Early accessPCBuildAI is still being built.
This English version is provided for convenience. The German version of this page is the legally binding text; in case of any discrepancy, the German version prevails.

Privacy Policy

1. Who we are

Controller within the meaning of the GDPR:

2. The short version

  • PCBuildAI uses no analytics, tracking, or advertising cookies and embeds no ad networks. We do not sell data.
  • You can use PCBuildAI without an account. In guest mode your chat history stays in your browser (localStorage) — our server keeps no history for guests.
  • Your chat messages are sent to OpenAI to generate responses (section 6). Please don't enter sensitive personal data in the chat — PC advice never needs it.
  • We finance PCBuildAI through affiliate links. When you click an offer you move on to partners and retailers who process data under their own responsibility (section 9).
  • Our servers are hosted by Hetzner in Germany (Falkenstein).

3. Hosting and delivery

Hetzner. PCBuildAI runs on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany (Falkenstein data center), under a data processing agreement (Art. 28 GDPR). For resilience, regular encrypted database backups are stored with Hetzner within the EU and rotated on a recurring basis. Legal basis: Art. 6(1)(f) GDPR.

Cloudflare. The website is delivered through the CDN of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes technical connection data (notably your IP address and HTTP headers) and may set strictly necessary security cookies. Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. Chat and account requests go TLS-encrypted directly to our server in Germany. Legal basis: Art. 6(1)(f) GDPR.

4. Technical logs and abuse protection

  • Application logs: per request we store route, time, status, and latency. IP address and user ID appear only as salted hashes, never in the clear. Deleted after at most 12 months.
  • Web server logs: the upstream web server logs accesses including the IP address for error and attack analysis; these server logs are rotated daily and deleted after 7 days.
  • Rate limiting: for guests by IP address (IPv6 truncated to the /64 prefix), for signed-in users by account ID. Deleted after at most 30 days.
  • Error logs: error context kept for 30 days.

Legal basis: Art. 6(1)(f) GDPR (operational security, abuse prevention, diagnostics).

5. Cookies and local storage

We only use storage that is strictly necessary or requested by you (§ 25(2) TDDDG) — which is why there is no cookie banner:

  • pcb_session (cookie, HttpOnly, signed): login session, contains only your account ID. Duration: 14 days.
  • NEXT_LOCALE (cookie): remembers your language choice. Duration: 12 months.
  • pcb-theme (localStorage): remembers day/night mode. Duration: until you delete it.
  • pcb_anon_chat_v1 (localStorage): your guest chat history, stays in your browser. Duration: until sign-in, "new chat", or deletion.
  • pcb_consent_v1 (localStorage): stores a consent decision should optional services be added later. Duration: until you delete it.

We set no analytics, statistics, or marketing cookies. Should that change, we will ask for your consent first (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

6. AI chat (OpenAI)

PCBuildAI's core feature is a chat that understands your requirements and turns them into PC configurations. To do this we transmit your chat messages (including the previous conversation) to OpenAI and receive the language model's reply. Short excerpts also go to OpenAI for automated abuse checks of inputs/outputs and for naming your builds.

  • Provider: OpenAI Ireland Ltd, Dublin, Ireland; parent OpenAI, L.L.C., San Francisco, USA. US transfers rely on the EU-US Data Privacy Framework plus standard contractual clauses.
  • Under the API terms OpenAI does not use API data for training and deletes it after at most 30 days.
  • We do not send your account data (name, e-mail) to OpenAI — only the chat content itself. Please do not enter special categories of personal data (Art. 9 GDPR).

Legal basis: Art. 6(1)(b) GDPR (providing the service you requested); abuse checks: Art. 6(1)(f) GDPR.

7. Guest mode, demo, and quality assurance

In guest mode and the demo our server stores no chat history; it lives in your browser only. For quality assurance, error diagnosis, and abuse prevention we store server-side:

  • per chat reply a technical record of the last message pair (your message + the reply, truncated to 2000 characters). E-mail addresses and phone numbers are removed automatically; guest records are not linked to any person. For signed-in users this record is linked to your account ID for the 30 days. Deleted after 30 days.
  • for blocked or flagged requests (safety filters) the affected message pair, to review the filter. Deleted after at most 90 days.

Legal basis: Art. 6(1)(f) GDPR.

8. Account, saved chats and builds

Google sign-in. Accounts are created exclusively via "Sign in with Google" (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We receive and store: Google ID, e-mail address, display name, and profile picture URL, plus language/market preference and the time of your last activity. Your profile picture is loaded directly from Google servers. Legal basis: Art. 6(1)(b) GDPR.

Chats and builds. When signed in, we store your chats and builds until you delete them or your account. Legal basis: Art. 6(1)(b) GDPR.

Self-service. In settings you can at any time export all data as JSON (Art. 20 GDPR) and delete your account — profile, chats, and builds are erased immediately; click statistics (section 9) lose their account link.

9. Affiliate links, retailers, click statistics

We finance PCBuildAI through the Geizhals partner program (Preisvergleich Internet Services AG, Vienna, Austria) — see the Affiliate disclosure.

  • Offer links lead to the retailer's shop via the partner's counting mechanism. From the click onward, partner and retailer process your data (e.g. IP address, their own cookies) under their own responsibility. We pass no identifier of yours to the partner.
  • Retailer logos in the offers dialog are loaded from the partner's servers (gzhls.at), which thereby receives technical connection data such as your IP address.
  • Our own click statistics: when you click an offer we count it first-party (component, offer, page area, time — plus the account ID for signed-in users; no IP address).

Legal basis: Art. 6(1)(f) GDPR.

10. Shared builds

If you create a share link, the build becomes publicly accessible under a random address (part list, prices, build name — the name may derive from your chat). No account or contact data is shown. Deleting the build ends publication. Legal basis: Art. 6(1)(b) GDPR.

11. Recipients and processors

Internal recipients: the operator only. Processors/recipients: Hetzner (hosting, EU), Cloudflare (delivery/protection, USA), OpenAI (AI replies, Ireland/USA), Google (sign-in and profile picture only, Ireland/USA). Authorities only where legally required.

12. Third-country transfers

Where data goes to the USA (Cloudflare, OpenAI, Google), we rely on the adequacy decision for the EU-US Data Privacy Framework — all three are certified — plus standard contractual clauses (Art. 44 ff. GDPR).

13. Retention overview

  • Guest chat history: your browser only.
  • Account, saved chats, builds: until you delete them.
  • Per-reply quality record (truncated, contact data stripped; account-linked for signed-in users): 30 days.
  • Safety-filter events: max. 90 days.
  • Rate-limit events (guests: IP-based): max. 30 days.
  • Application logs (hashes only): max. 12 months.
  • Web server logs (IP, error/attack analysis only): 7 days.
  • Error logs: 30 days.
  • Login session: 14 days.

14. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), and data portability (Art. 20 — built into your account as an export). Consent can be withdrawn at any time with future effect (Art. 7(3)).

Right to object (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f).

Our competent supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI), Alt-Moabit 59–61, 10555 Berlin. You may also contact any other data protection supervisory authority.

15. No automated decision-making

Build suggestions are non-binding information; no automated decision-making with legal effect (Art. 22 GDPR) takes place. We build no advertising profiles.

16. No obligation to provide data, minors, changes

You are not obliged to provide data — guest mode works without an account. The service is not directed at children under 16. We will update this policy as the service evolves; the version published here applies.

Last updated: 13 July 2026