Privacy policy

Cookies

None. Only the customer portal sets a strictly necessary login cookie.

Analytics / tracking

No script, no pixels, no recognition — only anonymous daily totals per page (section 5).

Third-party content

None. Fonts, images and scripts are served from our own server.

Server logs

Access logs, deleted after 14 days.

Forms

Only what you send us — a contact request, or your email address for the early-access list.

1. Controller

rterials GbR, Gartenstraße 5a, 54472 Veldenz, Germany. Email: info@melanite.io. Represented by its partners Robin Arnoldi & Jan Tennhardt. We are not required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG); send requests to the address above.

2. Hosting and delivery

The site runs on a virtual server in Germany, which also terminates TLS; no content delivery network sits in front of it. The provider acts as a processor under Art. 28 GDPR, on our instructions only:

IONOS SE

Server hosting (the virtual server this site runs on) and our email mailboxes.Elgendorfer Str. 57, 56410 Montabaur, DeutschlandData centres in Germany. Order-processing agreement under Art. 28 GDPR in place.

The legal basis is our legitimate interest in a secure, available and fast service (Art. 6(1)(f) GDPR).

3. Server logs

Requesting a page makes the server process your IP address, date and time, the requested URL, the HTTP status code, the amount of data transferred, the referrer and the user agent. This is technically unavoidable when delivering a page, and we use it for troubleshooting and to fend off attacks (Art. 6(1)(f) GDPR). Logs are deleted after 14 days and are never combined with other data. Before they are deleted, they are summarised into the anonymous totals described in section 5.

If a page violates our Content Security Policy, your browser reports that to an endpoint on our server. Such a report contains the affected URL and the blocked resource; we treat and delete it like a log entry.

4. Fonts

Every font is served from our own server. There is no connection to Google Fonts or any other font CDN, so your IP address is never transmitted to one (cf. LG München I, 3 O 17493/20).

5. Cookies and audience measurement

The public part of this site stores nothing on your device: no cookies, no local storage, no pixels, no fingerprinting. That is also why there is no cookie banner — there would be nothing to consent to.

We do count page views — without recognising you while doing it. No analytics script runs in your browser and nothing extra is collected: once a day a program on our server summarises the logs that exist anyway (section 3) into plain totals, and stores only those. A stored row looks like this, in full:

2026-09-18 · /download · github.com · 47

• Stored: the date, the page's path, the origin it was reached from as a bare domain name (e.g. github.com, direct for direct visits, internal for clicks within this site), and a count.
• Not stored: IP addresses, user agents, identifiers of any kind, the time of an individual request, or full referrer URLs — those can carry search terms or usernames, and our referrer policy means only the domain reaches us in the first place.
• No consent is required for this: § 25 TDDDG applies to storing information on, or reading it from, your device, and neither happens here. Hence no banner.
• The totals carry no personal reference; the underlying logs are still deleted after 14 days. The legal basis for summarising them is our legitimate interest in knowing which content gets read (Art. 6(1)(f) GDPR).
• What this explicitly cannot do: tell visitors apart, recognise a returning one, or build sessions and journeys. We count requests, not people.

The one exception is the customer portal at /portal: after you log in we set a session cookie (melanite.auth, HttpOnly, SameSite=Strict). It is strictly necessary for the service you asked for and therefore exempt from consent under § 25(2) no. 2 TDDDG.

6. Contact form and email

When you write to us we process your name, email address, optionally your company, and your message in order to answer — Art. 6(1)(b) GDPR where there is a contractual context, otherwise Art. 6(1)(f). To keep bots out, the form carries a field that is invisible to you (a honeypot) and a per-IP limit on submissions per hour. We delete an enquiry once it is settled and no statutory retention period applies. Our mailboxes are hosted at IONOS (section 2).

7. Early-access list

You can join the early-access list to be told when there is something to download or buy. It uses double opt-in: after you sign up we send you an email with a confirmation link, and you are only on the list once you click it.

• We process: your email address, the page you signed up from, and the time, IP address and user agent of both the signup and the confirmation.
• The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG).
• The timestamps and technical details are the record of that consent. Without it we could not show the signup came from you — which is why we keep it.
• If you never confirm, the entry is deleted automatically after 30 days.
• You can leave at any time, via the link in every email or informally to info@melanite.io. We then delete your address; the record of consent and of the withdrawal is kept until any related claims lapse.
• Mail is sent from our own IONOS mailboxes. There is no newsletter provider, and no open or click tracking.

8. Portal account

For a portal account we process your email address, display name, a password hash and — if you enable it — your two-factor authentication data, in order to give you access and licence management (Art. 6(1)(b) GDPR).

When you choose a password we check server-side whether it appears in known breaches. Neither your password nor its full hash leaves our server: only the first five characters of a hash go to the Have I Been Pwned service, which returns a whole list of candidates, and the comparison happens here (k-anonymity). The legal basis is our legitimate interest in account security (Art. 6(1)(f) GDPR).

We keep a security log of actions on an account — sign-in, failed sign-in, lockout, two-factor changes, password changes, and the issuing, changing or revoking of a licence — with the time, the IP address and the browser identification of the action. It exists so that an unauthorised change can be noticed and reconstructed, which is both our legitimate interest and yours (Art. 6(1)(f) GDPR). Entries are deleted after 180 days. This log concerns accounts only; it is separate from the anonymous page counters in section 5 and the two are never combined.

9. Transfers outside the EU

All processing happens in the EU. We transfer no personal data to countries outside it.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR). Consent you have given can be withdrawn at any time with future effect (Art. 7(3) GDPR). An email to info@melanite.io is enough.

You may also lodge a complaint with a supervisory authority (Art. 77 GDPR). Ours is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Deutschland, datenschutz.rlp.de.

11. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. We do not sell data, and we pass it only to the processors named in section 2.

12. Changes

If what we process changes, this page changes first. The date below is its version. German law governs this notice, so the German version is authoritative; this page is a courtesy translation.

Last updated: 2026-10-22