Vibe Coding Hamburg Sign in

Privacy

What data we process and why. The German version is legally binding.

1. Controller

Vibe Coding Hamburg e.V. (in formation), represented by the board:

  • Finn Malte Hinrichsen: Chair
  • Marc Murray: Treasurer

Address: c/o Finn Malte Hinrichsen, Gärtnerstraße 105, 20253 Hamburg, Germany
Email: hello@vibe-coding.hamburg · Board: vorstand@vibe-coding.hamburg

2. What data we process and why

We process personal data strictly for specific purposes: because you have consented, because it is required for membership of the association, or because there is a legitimate interest or legal obligation.

Newsletter / event registration
Name + email · for confirmation and event communication · Art. 6 (1) a GDPR · until withdrawal.
Member account (login)
Email + login timestamp · for authentication via magic link (no password) · Art. 6 (1) b GDPR · for the duration of use.
Membership
Name, address, phone if applicable, date of birth if applicable (only for board eligibility), chosen tier, date of joining · for membership and fee handling · Art. 6 (1) b GDPR · for the duration of membership + 3 years after leaving (limitation periods).
Membership payments
Date received, amount, payment method, reference · for the association's accounts · Art. 6 (1) c GDPR + § 147 AO · 10-year retention obligation.
Membership application (Documenso)
Digital signature + audit trail · for a legally binding membership application · Art. 6 (1) b GDPR · for the duration of membership + 3 years.
Event registrations
Assignment of member/guest to event, check-in status · for attendee management · Art. 6 (1) a/b GDPR · 1 year after the event.
Idea collection & votes
Posts and votes linked to the member account · for member participation · Art. 6 (1) b GDPR · for the duration of membership.
AI token pool (LiteLLM)
Assignment of a pool token to a member (optional) · for use of the association's AI pool · Art. 6 (1) b GDPR · for the duration of the token assignment. Content of API usage is not stored in a personal way.
Server log files
IP address, timestamp, requested URL, browser/OS · for operational security · Art. 6 (1) f GDPR · up to 15 days.
Web analytics (Umami)
Aggregated, non-personal usage data · to measure reach · Art. 6 (1) f GDPR · no cookies, no personal data, data-minimal.

3. Publication of member data

Currently this website publishes no personal member data. The members' area is currently being revised.

4. Recipients / processors

We use the following services. Where personal data is processed, this happens on the basis of data processing agreements (DPA) or our own hosting infrastructure:

  • netcup GmbH (Karlsruhe, Germany), hosting of the website and the PocketBase database.
  • Neue Medien Münnich (All-Inkl.com) (Friedersdorf, Germany), SMTP server for sending mail (magic link, newsletter).
  • Documenso (own instance at documenso.fmhc.io), digital signing of membership applications and association documents. Self-hosted on infrastructure in Germany.
  • LiteLLM pool (own instance on own infrastructure in Germany), API gateway for the association's AI pool. Only for members with an active pool token.
  • Umami Analytics (self-hosted at stats.vibe-coding.hamburg), privacy-friendly web analytics, no cookies, no personal data.

Note on Google Maps: On some pages we embed the venue via Google Maps. This transfers data to Google LLC (USA). More in Google's privacy notice.

5. Cookies and local storage

We use no tracking cookies . For member login we store an auth token in local storage of your browser (not a cookie), so you stay signed in after login (~30-day sliding window). You can remove this token at any time via logout or by clearing local storage.

6. Retention period

  • Newsletter entries: until withdrawal.
  • Event registrations: 1 year after the event.
  • Membership data: for the duration of membership + 3 years after leaving (statutory limitation periods).
  • Accounting-relevant data (fees, donations, receipts): 10 years under § 147 AO.
  • Server log files: up to 15 days.
  • Membership applications / signed documents: for the duration of membership + 3 years.

7. Your rights

You have the right at any time to:

  • Access to the data stored about you (Art. 15 GDPR)
  • Rectification of incorrect data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR), unless a statutory retention obligation applies
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)
  • Withdrawal of consent given (Art. 7 (3) GDPR)

Send requests informally by email to vorstand@vibe-coding.hamburg.

8. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. Responsible for us is:

The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI)
Ludwig-Erhard-Str. 22, 7th floor · 20459 Hamburg
Phone: 040 / 428 54-4040
Email: mailbox@datenschutz.hamburg.de
Web: datenschutz-hamburg.de

9. Changes to this privacy policy

Status: May 2026. We will update this policy whenever procedures, third-party providers or legal bases change, in particular once the tax office Hamburg recognises our charitable status (planned for Q3 2026).