Privacy Policy

The controller for the processing described in this policy, within the meaning of Article 4(7) GDPR, is the operator of Atlas Munich named below. The same details serve as provider identification under section 5 of the German Digital Services Act (DDG) and section 18(2) of the Interstate Media Treaty (MStV).

Atlas Munich is run by volunteers on a non-commercial basis. Because we neither process special categories of data at scale nor carry out regular and systematic large scale monitoring, we are not required to appoint a Data Protection Officer under Article 37 GDPR. Data protection requests go to the address above and are handled by the operator personally.

We are established in Germany and address the German and European market, so the GDPR, the Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG) apply to this service.

You can read every guide, answer and place listing on Atlas Munich without telling us anything about yourself. The categories below are the complete set of data the service handles.

Access and server log data

Each time a page or asset is requested, our hosting provider processes technical connection data: the IP address of the requesting device, date and time, the resource requested, the HTTP status and volume transferred, the referring page, and the browser and operating system identifiers your device sends. This is technically necessary to deliver the page and to keep the service stable and secure. It is not merged with other sources and is not used to identify you.

Usage analytics

We use Vercel Web Analytics and Vercel Speed Insights. Both are cookieless and neither sets nor reads identifiers on your device. They report aggregate figures such as page views, referrer category, country level region, device type and page loading performance. A short lived, non-reversible hash derived from request properties is used only to separate one visit from another, and we cannot trace it back to a person.

AI assistant conversations

If you open one of the assistants, the messages you type, the assistant you selected, your interface language and the path of the page you were on are transmitted to our AI processor so that a reply can be generated. Conversations are not written to any database of ours and are not linked to a profile: they are stored only in your browser's local storage, on your own device, until you clear them or your browser does. The technical detail is in section 6.

Content-gap signal

When an assistant cannot find anything relevant in our own guides or FAQs to answer your question, we log that this happened: which assistant, whether a match was found, and when. We never log the question itself, the answer, or anything else about the conversation. This is used only to see which topics our guides are missing.

Abuse prevention

To stop a single client from overwhelming the assistant endpoint, the IP address supplied by our hosting proxy is held in volatile server memory together with a request counter for a rolling window of ten minutes and is then discarded. No record of these counters is written to disk.

Contact by email

If you write to us, your address and the content of your message are processed to answer you and, where a legal record is required, kept as correspondence. Nothing you send us is used for any other purpose.

Location and route planning

The places map can sort by distance and draw a route. Your position is read only after you explicitly allow it, never on page load. Sorting, filtering and straight line distances are calculated entirely in your browser and your position is not transmitted for them. Only when you ask for directions to a place are coordinates sent, as a POST body so they never appear in any URL or log: your position and the place or places involved, up to five stops if you are planning a multi-stop trip, go to our server, which forwards them to the routing service and returns the road geometry. We do not log, store or retain those coordinates, and because the request is relayed by our server the routing service never receives your IP address and cannot connect the request to you. Your position and your planned stops are held in the page only, are never written to storage or a cookie, and disappear when you reload the page or turn location off.

Art. 6(1)(a), consent

Where we ever ask for consent, for example if an optional embedded service were introduced, processing happens only after you agree, and you may withdraw at any time with effect for the future.

Art. 6(1)(b), steps at your request

Delivering an answer from an assistant you chose to open is processing needed to provide the service you asked for.

Art. 6(1)(c), legal obligation

Where statutory duties require us to retain or disclose data, for example in response to a lawful order.

Art. 6(1)(f), legitimate interests

Operating, securing and improving a free information service, as set out in the balancing test below.

Our balancing test for legitimate interests

Our interest is in running a site that loads, stays online, resists abuse and improves over time. The processing is limited to what a web server unavoidably sees plus aggregate statistics. We build no profiles, we do not track you across sites, and we enrich the data from no other source. Because the intrusion is minimal and no reasonable visitor would expect a website to run without it, we consider that your interests and fundamental rights do not override ours. You may object at any time on grounds relating to your particular situation under Article 21(1) GDPR.

Atlas Munich uses no tracking cookies, no advertising pixels, no social media plugins and no fingerprinting. There is no consent banner because we carry out no processing that requires consent under section 25(1) TDDDG.

A small family of entries is written to your browser local storage. All of them are strictly necessary to provide the service you explicitly requested and are therefore exempt from consent under section 25(2) no. 2 TDDDG. They remain on your device, are readable only by this site, and are never transmitted to us.

You can delete both at any time through your browser settings for site data, and everything on the site keeps working afterwards. Your browser may also let you block storage for this site entirely.

Map tiles on the places page are loaded from a third party and therefore involve your IP address. That is described in section 7.

The assistants run on a large language model operated by OpenAI as our processor. When you send a message, the following is transmitted: the text of your message, up to the last twenty turns of the current conversation for context, the assistant you selected, your interface language and the path of the page you were on. Nothing else is attached: no name, no account, no cookie and no analytics identifier.

We do not store your conversations on our servers. They are saved only in your browser's local storage, on this device, and persist across visits until you clear your browser's site data or clear the conversation yourself. They are never transmitted to us or readable by us outside the single request needed to generate each reply. Under the applicable API terms, inputs and outputs are not used to train the provider's models, and they are retained by the provider for up to thirty days solely to detect abuse before being deleted, unless a longer period is required by law.

Message length, conversation length and request frequency are all capped, both to protect the service and to limit how much data can be sent in the first place.

No automated decision making

The assistants produce information, nothing more. No decision producing legal effects concerning you or similarly significantly affecting you is taken automatically, so Article 22 GDPR does not apply. Whether to act on an answer is entirely your choice, and we recommend confirming anything important with the official source.

Accuracy and human oversight

AI output can be outdated, incomplete or confidently wrong, particularly on immigration, tax, health and legal matters where rules change often. Treat every answer as a starting point for your own research. Report a wrong or harmful answer to us and we will review the underlying instructions.

We keep the number of third parties as small as a modern website allows. Where a provider processes personal data on our behalf, a data processing agreement under Article 28 GDPR is in place. We do not sell personal data, we do not pass it to data brokers, and we do not use it for advertising.

Links to other websites

Guides link out to public authorities, universities, housing platforms and similar resources. Once you follow such a link you are on someone else's site under their privacy policy, over which we have no control and for which we accept no responsibility. The QR code shown on the about page is fetched by our server rather than by your browser, so your address is not disclosed to that service.

Beyond the table above, personal data is disclosed only where we are legally obliged to do so, for example in response to a lawful order from a competent authority or a court.

Some of the providers listed above are established in the United States or process data there, so a transfer to a third country within the meaning of Chapter V of the GDPR takes place.

• Where the recipient is certified under the EU-US Data Privacy Framework, the transfer relies on the adequacy decision of the European Commission of 10 July 2023 under Article 45 GDPR.
• Otherwise the transfer relies on the Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) GDPR, supplemented where necessary by a transfer impact assessment and technical measures such as encryption in transit.
• Where a provider offers processing inside the European Union, we select that option.

You should be aware that authorities in the United States may in principle be able to require access to data held by providers subject to their jurisdiction, and that the legal remedies available to you there may not match those under EU law. You may ask us for a copy of the safeguards in place using the contact details in section 2.

We hold personal data only for as long as the purpose it was collected for requires. After that it is deleted or, where an overriding retention duty exists, restricted from any further processing.

• Server logs: held by the hosting provider for a short operational window, as a rule no longer than thirty days, unless a specific security incident requires a longer look.
• Analytics: only aggregated figures survive the visit, so there is nothing left to attribute to an individual.
• Assistant conversations: not stored on our servers at all. They persist in your browser's local storage on your own device until you clear them, and are separately held by the AI processor for up to thirty days for abuse detection.
• Rate limit counters: volatile memory only, at most ten minutes, and lost on every deployment or restart.
• Local storage: entirely under your control and removable at any time.
• Email: deleted once the matter is settled, unless commercial or tax law requires the correspondence to be kept, in which case it is restricted until the period expires.

You have the following rights in respect of personal data relating to you. Exercising them is free of charge, and we answer within one month of receiving your request. That period may be extended by a further two months for complex requests, in which case we tell you why within the first month.

Access, Art. 15

Confirmation of whether we process data about you and, if so, a copy of it together with the purposes, recipients, retention periods and the source.

Rectification, Art. 16

Correction of inaccurate data and completion of incomplete data.

Erasure, Art. 17

Deletion where the data is no longer needed, where you withdrew consent, where you successfully objected, or where processing was unlawful.

Restriction, Art. 18

Marking data so that it is only stored, for example while a dispute over its accuracy is being resolved.

Portability, Art. 20

Receiving data you provided in a structured, commonly used and machine readable format, and having it transmitted to another controller where technically feasible.

Objection, Art. 21

Objecting to processing based on legitimate interests, on grounds relating to your particular situation.

Withdrawal of consent, Art. 7(3)

Where processing rests on consent, withdrawing it at any time with effect for the future, without affecting the lawfulness of processing carried out before.

Complaint, Art. 77

Lodging a complaint with a supervisory authority, in particular in the country of your habitual residence, your place of work, or the place of the alleged infringement.

To help us respond, tell us which processing you mean and, where the request concerns data we could only recognise technically, anything that helps us locate it. We may ask for information to confirm that the request really comes from you, but only where we have reasonable doubts about your identity, and never more than is necessary.

You may lodge a complaint with any supervisory authority. The authority responsible for the controller is:

We take the measures below to protect personal data against unauthorised access, alteration, loss and disclosure. They are proportionate to the risk of a site that holds no accounts, no passwords and no customer database, and they follow the state of the art referred to in Article 32 GDPR. Our approach draws on recognised frameworks including ISO/IEC 27001 Annex A, the OWASP Application Security Verification Standard and the OWASP Top Ten, although the project does not claim certification against any of them.

• Transport encryption: the whole site is served exclusively over HTTPS with modern TLS, and plain HTTP requests are redirected.
• A strict Content Security Policy restricting scripts, styles, images, fonts and network connections to known origins, with framing, plugins and cross-origin form submission disabled.
• Security response headers on every route: X-Content-Type-Options, X-Frame-Options, a strict referrer policy, and a Permissions Policy that switches off the camera, microphone and interest cohort APIs entirely, and restricts geolocation to this site itself, where the places map only reads it after your explicit consent.
• Input hardening on the assistant endpoint: payload size limits, message count and length caps, strict role separation between user and assistant turns so that instructions cannot be spoofed, and per client rate limiting.
• Data minimisation by design: no accounts, no stored passwords, no payment data, no advertising identifiers, and no database of visitor data that could be breached.
• Secrets such as API keys are held in the hosting platform's encrypted environment configuration, never in the source repository, and can be rotated at any time.
• Dependencies are pinned and updated regularly, and the source code is public so that weaknesses can be found and reported openly.
• Access to the deployment platform is limited to the maintainers and protected by multi factor authentication.

Reporting a vulnerability

If you find a security or privacy weakness, please tell us at hamza.chaouki@tum.de before disclosing it publicly and give us a reasonable period to fix it. We will not pursue good faith security research that respects user privacy, avoids service disruption, and does not access data beyond what is needed to demonstrate the issue.

Personal data breaches

If a breach occurs that is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority without undue delay and, where feasible, within seventy two hours of becoming aware of it, in line with Article 33 GDPR. Where the breach is likely to result in a high risk to you, we also inform affected people directly as required by Article 34 GDPR.

No online service can promise absolute security. Transmission over the internet always carries a residual risk, which is one more reason not to type sensitive information into a chat window.

Atlas Munich is aimed at students, professionals and families arriving in Munich and is not directed at children. We do not knowingly process personal data of persons under sixteen years of age. In Germany, Article 8 GDPR read with the national age limit sets sixteen as the age from which a young person can consent on their own behalf in relation to information society services.

If you are a parent or guardian and believe that a minor has provided personal data to us, in particular through an assistant conversation, contact us at hamza.chaouki@tum.de and we will delete whatever we can identify without undue delay.

We review this policy whenever the service changes, whenever a provider changes, and at least once a year. The version and the date shown at the top of this page always identify the text in force. Material changes are announced on the site before they take effect wherever that is practicable, and the version in force at the time of your visit applies to that visit. Earlier versions remain visible in the history of the public source repository at github.com/HamzaChx/Atlas-Munich.

For any question, request or complaint about data protection, write to hamza.chaouki@tum.de and say clearly what you are asking for. We answer in English, German or French.

You always retain the right to complain to a supervisory authority, whether the one responsible for us or the one where you live or work.