Skip to content
Back to homepage

Privacy Policy

Last updated: 2026-08

1. Data Controller, Scope and Target Audience

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the EU member states is:

Headgent GmbH
Heinrich-Peiffer-Straße 5
41540 Dormagen
Germany
Email: info@headgent.com
Commercial register: Local Court (Amtsgericht) Neuss, HRB 24129
VAT ID: DE321303256

This privacy policy applies to the websites jardis.io, docs.jardis.io and app.jardis.io, to the online services of Headgent GmbH accessible through them and to the locally executed Jardis software (collectively the “website” or “Jardis”).

B2B offering: Jardis is directed exclusively at entrepreneurs within the meaning of § 14 of the German Civil Code (BGB), legal entities under public law and special funds under public law. The offering is not intended for consumers within the meaning of § 13 BGB and not for persons under the age of 18. We do not intentionally process personal data of children within the meaning of Art. 8 GDPR.

Data protection officer: The appointment of a data protection officer is not legally required for Headgent GmbH (§ 38 BDSG) and has not been made. For any data protection enquiries, please use the contact details provided above.

2. General Information on Data Processing

We process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. Processing of personal data takes place only with the user's consent or on the basis of one of the following legal grounds:

  • Art. 6 (1) lit. a GDPR: consent of the data subject.
  • Art. 6 (1) lit. b GDPR: necessity for the performance of a contract or for pre-contractual measures.
  • Art. 6 (1) lit. c GDPR: compliance with a legal obligation.
  • Art. 6 (1) lit. f GDPR: legitimate interests, provided that the interests, fundamental rights and freedoms of the data subject do not override them.

Personal data is deleted as soon as the purpose of storage no longer applies and no statutory retention obligations conflict with deletion. On automated decision-making, see section 18.

In addition to this privacy policy, the use of Jardis is governed by our Terms of Service.

3. Provision of the Website and Server Log Files

Each time our website is accessed, data and information from the computer system of the requesting device is recorded automatically. The recording is carried out technically by our hosting provider (see sections 4 and 5), which acts as a processor on our behalf in this respect. The following data is collected:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the file accessed
  • Volume of data transferred and HTTP status code
  • Referrer URL (previously visited page)
  • Browser type and version
  • Operating system

Storage in log files takes place to ensure the functionality and security of the website, in particular to prevent and analyse attacks on our IT systems, to diagnose errors and to ensure stable operation. Log files are anonymised or deleted after 14 days at the latest, unless further retention is required for evidentiary purposes (e.g. in the event of security incidents). The actual retention period depends on the settings of the respective hosting provider.

Legal basis: Art. 6 (1) lit. f GDPR. Our legitimate interest lies in IT security, the prevention and analysis of attacks and the stable, error-free operation of our services.

4. Frontend Hosting via Vercel

The frontend of our websites jardis.io and docs.jardis.io is delivered via the infrastructure of Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA (hereinafter “Vercel”). Vercel operates a global content delivery network; requests are generally served via European edge locations, but processing in the USA cannot be ruled out.

When you access the website, Vercel processes in particular your IP address, user agent, timestamp and requested URL. This processing is technically necessary to deliver the content and to ensure the stability and security of the website.

Third-country transfer to the USA: As Vercel is based in the USA, personal data is transferred to a third country within the meaning of the GDPR. The transfer is based on the adequacy decision of the European Commission under the EU-US Data Privacy Framework (Art. 45 GDPR); Vercel Inc. is certified under the EU-US Data Privacy Framework. In addition, we have concluded EU standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR and a data processing agreement pursuant to Art. 28 GDPR with Vercel. Despite these safeguards, a level of data protection fully comparable to that of EU law cannot be guaranteed in the USA; in particular, access by US authorities cannot be entirely ruled out.

For further information, please refer to the Vercel Privacy Policy.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in a performant, globally available and secure delivery of the website) in conjunction with Art. 44 et seq., Art. 45 and Art. 46 GDPR.

5. Backend Hosting via Hetzner

Our application backends (including user account management and licence validation) are operated in data centres of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Hetzner. No personal data is transferred to third countries as part of the backend hosting.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in a technically error-free and secure provision of our services).

6. Cookies and Comparable Technologies

Our website does not use any cookies that would require consent under Section 25 (1) TDDDG. The language version you select (DE/EN) is reflected via the URL structure (/de/, /en/) and is not stored in a cookie.

Where strictly necessary storage technologies (e.g. session storage in the logged-in area at app.jardis.io) are used, they are indispensable for the operation of the respective service and fall within the exemption of Section 25 (2) no. 2 TDDDG. We do not use any marketing, tracking or profiling cookies. The web analytics service Umami (see Section 7) operates entirely without cookies and without recognition features.

Legal basis: Section 25 (2) no. 2 TDDDG and Art. 6 (1) lit. f GDPR.

7. Web Analytics with Umami Cloud

On jardis.io and docs.jardis.io we use the web analytics tool Umami Cloud to statistically analyse the use of our service and to improve our content. The provider is Umami Software, Inc., USA. jardis.io and docs.jardis.io are tracked separately under their own site IDs.

Umami is a privacy-friendly analytics service designed according to the privacy-by-design principle. In particular:

  • no cookies or comparable recognition features are set,
  • no full IP addresses are stored,
  • no personal profiles or cross-device recognition is created,
  • no data is shared with third parties for advertising or marketing purposes.

We collect anonymised usage data such as pages viewed, referrer source, rough geographical information at country level, browser and device type, and screen resolution. Due to the salting and hashing techniques applied by Umami, in our assessment a personal reference cannot be established. Should the connection data of the request nevertheless be regarded as personal data, the following information on third-country transfers applies.

Third-country transfer to the USA: As Umami Cloud is operated by a provider based in the USA, connection data (in particular the IP address in the context of the request) is transferred to a third country within the meaning of the GDPR. The transfer takes place on the basis of the EU standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR. Despite these safeguards, a level of data protection fully comparable to that of EU law cannot be guaranteed in the USA.

For further information, please refer to the Umami Privacy Policy.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in the needs-based design and statistical analysis of our website) in conjunction with Art. 44 et seq., Art. 46 GDPR. Due to the complete anonymisation and the absence of cookies, consent under Section 25 TDDDG is not required.

8. Contact by Email

You may contact us at the email address provided. In this case, the personal data transmitted with the email (at least your email address, and possibly your name and any further voluntary information) will be stored. The processing serves exclusively to handle your enquiry. The data will be deleted as soon as it is no longer required for the purpose of its collection and no statutory retention obligations apply.

Legal basis: Art. 6 (1) lit. b GDPR if the enquiry is directed at the conclusion or performance of a contract, otherwise Art. 6 (1) lit. f GDPR (legitimate interest in responding to enquiries).

9. Jardis: User Account and Licence Administration

Use of Jardis requires the creation of a user account; this also applies to the free trial. As part of registration and the subsequent contractual relationship, we process the following data:

  • Name
  • Email address
  • Password (stored only as a salted hash)
  • Licence key and the identifier of the workstation the licence is bound to (see section 10)
  • Administrative data on the licences booked and the associated workspace (number, status, term)
  • where applicable, billing data and VAT ID (see Section 11: payment processing)

The provision of the data listed above is required for the conclusion and performance of the user contract. Without this information, we are unable to provide Jardis. There is no legal obligation to provide the data; failure to provide it merely has the consequence that no contract is concluded.

The processing serves the provision of the service, authentication, management of the user account and performance of the contract. The data is stored for the duration of the contract. After termination, the account is retained for a transitional period of 30 days to allow users to export their data. Personal data is then deleted unless statutory retention obligations apply. Invoicing and accounting data is retained for 10 years pursuant to Section 147 AO and for 6 years pursuant to Section 257 HGB.

Legal basis: Art. 6 (1) lit. b GDPR (performance of contract) and Art. 6 (1) lit. c GDPR (compliance with statutory retention obligations).

10. Jardis: Local Execution, Licence Validation and Machine Binding

Jardis is built according to the principle of privacy by design: modelling and code generation take place exclusively locally on the user's machine.

Your source code, your domain models, your business logic and the contents of your projects are not transmitted by Jardis to our servers or to any third party. No content telemetry takes place. Only the licence-related data described below is transmitted.

Licence validation and binding to a workstation

Use of Jardis requires a valid licence. Each licence is technically bound to exactly one workstation (copy protection). For this purpose, an identifier of the machine on which Jardis runs is processed at activation. This identifier is a unique device characteristic; because it is linked to your user account, we treat it as personal data.

To validate the licence, Jardis establishes a connection to our servers at Hetzner in Germany. The following data is processed:

  • Licence key
  • Identifier of the workstation the licence is bound to
  • Timestamp of the request
  • Status and term of the licence
  • Technically required connection data (e.g. IP address as part of the TCP/IP connection)

The contents of your models, generated code, project data or any other payload are not part of this transmission.

If you change machines, or if the machine identifier changes due to a hardware replacement, you can transfer the licence to the new workstation via your user account. The previous and the new identifier are processed in the course of this; the previous binding is released.

In addition, we hold licence- and workspace-related administrative data linked to your user account (in particular the assignment of licences to workstations and the status of the workspace). After the contractual relationship ends, this data is retained for 30 days so that you can reactivate access; after that it is deleted. Code generated locally on your machine is unaffected and remains with you in any event.

Legal basis: Art. 6 (1) lit. b GDPR (performance of contract, in particular licence validation and licence administration) and Art. 6 (1) lit. f GDPR (legitimate interest in protecting our software against unauthorised copying and use).

Use of your own AI tools via the MCP server

Jardis includes a locally executed MCP server that lets you connect your own AI agents (such as Claude Code or comparable tools) to your workspace. We do not provide an AI service and do not operate any language model. If you connect such an agent, that agent transmits contents of your workspace to the provider you have chosen. You are responsible for that transmission and its compliance with data protection law; we are not involved in it and do not receive that data.

11. Payment Processing via Polar (Merchant of Record)

For the processing of paid orders, we use the payment service provider Polar (Polar Software Inc., 3500 South DuPont Highway, Dover, DE 19901, USA, hereinafter “Polar”).

Polar acts as a so-called Merchant of Record (MoR). This means that Polar carries out the payment processing in its own name and on its own account. With regard to payment and tax processing, Polar is therefore an independent controller within the meaning of Art. 4 no. 7 GDPR and not our processor. To the extent that Polar additionally processes customer and subscription data on our behalf and returns it to us (see section 12), Polar acts as our processor in that respect. The civil-law role of Polar and the relationship with Headgent GmbH as the licensor are set out in our Terms of Service.

In the course of payment processing, the following data is in particular transmitted to or collected directly by Polar:

  • Name
  • Email address
  • Billing address
  • VAT ID, where applicable
  • Payment data (credit card number, IBAN etc.; collected directly in the PCI-DSS-compliant environment of Polar or its payment service providers and not shared with us)
  • Order data (selected product, amount, time of order)

Third-country transfer to the USA: As Polar is based in the USA, personal data is transferred to a third country within the meaning of the GDPR. To our current knowledge, Polar Software Inc. is not certified under the EU-US Data Privacy Framework. The transfer therefore takes place exclusively on the basis of the EU standard contractual clauses pursuant to Art. 46 (2) lit. c GDPR. Despite these safeguards, a level of data protection comparable to that of EU law cannot be guaranteed in the USA; in particular, access by US authorities on the basis of FISA 702 and Executive Order 12333 cannot be entirely ruled out.

For further information on data processing by Polar, please refer to the Polar Privacy Policy.

Legal basis: Art. 6 (1) lit. b GDPR (performance of contract), Art. 6 (1) lit. c GDPR (legal obligations) and Art. 44 et seq. GDPR in conjunction with Art. 46 GDPR for the third-country transfer.

12. Polar Webhooks and Data Reconciliation

As part of the payment and subscription management, Polar transmits event and customer data to our backend at Hetzner in Germany via so-called webhooks. In this way, we receive information about account creation, successful payments, subscription changes, cancellations and refunds. The data processed includes customer name, email address, order and subscription data and a Polar-internal customer ID.

We use this data exclusively to link a Jardis user account with the corresponding Polar order, to enable the licensed features, for licence administration and for the fulfilment of contractual and statutory obligations.

Source of the data (Art. 14 GDPR): The data described in this section is not collected directly from you, but transmitted by Polar. Polar collects this data directly from you as part of the order process.

Legal basis: Art. 6 (1) lit. b GDPR (performance of contract) and Art. 6 (1) lit. c GDPR (legal obligations).

13. System Emails

In connection with the use of Jardis, we send system emails, for example to confirm registration, to reset passwords, to deliver the licence key or to inform users of contractually relevant events.

These emails are predominantly sent via the Google Workspace (Gmail) email service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (with possible data processing by Google LLC, USA). In part, emails are also sent via our own infrastructure at Hetzner in Germany. The recipient’s email address and the content of the respective email are processed in this context. A data processing agreement pursuant to Art. 28 GDPR is in place with Google. For the third-country transfer to the USA, see Section 15.

Legal basis: Art. 6 (1) lit. b GDPR (performance of contract).

14. Recipients and Processors

In the context of the processing described above, we share personal data with the following recipients:

  • Vercel Inc., Covina, USA - frontend hosting and CDN delivery of the websites (processor pursuant to Art. 28 GDPR; third-country transfer to the USA, see Section 4).
  • Hetzner Online GmbH, Gunzenhausen, Germany - hosting of the backend infrastructure including licence validation and, in part, the sending of system emails (processor pursuant to Art. 28 GDPR).
  • Umami Software, Inc., USA - web analytics via Umami Cloud (processor; third-country transfer to the USA, see Section 7).
  • Google Ireland Limited, Dublin, Ireland (with data processing by Google LLC, USA) - technical sending of system emails and handling of email correspondence via Google Workspace (Gmail) (processor pursuant to Art. 28 GDPR; third-country transfer to the USA, see Sections 8, 13 and 15).
  • Polar Software Inc., Dover, USA - payment processing as Merchant of Record (independent controller in that respect, otherwise processor; third-country transfer to the USA, see Sections 11 and 12).

Personal data is not shared with any other third parties unless we are legally obliged to do so (in particular towards tax or law enforcement authorities; legal basis Art. 6 (1) lit. c GDPR).

No further third-party services: We do not use Google Fonts on our website (the Geist typeface is served locally), nor Cal.com, nor any tracking pixels or comparable marketing tools, nor error monitoring tools such as Sentry.

15. Transfers to Third Countries

Personal data is transferred to third countries outside the European Economic Area in connection with the following services to the USA: Vercel (frontend hosting, Section 4), Umami Cloud (web analytics, Section 7), Google Workspace (email sending, Section 13) and Polar (payment processing, Sections 11 and 12). The transfers are in each case based on appropriate safeguards pursuant to Art. 44 et seq. GDPR, in particular on the EU-US Data Privacy Framework (Art. 45 GDPR, where the respective provider is certified) and the EU standard contractual clauses (Art. 46 (2) lit. c GDPR). All other processing takes place within the European Union, generally in Germany.

16. Storage Period

Personal data of the data subject is deleted or blocked as soon as the purpose of storage ceases to apply. Storage may also take place if provided for by European or national legislation. The following retention periods apply specifically:

  • Server log files: maximum 14 days
  • Account and contract data: for the duration of the contract plus a 30-day transitional period for data export
  • Licence- and workspace-related administrative data including the machine identifier: for the term of the contract plus 30 days (see section 10)
  • Invoicing and accounting data: 10 years pursuant to Section 147 AO or 6 years pursuant to Section 257 HGB
  • Email correspondence: until the enquiry has been finalised

17. SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address bar changing from “http://” to “https://” and by the lock icon in your browser bar.

18. No Automated Decision-Making

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place. Decisions producing legal effects concerning you, or similarly significantly affecting you, are not taken solely on the basis of automated processing.

19. Your Rights as a Data Subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw a given consent with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, please contact us at: info@headgent.com.

20. Right to Object pursuant to Art. 21 GDPR

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 (1) lit. f GDPR.

The controller will then no longer process the personal data, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

21. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.

The supervisory authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Düsseldorf
Germany

22. Changes to This Privacy Policy

We reserve the right to amend this privacy policy to ensure that it always complies with current legal requirements or to reflect changes to our services in the privacy policy, e.g. when introducing new services. The current version will then apply for any further visit.