Privacy Policy

Last updated: September 2026

This is an English courtesy translation. The German version is legally authoritative.

This website (mboiman.github.io) is a personal CV site with an optional AI chat assistant. Personal data is processed only to the extent described below. There is no tracking, no advertising and no analytics cookies.

1. Controller

2. Visiting the website (hosting)

The site is served as a static page via GitHub Pages (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). When you visit, GitHub processes technically necessary access data (including IP address, date and time, the resource requested, amount of data transferred, browser type) in order to deliver the page and keep operation secure and stable. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, functional provision).

3. AI chat assistant

The site offers an optional chat assistant (the agent). It answers questions about Michael Boiman's professional profile and takes inquiries and meeting requests on his behalf. Use is voluntary, your input is only processed if you send a message yourself. The same agent is also reachable for other software agents atmboiman.bks-lab.com. This section applies accordingly to messages sent that way.

Answers and logs

• Generating answers: Your message is sent to the agent endpointmboiman.bks-lab.com. The agent runs on a computer owned by Michael Boiman. The answer is generated by a language model fromAnthropic ("Claude"). For this, Anthropic receives your message, the conversation so far and the page context (next item). Transport runs throughCloudflare, which processes technical connection data (including IP address) to protect the service against abuse and overload.
• What travels with a message: Alongside your input, technical details are transmitted: the path of the open page, the selected interface language, the section currently in view, that page's anchors, which controls the chat window can display (such as suggestion buttons) and the technical session identifier (see "Local browser storage"). They let the agent point at a specific place in the CV and assign your messages to one conversation. No other details about you and no content from other websites are sent.
• Fetching the agent card: When the chat window opens, the agent's public agent card (agent-card.json) is fetched once per page view, on every page of this website, including the legal notice and this privacy notice. This also applies when the window opens by itself because you left it open on your last visit, and when you open a page through a link with #agent, which opens the chat window. On the pages that display the agent's reachability status, it is also fetched as the page loads, without any action on your part. Your IP address is transmitted to the endpoint named above in doing so and recorded there in the computer's operational log (see "Operational logs"). No input is sent, and the fetch itself stores nothing in your browser.
• Conversation history: So the agent can build on earlier messages, it keeps the history of a conversation in memory. It is lost when the service restarts. In addition, the Claude software stores a session file on the computer for every answer, containing your message, the conversation so far and the answer.
• Conversation logs: Every question and every answer is logged in plain text together with the conversation identifier, its sequence number and the response time. The logs are kept at Elastic Cloud in an account of Boiman Kupermann Solutions GmbH (BKS-Lab), stored in Frankfurt am Main (Amazon Web Services region eu-central-1). They can be read by Michael Boiman and by anyone with access to that account or to one of its access keys. Boiman Kupermann Solutions GmbH also uses the account for other projects, including a client project in which such a key is currently stored. The logs serve operation and troubleshooting, detecting abuse and improving the answers (see "Evaluations"). This logging has been in place since 6 August 2026.
• Operational logs: In addition, logs without conversation content are kept at Elastic Cloud and on the computer (conversation identifier, time, duration, length of request and answer, outcome). The operational log on the computer also records every request to the endpoint with your IP address, the address requested and the outcome, including the agent card fetch. The operational logs serve secure and stable operation and the prevention of abuse.
• Consulting other agents: Questions about BKS-Lab or the open-bridge project are passed on in general form, without your name or contact details, to two further agents. They run on the same computer and work the same way (answers via Anthropic, logs at Elastic Cloud).

Inquiries, appointments and notifications

• Meeting requests and inquiries: If you would like a meeting with Michael Boiman or send him an inquiry, for example about a project, a position, a cooperation or an offer, the agent records your details: name, contact details, company and website (if given), topic, preferred time, your request, your answers to its follow-up questions and the last messages of the conversation. Added to this are its assessment of the request and, for inquiries, a recommendation and a draft reply for Michael Boiman. The details are stored on the computer and forwarded to Michael Boiman by email. Michael Boiman decides on your request himself. Only sales offers addressed to him are declined by the agent itself, following his instructions.
• Office hours (if offered): If the agent offers fixed meeting slots, it can book one of them for you. To do so, it sends a confirmation code to the email address you provide. The slot is only booked once you enter the code in the chat. You and Michael Boiman then receive an email with a calendar invitation. The email address, name (if given), topic, slot and booking status are stored. To prevent abuse, the number of codes per conversation, per address, per mail domain, per hour and per day is limited.
• Notifications to Michael Boiman: The agent sends its emails through the mailbox ai@bks-lab.com of Boiman Kupermann Solutions GmbH atMicrosoft 365. Michael Boiman receives them in his mailbox atGoogle (Gmail). Once a day he also receives an overview of conversations that remained open after the agent's follow-up questions and of inquiries without their own email. If enabled, the agent additionally notifies him of a meeting request via the Telegram messenger, containing only the type of request, the preferred time and a short reference, without your name, contact details or any text from you. If Michael Boiman responds there, the agent sends you his answer (confirmation with calendar invitation, proposal of a different time or cancellation) at the email address from your meeting request. All of the agent's emails to you (confirmation code, calendar invitation, Michael Boiman's answer) come from ai@bks-lab.com. Replies to these emails, including accepting or declining the calendar invitation, go to that mailbox. They are not evaluated automatically there. Michael Boiman reads them himself.
• Abuse reports: If the agent detects an abuse attempt, such as an attempt to manipulate it or to obtain non-public information, a threat or spam, or clearly targeted research about Michael Boiman, it reports this to Michael Boiman by email, with a short description, its assessment of who is asking and the last messages of the conversation. It keeps the same details on the computer. You are not notified of this in the chat.
• Information that needs no further data about you: The agent names free slots from an overview of busy times, without the content of any appointment. Its information on project capacity is based on a figure Michael Boiman maintains himself. Neither processes any data about you beyond the conversation.

Evaluations

Once a week, the conversation logs are automatically evaluated for questions the agent could not answer, or answered only evasively. Where needed, a language model from Anthropic groups the questions and answers found into topics. Only Michael Boiman receives the result, with individual example questions, by email. It serves to extend the public information in the CV.

Local browser storage

With your first message, the chat stores a random technical session identifier in your browser's local storage (localStorage), not when the page loads. It is sent with every message so a conversation can continue across a page reload, and it appears in the logs and inquiries described above. Conversations from the same browser can be linked through it. The browser also remembers whether you opened or closed the chat window and which size you set. This storage is required for the function you use (§ 25(2) no. 2 TDDDG) and is not used for tracking. You remove these entries by deleting the site data for mboiman.github.io in your browser. No analytics or advertising cookies are set.

Legal bases

• Answering your questions, conversation history, the agent card fetch, conversation and operational logs, consulting other agents, abuse reports, limiting confirmation codes and the weekly evaluation: Art. 6(1)(f) GDPR. The legitimate interest lies in answering questions about Michael Boiman and his work, in secure and stable operation, in preventing abuse and in improving the answers.
• Meeting requests, inquiries, office hours bookings including the confirmation code, the notifications to Michael Boiman and his answer to you: Art. 6(1)(b) GDPR (steps taken at your request prior to a possible contract). If you inquire on behalf of a company, the legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in handling business inquiries.

No automated decision-making within the meaning of Art. 22 GDPR takes place.

Note: Please do not enter confidential information or special categories of personal data (e.g. health, religious or political data) into the chat. For a meeting request, a name and one way to reach you are enough.

4. Project match

Under /en/match/ a job posting can be compared with Michael Boiman's CV. The example projects replay a stored measurement; your browser sends no request for them. A file you upload is read in your browser only and is not transmitted. Its text then appears in the text field.

Only when you click "Start the match" with your own text is that text transmitted: to a service of Michael Boiman at Cloudflare (Cloudflare Workers), which passes it to the Jev interface of TypeSafe and sends the answers back to your browser. The service stores neither the text nor the answers. Cloudflare processes technical connection data (including the IP address) to run the service and to limit the number of matches per address. TypeSafe processes the text to answer the questions of the match. According to TypeSafe, it does not train models on these inputs and keeps them for as long as necessary for the service. TypeSafe may use technical data derived from them (telemetry) without time limit.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in carrying out the match you started. The score is a machine estimate over passages of text. No automated decision within the meaning of Art. 22 GDPR takes place.

Note: please do not paste confidential details or names or contact details of people. Tasks and requirements are enough for the match.

5. Recipients and transfers to third countries

Within the scope described, the following parties receive data:

• GitHub (GitHub, Inc., USA): hosting of the website.
• Cloudflare (Cloudflare, Inc., USA): transport and protection of the chat.
• TypeSafe (TypeSafe AI, Inc., San Francisco, USA): answering the questions of the project match with your own text (section 4). Cloudflare also runs the service that passes the text on.
• Anthropic (Anthropic Ireland, Limited, Ireland): generating the answers, including for the questions passed on to the other agents, and grouping topics in the weekly evaluation. For this the agent uses a Claude subscription of Michael Boiman, not Anthropic's offering for business customers. Anthropic therefore processes the data under its own responsibility, according to its terms of use and its privacy policy. There is no data processing agreement. Whether Anthropic also uses the content to train its models depends on a setting in that subscription. The data is also processed in the USA. According to Anthropic, it bases transfers there on the EU Standard Contractual Clauses.
• Boiman Kupermann Solutions GmbH (BKS-Lab): provides the logging account at Elastic Cloud and the sending mailbox at Microsoft 365. Elastic (Elasticsearch B.V., Netherlands, storage location Frankfurt am Main) andMicrosoft (Microsoft Ireland Operations Limited, Ireland) are engaged for this as processors.
• Google (Google Ireland Limited, Ireland): Michael Boiman's mailbox, which receives the agent's emails.
• Telegram (if enabled): notification to Michael Boiman about a meeting request. The provider is based outside the EU. The message contains no details by which Telegram could identify you.

GitHub, Cloudflare, Elastic, Microsoft and Google are based in the USA or belong to groups of companies based in the USA, so data may also be processed there. For these providers, transfers to the USA take place on the basis of the EU-U.S. Data Privacy Framework (where the respective company is certified) or the EU Standard Contractual Clauses pursuant to Art. 46 GDPR. For TypeSafe, which according to its own statement processes in the USA, the transfer takes place on the basis of the EU Standard Contractual Clauses in its data processing agreement. No data is passed on to any other third parties.

6. Retention period

Where a period is given below, the data is deleted automatically once it has expired, unless statutory retention obligations apply. Where there is no period, this is stated explicitly.

• Conversation history in memory: transient, until the service restarts or it is displaced by newer conversations.
• Conversation logs (questions and answers): 90 days.
• Operational logs without conversation content, including the IP addresses in the computer's operational log: 30 days.
• Session files of the Claude software: 30 days.
• Project match: no storage in the service at Cloudflare. At TypeSafe, as long as TypeSafe considers it necessary for the service. TypeSafe states no fixed period.
• Meeting requests and inquiries, including the details stored for a notification via Telegram: 12 months. If an inquiry leads to a working relationship, the periods prescribed for that apply.
• Abuse reports on the computer: 90 days.
• Office hours bookings: 12 months from the appointment.
• Office hours confirmation codes: 24 hours.
• Emails and Telegram messages to Michael Boiman (notifications, overviews, evaluations, abuse reports), in his mailbox; since September 2026 no copy of emails is kept in the sending mailbox. There: as long as they are needed to handle your request or as a record of the communication. No automatic deletion after a fixed period is set up there. At your request, Michael Boiman deletes them unless a retention obligation applies (see section 7).
• The agent's emails to you (confirmation code, calendar invitation, Michael Boiman's answer) and your replies to them in the sending mailbox: likewise, without automatic deletion after a fixed period.
• Questions passed on to the two other agents (without your name and contact details): no automatic deletion after a fixed period is currently set up for their logs.
• At Anthropic: according to Anthropic, 30 days if the use for training is switched off in the subscription, otherwise up to five years. Content flagged by Anthropic's safety systems up to two years.
• Session identifier and window settings in the browser: until you delete the site data.
• Server access data from hosting: as determined by GitHub.

7. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21 GDPR). You may withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR). An informal message tomboiman@gmail.com is sufficient.

This includes the chat: you can object to your conversation being logged and request that your details be deleted. So Michael Boiman can find your conversation, please state the date, the approximate time and, if possible, your first question. If you do not want your conversation logged, please write an email instead of using the chat.

8. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany.

9. Changes

This privacy policy will be updated whenever the service or the legal framework changes.