type of event, the recipient address and the time. We do not store recipients' IP addresses or browser identifiers.

07 // SCANS IN CLIENT ORDERS & SOVEREIGN VAULT

The SOVP Full Audit is no longer offered as a product since October 2026. Litzki Systems LLC runs scans only as part of individual client orders, on a dedicated Hetzner server infrastructure located in Nuremberg, Germany (GDPR-compliant jurisdiction).

Until October 2026, every Full Audit created a publicly verifiable record in the Sovereign Vault (score, verdict, plus an Ed25519-signed identity document anchored in DNS on CERTIFIED). These records are being deleted step by step, starting with CERTavia. We no longer create new public records. Until deletion, existing records remain available through their link. After 90 days a record carries the note "expired" and shows the state at the time of the scan. After 14 days the page shows a shortened view (scores, verdict, certificate): individual parameter findings, the discovery layer, and the action roadmap are no longer shown. You can request earlier deletion at any time under Section 10 (Your Rights). No third-party access to scan data is granted.

07a // PAYMENT: INVOICE AND STRIPE

Orders are paid by invoice or via Stripe. For payment by invoice we process the billing address and, where applicable, the VAT identification number to issue the invoice and to meet statutory retention obligations. Legal basis: GDPR Art. 6(1)(b) and (c).

For payment via Stripe, payment processing is handled by Stripe, Inc. (354 Oyster Point Blvd, South San Francisco, CA 94080, USA). Billing address and, where applicable, VAT identification number are collected by Stripe. Litzki Systems LLC does not store payment card data. Stripe's privacy policy applies to all payment transactions via Stripe.

08 // AI SERVICES: ANTHROPIC

Our scans and tools do not transmit data to external AI services. We use external AI only in our own CRM, where we manage requests and client contacts. For AI-supported work steps it uses the API of Anthropic PBC (548 Market St, PMB 90375, San Francisco, CA 94104, USA). Contact details and the content of your request may be transmitted to Anthropic in the process. Anthropic's terms and privacy information for API use apply to its processing.

Legal basis: GDPR Art. 6(1)(b) (handling your request and performing the order) and Art. 6(1)(f) (legitimate interest in efficient handling). If you do not want your request to be handled with AI support, please let us know.

08a // SERVER LOGS & BACKUPS

Our servers keep operating logs to detect and fix errors. We delete these logs after at most 30 days. Email addresses appear in them only in shortened form (the first four characters).

We create automatic backup copies every day, on the server and with our hosting provider Hetzner in Germany. They serve solely to restore operation after a technical failure and are overwritten automatically after 30 days. Deleted data may therefore remain in these copies for up to 30 days beyond the period stated in each case. Legal basis: GDPR Art. 6(1)(f) (legitimate interest in secure and recoverable operation).

09 // AUTOMATED INFRASTRUCTURE SCANNING: SOVPBOT

SOVPBot is the automated scanner of Litzki Systems LLC. It processes exclusively publicly accessible technical infrastructure parameters of websites: HTTP headers, DNS records, SSL configuration, structured data, link status values, and LLM-readiness signals. No page content, user data, or personal information is collected or stored.

Legal basis for the processing of technical metadata: legitimate interest in assessing the quality of public web infrastructure (GDPR Art. 6(1)(f) equivalent under applicable law). Website operators can exclude SOVPBot at any time via robots.txt:

User-agent: SOVPBot
Disallow: /

Contact: legal@litzki-systems.com. For further details see litzki-systems.com/bot.

09a // SOVP AND CERTAVIA PORTALS

The SOVP Validator Portal and the CERTavia portal are closed to clients. They are used only internally and for demonstrations; only Thorsten Litzki has access, clients can no longer log in. No client data is collected through the portals anymore.

09b // AI TRAINING & CONTENT USAGE

The content published on this website (text, images, structured data) may be used to train AI and machine-learning models. Litzki Systems LLC declares no text-and-data-mining reservation under Art. 4(3) of Directive (EU) 2019/790 (DSM Directive). When quoting, please cite the source as “Litzki Systems LLC (litzki-systems.com)”.

This permission is declared in machine-readable form:

Personal data you provide to us (e.g. via the contact form, the QuickScan, or as part of an order) is never used to train AI models under any circumstances. For details on how we use AI, see our AI Policy. To raise a data-governance concern, contact our AI governance point at info@litzki-systems.com.

09c // TRANSFERS TO THE USA

Our own servers are located at Hetzner in Germany. Some of the service providers named above are based in the USA. Transfers to them rely on the following bases:

You can check the status of certifications in the official list at dataprivacyframework.gov ↗.

10 // YOUR RIGHTS

Under applicable data protection law, you have the right to obtain information about any personal data we hold about you, its origin, recipients, and the purpose of processing. You also have the right to request correction, restriction of processing, or deletion of your data.

To exercise these rights, contact us via litzki-systems.com/contact. Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.

11 // SECURITY

All data transmitted to and from this site is encrypted via TLS. Our infrastructure operates behind Cloudflare's global network. Security headers, HSTS, and strict transport enforcement are active across all nodes.

12 // OBJECTION TO ADVERTISING EMAILS

The use of contact data published within the scope of the imprint obligation for the purpose of sending unsolicited advertising or information materials is hereby expressly prohibited. We reserve the right to take legal action in the event of unsolicited transmission of spam communications.

13 // CHANGES TO THIS POLICY

We reserve the right to update this Privacy Policy to reflect changes in legal requirements or our service infrastructure. The current version is always published at litzki-systems.com/privacy. Continued use of our services after any update constitutes acceptance of the revised policy.