Privacy and sub-processors (service)
Status: draft of 26 Oct 2026. These notes describe what data the hostily Captcha service (captcha.hostily.de) processes. The operator is connect – Media & Teledienst (address: see legal notice).
1. Roles
For visitors to our customers’ websites, the website operator (customer) is the controller and we are the processor (see DPA). For customer account and billing we are the controller ourselves.
2. Data when checking a visitor
| Data | Purpose | Retention |
|---|---|---|
| IP address, as a hash only (HMAC-SHA256 with a secret key that changes daily, 128 bits stored); the plain IP is not in the database | Rate limiting, IP block, abuse detection | 14 days |
| Project (site key), domain of the embedding page (Origin/Referer) | Assignment, origin check | 14 days (events) |
| Timestamps, solution of the task, honeypot flag, form load time | Check (minimum time, honeypot), single-use token | Challenges and tokens immediately after expiry or use, events 14 days |
| Hash (HMAC) of normalised form values | Detecting identical submissions | 14 days |
Form content, if the customer passes it to the check (/api/v1/pruefen) | Applying content rules | to clarify: does the service store rejected submissions in plain text (Business plan, “rejected submissions”)? If so, add duration and notice. |
The widget sets no cookies and stores nothing in the browser. All files, including the WASM module, are loaded from captcha.hostily.de; there are no requests to third parties.
Legal basis (visitors): Art. 6(1)(f) GDPR, the website operator’s legitimate interest in protection against spam and abuse.
3. Customer data (management area)
For account and management we process name, email address, password hash, two-factor data, company, plan, billing data – verify against actual data holdings before publication on the basis of Art. 6(1)(b) GDPR (contract) and (c) (statutory retention). Project secrets are stored only as a SHA-256 hash.
4. Server log files
The web server logs technically necessary access data (including IP address) check retention for captcha.hostily.de; 30 days is stated for the website.
5. Recipients and sub-processors
| Company | Service | Location |
|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Data centre, servers (hosting) | Germany |
| add others, e.g. email delivery, payment processing – if external |
To our knowledge no transfer to third countries takes place. confirm
6. Your rights
Access, rectification, erasure, restriction, data portability, objection and complaint to a supervisory authority. Visitors should contact the operator of the website they visited first. Because only hashes are stored, we can usually not re-identify individual visitors.