Privacy notice for the website nextapplab.net
As of 2026-11-07
This privacy notice informs you about the processing of personal data when you visit our website nextapplab.net and when you contact us by e-mail or through the contact form. The Klaruna app has its own privacy policy; what the app processes is not described here. Nor does this notice cover the independent services Image Tools and MediaLink presented on the website: they run under their own addresses, and their own privacy notices apply.
1. Controller
USAMA IBRAHIM ZAGOUT, trading as "NextAppLab"
Paulsborner Straße 21A, 10709 Berlin, Germany
E-mail: kontakt@nextapplab.net
2. What the website itself does
The website consists of static pages. A server program exists only for the contact form (see section 4):
- The website itself sets no cookies and stores nothing else in your browser either (no local or session storage). No consent under section 25 TDDDG is therefore requested, and there is no consent banner.
- There is no analytics, advertising or social-media embed.
- No resources are loaded from third parties; fonts are served by the website itself.
- There is no sign-in. The contact form is the only form.
A check of the generated export on 2026-11-06 found no scripts, images, stylesheets or links pointing outside nextapplab.net, and no access to cookies or browser storage in the delivered program code; the other matches are references in the program code (licence and error notices, technical namespaces and example addresses) that are not fetched.
3. Hosting through Cloudflare
The website is served as a static export through Cloudflare Pages; the domain nextapplab.net is in the operator's Cloudflare account.
When a page is requested, the hosting provider processes technically necessary connection data. In its privacy policy (version of 4 November 2025) Cloudflare names, among the data processed when people use a customer's website, IP addresses and traffic routing data. According to that policy Cloudflare is a processor for the logs it makes available to the customer ("Customer Logs") and otherwise a controller for the data it collects. The purpose is delivering the pages and secure, stable operation; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).
Cloudflare states that it stores data mainly in the United States and the European Economic Area and may access it worldwide. For transfers from the EEA to the United States Cloudflare relies on the EU-U.S. Data Privacy Framework and, as a fallback, on standard contractual clauses. Cloudflare provides a data processing addendum (version 6.4, April 2026) that contains these clauses. No restriction to data centres in the EU is promised.
Cloudflare points out that it may set strictly necessary cookies (for example for bot detection) on customers' websites. The operator sets no cookies for analytics or advertising.
Access and security logs: the operator keeps none of their own, as the website has no server of its own. Cloudflare names no fixed period for its logs, only general criteria in its privacy policy; no period of our own is promised here.
4. Contact by e-mail and contact form
If you write to the contact address we process your message and e-mail address in order to reply. The address forwards incoming messages through Cloudflare Email Routing to a mailbox of the operator at Google Mail (Gmail); Cloudflare processes the message for the forwarding. Recipients after that are the operator and Google as the provider of the mailbox. In its privacy policy Google states that it processes data on servers around the world; no particular storage region is promised here. The operator replies to messages by e-mail. Please do not send sensitive details that your request does not need.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering enquiries) and, for enquiries that prepare a contract, (b). Ordinary enquiries and the related correspondence are, as a rule, to be deleted six months after the matter in question has been closed. They are kept longer only where statutory retention duties apply, where this is necessary and permitted for establishing, exercising or defending legal claims, or where longer processing is demonstrably necessary. The six months are a rule set by the operator, not a statutory period. Automatic deletion is not currently set up.
Contact form
Data collected: name, e-mail address, subject, message and, if you choose it, the product reference. Everything except the product reference is required, because otherwise we cannot reply. When you submit, Cloudflare also processes technically necessary connection data, in particular your IP address (see section 3).
Purpose: to answer your message.
Technical processing: the form sends your details to a function on Cloudflare Pages. It checks them, limits the number of requests per IP address (the address is held only briefly in the function's volatile memory for this, not stored) and hands the message to the e-mail provider Resend, which delivers it to the contact address; from there Cloudflare Email Routing forwards it to the operator's mailbox. In addition, a rule at Cloudflare limits the number of requests to the form per IP address; for this Cloudflare evaluates the IP address (section 3). So that a message sent twice by mistake is delivered only once, the function passes Resend a random identifier of the submission together with a short checksum of the message. The function does not store the content of the message and does not write it to logs. The form sets no cookies and uses no external bot service; a field invisible to people and a timing check protect it.
Recipients: Cloudflare (hosting and function, section 3, and Email Routing for the forwarding to the mailbox), Resend (delivery) and the operator with their mailbox at Google Mail.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering enquiries) and, for enquiries that prepare a contract, (b).
Retention: with the operator the same rule applies as for e-mails (six months after the matter has been closed, with the exceptions named above). The function on Cloudflare Pages does not store the content of your message. For the service providers their own statements apply: Resend states that it keeps sending logs for a period that depends on the plan, 30 days on the free plan; Cloudflare names no fixed period for its logs. Resend's data processing agreement (version of 31 December 2025) names the term of the contract as the retention period, with deletion within 90 days after it ends. The operator's deletion period does not cover those logs and data.
Transfers to third countries: Under Resend's data processing agreement the processing takes place mainly in the United States. Resend offers several sending regions, among them the United States and the EU (Ireland); according to Resend the region only determines where e-mails are sent from, not where data is stored. Resend states that it stores account data, including e-mail metadata and logs, in the United States regardless of the sending region. Which sending region is set for the form's sender address is not promised here; a transfer to the United States takes place in any case. Resend states that it concludes a data processing agreement with EU standard contractual clauses at sign-up; it names the EU-U.S. Data Privacy Framework as an additional mechanism. For Cloudflare see section 3. For the mailbox at Google Mail, the safeguards for transfers to third countries depend on the terms Google provides for the operator's account.
Information about the safeguards for transfers to third countries and, where available, where they can be viewed is available on request through the contact address. The data processing agreements of Cloudflare and Resend are publicly available (cloudflare.com/cloudflare-customer-dpa/ and resend.com/legal/dpa).
5. Analytics and tracking
The operator uses no analytics or tracking services. Cloudflare Web Analytics is a separate function that has to be switched on explicitly for Cloudflare Pages; it is not switched on.
6. Your rights
Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21 GDPR) and a complaint to a supervisory authority. Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to the processing at any time on grounds relating to your particular situation.
The processing is not based on your consent, so there is no consent to withdraw. Providing your data is neither a statutory nor a contractual requirement. The form cannot be submitted without its required fields, and without your e-mail address we cannot reply. There is no automated decision-making, including profiling.
Competent supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.
7. Changes
This notice is adjusted when the processing changes. As of 6 November 2026.