Privacy notice
Last updated: 11 November 2026
This notice describes personal data processing when you visit lina.onl or lina.fyi. It applies to this website and does not replace the privacy information provided by external social platforms.
1. Controller
KMC.Studio
Proprietor and controller: Kai Muckenheim (sole proprietor)
Emsdettener Str. 10
48268 Greven
Germany
Email: lina@kmc.studio · Phone: +49 155 69154257
2. Access and technical delivery
Establishing a connection involves processing technically necessary data, including your IP address, request time, requested resource and browser/connection information transmitted by your device. Storage depends on the actual systems described below. A visit is not data-free merely because there are no analytics cookies.
Delivery and security are based on Article 6(1)(f) GDPR. Our legitimate interests are to provide a secure, functional website and prevent misuse. We limit data and access to what is necessary.
Hosting, recipients and technical services
The website runs on a Netcup VPS whose physical location is shown as Nuremberg, Germany in the server control panel. The shared Caddy gateway forwards requests to an internal Nginx service for HEY LINA; the VPS also hosts other projects. This website uses no analytics or advertising pixels and loads no social widgets or external media automatically. The saved Netcup DPA copy dated 10 September 2026 names Kai Muckenheim as controller and netcup as processor; the operator confirms that the DPA relevant to this VPS is active and valid. The exact Annex 3 scope for this shared server and the complete provider/subprocessor details have not yet been reconciled. Netcup’s published standard terms say customers must create and retain their own backups and that netcup does not back up customer content unless otherwise agreed. Whether a different backup arrangement applies to this VPS has not been checked; the inspected SCP snapshot list showed no manual snapshots.
Logs and deletion
In the inspected service, HTTP access logging is disabled in Lina's Nginx service; the Caddy gateway's configured default logger excludes HTTP access logs. Container output is rotated by size (Caddy: up to 3 × 5 MB; Lina Nginx: up to 2 × 1 MB), not by a fixed number of days. Netcup says personal-log retention depends on the contracted product; automatically collected attack-response logs may be kept for up to 14 days. That general statement is not a VPS-specific overall retention period. Complete host/provider log categories and periods, and backup, restore and deletion periods, have not been verified. Netcup’s published standard terms say customers must create and retain their own backups and that netcup does not back up customer content unless otherwise agreed. Whether a different backup arrangement applies to this VPS has not been checked; the inspected SCP snapshot list showed no manual snapshots.
Transfers outside the EEA
The confirmed physical VPS location is Nuremberg, Germany. The saved DPA copy lists netcup as processor and Anexia entities located in Germany and Austria as other processors. This does not establish every location used for support access, backups or other processing. Those locations and any transfers to third countries have not been fully verified for this VPS, so exclusive processing in the EEA is not claimed.
3. Email contact
Contact links open your email application. This version of the website has no server-side contact form. If you write to us, we process sender/contact details, your message, any attachments and communication metadata to handle your request.
Article 6(1)(b) GDPR applies to specific pre-contractual or contractual requests. Other business enquiries are handled under Article 6(1)(f), based on our legitimate interest in responding to messages. Article 6(1)(c) applies where statutory retention obligations require storage.
The lina@kmc.studio contact uses the Apple iCloud Mail route for kmc.studio; public MX records point to mx01.mail.icloud.com and mx02.mail.icloud.com. The operator confirms this address, provider and mail route are correct for HEY LINA. The website has no server-side contact form and does not transmit email messages to the Lina web server. The domain manager showed catch-all incoming enabled for kmc.studio, which accepts domain addresses that are not separately listed. A dedicated lina alias and actual message receipt were not independently tested. Apple's specific contractual and data-protection roles and account-specific storage, backup, log and transfer locations are not fully verified.
Retention and deletion: According to the operator, messages received in his mailbox through the HEY LINA contact address are automatically deleted after 30 days. This concerns mailbox messages, not Apple logs or backup copies. Apple’s privacy page says records of iCloud interactions are normally kept for 30 days; if laws require longer retention, they may be kept in aggregated form for up to three years. Apple’s law-enforcement guidelines describe iCloud connection logs kept for up to 30 days and mail logs for up to 60 days. These statements cover specific log types and do not establish a complete retention schedule for this account. Provider logs and backups for this mailbox have not been fully verified.
International transfers: Apple's iCloud terms identify Apple Distribution International Ltd. in Ireland as the Apple contracting entity for users outside the regions listed separately. Apple's privacy policy says personal data relating to people in the EEA, UK and Switzerland is controlled by Apple Distribution International Limited in Ireland and may be transferred to or accessed by Apple entities worldwide. Apple says international transfers of that data are governed by Standard Contractual Clauses and that personal data collected by Apple or an Apple-affiliated company worldwide is generally stored by Apple Inc. in the United States. These are Apple's general statements; they do not establish the storage location of this custom-domain mailbox or Apple's specific role in processing a message sent to the operator. Apple's law-enforcement guidelines also refer to content in U.S. data centres and encryption keys held by Apple there. The account manager does not identify this mailbox's exact locations, subprocessors, backup locations or complete retention periods; those account-specific details remain unverified. Sources S53, S56 and S59.
Please do not send unnecessary sensitive information. This is the operator’s business contact address, not a private conversation with a real person called Lina.
4. Appearance: Day, Night and Auto
Without a saved preference, Auto uses your device clock locally: Day from 07:00 until 18:00, otherwise Night. No location access or transmission of your local time is needed. Changing the appearance initially only changes the open document in memory.
Only if you explicitly enable “Remember appearance on this device for 30 days” do we save the mode and expiry time in your browser’s local storage under lina-appearance-v2. No user identifier is stored. On a later visit the preference is read; it is discarded after expiry, and you can remove it with “Delete saved preference”. A new manual mode selection while remembering is enabled renews the period.
Storage serves only the optional function you requested (section 25(2)(2) TDDDG). Where personal data is involved, implementing this requested appearance is based on Article 6(1)(f) GDPR. It is not used for profiling, audience measurement or advertising. You can use the website without saving this preference.
5. Social and external links
Instagram, TikTok and YouTube are linked only in this version. We do not load their embedded players, social widgets or tracking pixels just because you visit our site. A connection to an external provider is made when you open a link. That provider’s terms and privacy information apply to its processing. Our links suppress referrer information; this does not prevent the destination from receiving your IP address.
6. No additional interactive services in this version
This version has no user accounts, newsletter, shop, payments, personalised advertising or website chatbot. We do not make automated decisions with legal or similarly significant effects under Article 22 GDPR here. Lina’s AI images and videos are media content, not an indication that your visitor data is used to train AI. Before enabling new functions, we will update the information and implement any required consent mechanism.
7. Your rights
Subject to applicable conditions, you have rights of access, rectification, erasure, restriction and data portability under Articles 15–20 GDPR. If processing is based on consent, you may withdraw it at any time with effect for the future. Use the contact address above to exercise your rights. We will only ask for information necessary to establish the connection to the data.
Objection: For processing based on Article 6(1)(f), you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time; this website currently does not conduct personalised direct marketing.
You may complain to a supervisory authority, particularly in your usual place of residence, workplace or the location of an alleged infringement. The State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia is an authority relevant to this operator.
8. Providing data
Technical connection information is necessary to deliver the site. Email information is voluntary, but we may be unable to answer without sufficient contact or contextual details. Remembering your appearance preference is optional.
Daylight & After Dark
Without remembering, the choice only lasts in the open document.