Privacy notice

Updated: 2 October 2026

1. who is responsible

Carsten Christiani, elegant.work
Kaiserstrasse 161, 41061 Mönchengladbach, Germany
Email: [email protected]

Carsten Christiani is the controller for the personal data described here (Article 4(7) of the General Data Protection Regulation, GDPR). For anything about your data, write to the address above.

2. the short version

Reading this site leaves almost nothing behind. There are no cookies, no analytics, no advertising and no social media plug-ins, and every page, font and picture comes from this site itself.

One small thing is stored in your browser: your choice of light or dark display, and only if you make that choice yourself.

We receive personal data only when you hand it over: when you write to us, book a conversation or run the diagnostic. Each of these is explained below, with who else sees it and how long we keep it.

3. visiting the site

The site is delivered by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. To send you a page, Cloudflare's servers necessarily process your IP address, the page you asked for, the time, and the technical details your browser sends with every request (such as browser type and the page you came from).

Purpose: to deliver the site and to protect it against attacks and overload.
Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is a site that loads and stays up.

We keep no visitor log of our own for ordinary page views, and Cloudflare's visitor statistics are switched off for this site.

Cloudflare acts on our behalf under its data processing agreement (Article 28 GDPR). Cloudflare is a US company, so data can reach the United States. Cloudflare states that it takes part in the EU-US Data Privacy Framework, for which the European Commission has decided that the US ensures adequate protection (Article 45 GDPR); its agreement also contains the EU Standard Contractual Clauses (Article 46 GDPR).

4. what is stored on your device

The light/dark switch. When you click the switch at the top of the page, your browser stores one entry in its local storage: the name "ew-mode" and the value "light" or "dark". On your next visit the page reads it and shows the version you chose. It stays until you clear this site's data in your browser. It is never sent to us, and our server never sees it. If you never click the switch, nothing is stored, and the page simply follows the light or dark setting of your device.

This storage is allowed without asking you first, because it is strictly necessary to provide something you explicitly asked for by clicking (Section 25(2) no. 2 of the German Telecommunications and Digital Services Data Protection Act, TDDDG).

Unsent diagnostic answers. While you fill in the diagnostic, the page keeps what you have typed in your browser's session storage, so that nothing is lost if your link expires before you send. It is deleted as soon as we have received your answers, and in any case when you close the tab. It is never sent anywhere until you press send. The same legal provision applies.

Nothing else. This site sets no cookies and reads nothing else from your device.

Why there is no cookie banner. The German rule behind cookie banners asks for your consent before a site stores something on your device or reads it, unless that is strictly necessary for what you asked for. The display choice is exactly that, so there is nothing to ask. We do not track you because we do not want to. We would rather make the offer we think is right and have the right people recognise it than watch where you move your mouse.

5. writing to US by email

If you write to [email protected], we receive your email address, your name if you give it, and what you write.

Purpose: to answer you.
Legal basis: Article 6(1)(b) GDPR where your message is about working with us; otherwise Article 6(1)(f) GDPR, our legitimate interest in answering the people who write to us.

Our mailbox is hosted by our email host, LightningBase, which receives and stores the messages sent to [email protected].

We keep your message as long as the conversation needs it. Where tax or commercial law requires us to keep business correspondence, we keep it for the period the law prescribes and then delete it.

6. booking a conversation

"Book a conversation" takes you to a booking page run by Notion Calendar. At that point you leave this site. What you enter there, usually your name, your email address, the time you choose and anything you add, is collected on Notion's page and passed to us.

We use it to hold the conversation you booked. Legal basis: Article 6(1)(b) GDPR.

What Notion itself does on its page, including any cookies it sets, is governed by Notion's own privacy notice: notion.com/privacy.

If you would rather not use Notion, write to [email protected] and we will find a time by email.

7. the diagnostic

7.1 What it is

You describe one situation from your organisation and answer a few questions about it. An AI model made by Anthropic writes a first read from your answers, following our instructions. Carsten reads every read within two working days. If it got something badly wrong, he will write to you about it.

7.2 What we collect

• Your email address, to send you a one-time link to the diagnostic.
• The link itself and the time it was issued.
• Your answers: the situation you describe, your answers to the other questions, and your role, the size of your organisation and, if you give it, its sector.
• The read the model writes, and the emails we compose to you.
• Your feedback on the read, if you give any.
• Your IP address, to stop the diagnostic being flooded (see 7.8).

We do not ask for your name or your organisation's name. Please leave names of colleagues and customers out of your answers as well; a role is enough. The model is instructed to replace any name it finds with a role.

7.3 Who sees it

• Carsten Christiani reads your answers and the read.
• Anthropic receives your answers in order to write the read (see 7.4).
• Cloudflare runs the service and the database that holds it, on our behalf (see section 3). The database is set to Western Europe (Amsterdam); Cloudflare treats this setting as a preference rather than a guarantee.
• Our email provider delivers the emails (see section 9).

Nobody else. We do not sell or share it.

7.4 Anthropic

What is sent: your answers together with the questions they answer, and our instructions to the model. Your email address and your IP address are not sent.

Anthropic processes your answers on our behalf under the data processing agreement that is part of its commercial terms (Article 28 GDPR). The model runs in the United States. The transfer is covered by the EU Standard Contractual Clauses in that agreement (Article 46 GDPR).

Anthropic's commercial terms state that Anthropic may not train its models on content submitted through its API.

According to its published retention policy, Anthropic deletes what we send and what the model returns within 30 days, and keeps data longer only where it flags a breach of its usage policy (up to two years) or where the law requires it.

7.5 Why we may do this

• Producing the read you asked for, and sending it to you: Article 6(1)(b) GDPR.
• Keeping your answers and the read for 90 days so you can come back to them: Article 6(1)(b) GDPR.
• Carsten reading every read, writing to you if it went badly wrong, and using the reads to see whether the diagnostic is any good: Article 6(1)(f) GDPR. Our legitimate interest is a tool that tells people something true, and a person who stands behind what it says.
• Limiting abuse by IP address: Article 6(1)(f) GDPR. Our legitimate interest is a tool that a script cannot drain.

You can object to the processing based on legitimate interest at any time (see section 11).

7.6 No automated decision about you

The read is text for you to think with. It is not a decision about you, and nothing follows from it automatically. There is no automated decision-making within the meaning of Article 22 GDPR.

7.7 Do you have to

No. Everything is voluntary. Without an email address we cannot send you a link; without answers there is nothing to read.

7.8 How long we keep it

• The one-time link works for 48 hours.
• Your email address, the link, your answers, the read, your feedback and the emails we composed to you are deleted automatically 90 days after they were created. Your private read link stops working at the same moment. Save the read as a PDF if you want to keep it.
• Your IP address is deleted after one day at the latest.
• Our server logs record the time and outcome of each step. They contain no email address, no link and none of your answers, and Cloudflare deletes them after three days.
• Anthropic's retention is described in 7.4.

Write to [email protected] and we delete it sooner.

8. the updates list

This site has no sign-up form for an updates list. If we add one, this notice will first describe it, including who runs the list for us.

9. emails we send you

The diagnostic sends you two kinds of email: the one-time link, and a message when your read is ready, with its private address. These are part of the service you asked for. They do not put you on any list.

They are sent from [email protected] through the mail server of our email host, LightningBase, which receives your email address and the text of the message, including your private link, for that purpose. We keep a record of each send: your address, the time, the kind of message and whether it was delivered. The message text itself is not kept once it has been delivered; it is kept for 90 days only if it could not be sent.

Legal basis: Article 6(1)(b) GDPR.

10. links to other sites

Some pages link to LinkedIn profiles, to Notion Calendar and to Anthropic's privacy page. Nothing from those sites is loaded while you read ours. Only when you click does your browser go there, and from then on that site's own privacy notice applies.

11. your rights

You can ask us:
- what we hold about you, and for a copy (Article 15 GDPR);
- to correct it (Article 16);
- to delete it (Article 17);
- to restrict how we use it (Article 18);
- to give it to you, or to someone else, in a common machine-readable format, where we process it on the basis of your consent or a contract (Article 20).

Where you gave consent, you can withdraw it at any time, with effect for the future (Article 7(3)).

Your right to object. Where we process your data on the basis of our legitimate interest (Article 6(1)(f) GDPR), you can object at any time, on grounds relating to your particular situation (Article 21 GDPR). We then stop, unless we can show compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims.

Write to [email protected]. We answer within one month.

12. your right to complain

You can complain to a data protection supervisory authority (Article 77 GDPR), in particular in the EU country where you live or work. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44, 40102 Düsseldorf, Germany
[email protected]
www.ldi.nrw.de

13. changes

When what the site does changes, this notice changes first. The date at the top shows the current version.

This notice is also available in German: Deutsche Fassung.