Skip to content
special.at
Sign in

Privacy Policy

Controller

Andreas Steidl
Hervicusgasse 19/2/15
1120 Vienna, Austria
Email: office@steidl.com · Phone: +43 699 100 52 220

This policy applies to the website special.at and the MCP server at mcp.special.at. The website steidl.com, Steidl IT GmbH and Setup Foundry, to which we refer, have their own privacy policies.

When you visit this website

Each time a page is requested, your browser necessarily transmits data to our server: IP address, date and time, the address requested together with the method and protocol, the status code, the volume of data transferred, the page previously visited (referrer), browser and operating system identifiers, and the response time. The server records this in access logs in order to keep the service secure, find errors and detect attacks (Art. 6(1)(f) GDPR). The same applies to every request to the MCP server and every download. We delete the access logs after 30 days at the latest.

To limit misuse, we briefly count requests per IP address; we keep these counters in memory only, for no more than 15 minutes. If a single address stands out through a very large number of failed requests or registrations, we block only that address for 15 minutes and record the block with the address and the time in the log; we also delete these entries after 30 days at the latest (Art. 6(1)(f) GDPR).

This website uses no analytics and no advertising services and embeds no third-party content. All content, including fonts, is served from our own server; visiting the site transfers no data to third parties.

Cookies and local storage

The website and the MCP server set no cookies. If you choose light or dark display with the switch in the page header, your browser stores this choice in its local storage (special-modus). The entry is not transmitted to us and contains no identifier relating to you; it is strictly necessary for the display you have chosen (§ 165 para 3 Austrian Telecommunications Act 2021, Telekommunikationsgesetz 2021, TKG 2021). You can delete it in your browser at any time; the site also works without it.

Signing in with an invitation code

You use the MCP server with an invitation code that you receive on a sheet in our seminar. We keep no list of which person holds which code. Signing in is not possible without an invitation code; giving your first name is voluntary.

Invitation code. We do not store the code itself, only a check value calculated from it, together with a participant identifier without a name (such as “t03”) and the time the code was redeemed. A code can be redeemed only once and only for a short time; the codes for this seminar until 5 November 2026. When they expire, we delete the check values. We keep the list of codes used to print the sheets separately from the server and delete it as soon as the last sign-in with these codes has expired (see below), on 6 December 2026 at the latest; until then we need it to match your data to you if you exercise your rights.

Signing in via Claude Code. If you set up the server in Claude Code, the program registers with us and opens our access page in your browser. In doing so we store the name under which the program registers and the redirect address on your own computer. On the access page you enter the invitation code and, if you wish, your first name. Your program then receives an access key valid for one hour and a refresh key valid for 30 days from sign-in, which renewal does not extend. Claude Code stores the keys on your computer; we keep only check values of them. Program entries with which no sign-in is completed expire after 24 hours and are deleted no later than one day after that; a sign-in that has been started expires after 15 minutes.

Access key for manual entry. Instead of signing in via Claude Code, the access page can show you an access key after you have redeemed the code, which you enter in Claude Code yourself. It is valid for 30 days; we keep only a check value of it. We do not store your first name on this route.

First name. If you give a first name when signing in via Claude Code, we store it with your participant identifier and use it for nothing other than the greeting the server sends to your session when it connects (Art. 6(1)(f) GDPR). We accept only letters, spaces and hyphens, up to 30 characters; any other input is dropped.

Legal basis and duration. We process the invitation code, identifier, keys and program entry in order to let you use the server, which you request by redeeming the code (Art. 6(1)(b) GDPR). When a sign-in has expired or been blocked, we delete its keys, the program entry and your first name automatically, no later than one day after that. Anyone who has redeemed a code therefore remains signed in for 30 days at most; after that a new code is needed.

To prevent codes from being guessed, we count failed attempts per IP address. We keep these counters in memory only, for no more than 15 minutes (Art. 6(1)(f) GDPR).

When you use the MCP server

We record every request to the server in a usage log: time, your participant identifier, the operation requested (such as “list skills” or “sign-in”), the result and the duration. What you query or send and what the server replies is not included, nor are your invitation code, your keys or your IP address. We use the log to keep the service secure, find errors and detect misuse (Art. 6(1)(f) GDPR) and delete it after 30 days at the latest. To prevent overload, we briefly count requests per access key; we keep these counters in memory only.

Skills, prompts and downloads are the same for all participants. You can also download skills and their files without signing in; this creates only the entry in the access log (section “When you visit this website”).

After you have redeemed your code, the access page offers you the seminar materials for download. For this you receive a personal download token valid for 30 days; we keep only a check value of it and delete it when it expires, no later than one day after that. We record every download in the usage log, without the token (Art. 6(1)(b) GDPR).

Feedback

You can send us a text using the feedback tool. We store it with the time and your participant identifier; Andreas Steidl reads it in order to improve the skills and the server (Art. 6(1)(f) GDPR). We do not pass it on. We delete feedback as soon as we have evaluated it, after 90 days at the latest. Please do not include names, other personal data or confidential information about your company, and pay attention to what your AI assistant sends on your behalf.

Your AI assistant

You use the MCP server with your own AI assistant, such as Claude Code by Anthropic. What the server sends to your session (skills, prompts and the greeting with your first name) and what you send as feedback is part of your session history. Your assistant transmits this history to its provider as part of your own use; your contract and that provider's privacy policy apply to this. We ourselves transmit no data to Anthropic or any other provider.

Who else receives the data

  • netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany — operation of the server, processor (Art. 28 GDPR), with sub-processors of the Anexia group in Austria and Germany. No processing outside the European Union takes place in this context.

There are no other recipients. We send no emails through this service and embed no third-party services.

Your rights

You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object (Art. 21). A message to office@steidl.com is sufficient; we will reply within one month. Because we do not store names, please give us the invitation code from your sheet; we do not match data on the basis of a first name alone. If we can no longer match data to you because the list of codes has already been deleted, we will tell you so (Art. 11(2) GDPR). We can block your sign-in immediately at any time; we then delete it as described above.

Right to object (Art. 21(1) GDPR)

Where we process data on the basis of legitimate interests (this concerns the access logs, the counters against misuse, the blocking of conspicuous addresses, the usage log, your first name and your feedback), you may object at any time on grounds relating to your particular situation.

Right to lodge a complaint

You may lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

Changes

If our processing changes, we will update this policy. Last updated: 28 October 2026.

Language

This English version describes the same processing as the German version of this privacy policy. Austrian statutory terms are given in German in brackets so that you can look them up.