Privacy Policy

Datenschutzerklärung gemäß DSGVO — Last updated: March 2026

1. Data Controller

The controller responsible for data processing on this website is:

RESERVOIR GmbH
Ingenieurbuero — Geschäftsführer: Klaas Kostro
Hofweg 22, 22085 Hamburg, Deutschland
E-Mail: mail@reservoir-consulting.com
Telefon: +49 (0)40 609426711
Handelsregister: Amtsgericht Hamburg, HRB 115128

The data controller is the natural or legal person who alone or jointly with others decides on the purposes and means of the processing of personal data.

2. Overview of Data Processing

We process personal data only to the extent necessary for providing a functional website and our services. The processing of personal data takes place only with the user's consent or where processing is permitted by law.

3. Data We Collect

3.1 Account Registration

When you create a RUNSPEC account, we collect:

Full name
E-mail address
Password (stored as a bcrypt hash — we never store plaintext passwords)
Country (determined automatically at registration for regulatory compliance)

Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

3.2 Project & Simulation Data

When you use RUNSPEC to create reservoir simulation decks, upload data files, or run simulations, the following data is stored:

Simulation deck files (keywords, grid data, schedule data)
Uploaded production history files
PVT parameters and relative permeability tables
Simulation results (UNRST, SMSPEC, PRT output)
Project metadata (name, creation date, modification timestamps)

Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

3.3 AI Chat Interactions

When you use the AI deck-building assistant (OGAI), your prompts and the AI-generated responses are processed via the Anthropic API. We send your prompt and relevant simulation context to Anthropic's Claude model. Anthropic's data processing terms apply; prompts sent via the API are not used to train Anthropic's models.

Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

3.4 Server Log Files

When you access our website, the following data is automatically logged:

IP address (anonymised after 7 days)
Date and time of access
Requested URL and HTTP method
Browser type and operating system
Referrer URL

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in ensuring system security and stability.

3.5 Newsletter Subscription

If you subscribe to our newsletter, we collect your e-mail address. We use a double opt-in process: you will receive a confirmation e-mail before being added to our mailing list. You can unsubscribe at any time.

Legal basis: Art. 6(1)(a) GDPR — consent.

4. Hosting & Infrastructure

RUNSPEC is hosted exclusively on Hetzner Online GmbH servers located in Germany (Falkenstein and Nuremberg data centres). Hetzner operates ISO/IEC 27001-certified facilities. Your data never leaves the European Union.

We have concluded a Data Processing Agreement (Auftragsverarbeitungsvertrag, AVV) with Hetzner in accordance with Art. 28 GDPR.

5. Third-Party Services

Service	Provider	Purpose	Data Transferred
Anthropic Claude API	Anthropic, PBC (USA)	AI-assisted deck building (OGAI)	User prompts, simulation context. Covered by Anthropic's DPA and Standard Contractual Clauses (SCCs) for EU→US transfers.
Google Fonts	Google LLC (USA)	Typography rendering	IP address. We are evaluating self-hosting fonts to eliminate this transfer.

6. Cookies

RUNSPEC uses the following cookies:

Cookie	Purpose	Type	Duration
session	User authentication session	Strictly necessary	Browser session
remember_token	"Remember me" persistent login	Strictly necessary	30 days
cookie_consent	Stores your cookie preference	Strictly necessary	1 year

We do not use analytics cookies, tracking pixels, or advertising cookies. All cookies are strictly necessary for the operation of the service.

You can manage your cookie preferences at any time via the "Cookie Settings" link in the page footer.

7. Data Retention

Account data: retained for the duration of your account. Deleted within 30 days of account deletion request.
Project & simulation data: retained while your account is active. Deleted with the account.
Server logs: IP addresses anonymised after 7 days. Aggregated logs retained for up to 90 days.
Newsletter subscriptions: retained until you unsubscribe.
Invoicing data: retained for 10 years as required by German tax law (§ 147 AO, § 14b UStG).

8. Your Rights under GDPR

You have the following rights regarding your personal data:

Right of access (Art. 15 GDPR) — obtain a copy of your stored data
Right to rectification (Art. 16 GDPR) — correct inaccurate data
Right to erasure (Art. 17 GDPR) — request deletion of your data
Right to restriction (Art. 18 GDPR) — restrict processing
Right to data portability (Art. 20 GDPR) — receive your data in a machine-readable format
Right to object (Art. 21 GDPR) — object to processing based on legitimate interest
Right to withdraw consent (Art. 7(3) GDPR) — withdraw previously given consent at any time

To exercise any of these rights, contact us at mail@reservoir-consulting.com.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for RESERVOIR GmbH is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22, 20459 Hamburg
https://datenschutz-hamburg.de

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

TLS/SSL encryption for all data in transit
Encryption at rest for stored project data
Bcrypt password hashing
Rate-limited authentication endpoints
Regular security updates and patch management
Access controls and role-based permissions

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically.