Discuss your project

LEGAL

PRIVACY POLICY.

What data is processed when you visit this website, for what purpose, on what legal basis – and what rights you have.

This is a translation for convenience. The German version is legally binding.

01Controller

TOMORIS GmbH
Saturnstraße 1
4614 Marchtrenk
Austria

Email: contact@tomoris.com
Phone: +43 7243 53091

02Purpose and scope

This privacy policy describes the processing when you visit this website, when you select external links and when you contact us by email or via the website form. The website explains on the form whether direct transmission is enabled.

Fonts and images are delivered with the website. Google Analytics is only loaded on our production website once you consent to statistics. A separate choice is provided for additional ad measurement. The following sections explain the purposes and your choices.

03Hosting and delivery

The website is delivered as a Next.js/Node.js application, together with its static files, via the existing Hostinger application. Technically necessary server and access logs may be created when the website is accessed. They contain, for example, the time, the requested resource, the transfer status and the connection (including the IP address).

The servers and the processing of these logs are located in the EU. Hostinger processes them as a processor and, according to its own information, keeps them as long as necessary for operation; Hostinger does not state a specific period for this.

04Contacting us

The form processes topic, name, email address and message, and optionally company and phone number, in order to pass your request on to TOMORIS and answer it. When you register for the Ambassador Program, your relationship to TOMORIS and your interests are added; they are placed at the beginning of the message.

Direct sending from the website is enabled in the active runtime configuration. After successful validation and abuse checks, a plain-text message is passed via the technical sending mailbox website@tomoris.com to the fixed production recipient contact@tomoris.com.

The visitor’s address is used exclusively as Reply-To. It cannot determine the sender, recipient, Cc or Bcc. The application code does not store the message or contact details in its own database or file and does not write them to application logs. After handover, your request is processed further in the TOMORIS Microsoft 365 mailbox.

Providing your data is voluntary. Without name, email address and message, however, we cannot process your request via the form; alternatively, you can reach us by phone.

05Toolbox: free check tools

With the server-side check tools of the TOMORIS Toolbox, such as the security header check, you enter a domain or web address. Our web server then retrieves the specified website and creates the report from it. Depending on the tool, this means the page you entered, its redirects with and without www, its robots.txt and a sitemap; or it queries the domain’s public DNS records instead. The checked website receives a request from our server, not your IP address.

For the DNSSEC check of the DNS security check, our web server queries the DS and DNSKEY records of the entered domain from Cloudflare’s public DNS resolver (DNS over HTTPS). Cloudflare receives the domain name and our server’s IP address, not your IP address. According to its own information, Cloudflare does not permanently store the requesting IP address for its public resolver and deletes the resolver logs within 25 hours. Our web server makes all other DNS queries via its hosting provider’s resolver. With the cookie check, the checked website sets its cookies for our web server, not in your browser. We only evaluate names and attributes and include the values neither in the report nor in the cache.

With the Microsoft 365 domain check, our web server additionally retrieves the public sign-in metadata (OpenID Connect) for the entered domain once from Microsoft at login.microsoftonline.com. This shows whether Microsoft assigns a Microsoft Entra tenant to the domain. Microsoft receives the domain name and our server’s IP address, not your IP address; we do not query user accounts.

With the certificate transparency check, our web server queries crt.sh for the certificates of the entered domain and its subdomains. crt.sh is a search across the public Certificate Transparency logs operated by Sectigo. Sectigo receives the domain name and our server’s IP address, not your IP address. We keep the response from crt.sh in the web server’s memory for up to one hour, so that repeated checks of the same domain do not put renewed load on crt.sh. With the lookalike domain check, our web server queries public DNS records via its hosting provider’s resolver for up to 40 spelling variants derived from your input; it does not access the websites of these domains. For the list of Microsoft 365 endpoints, our web server retrieves the published Microsoft 365 addresses from Microsoft at endpoints.office.com at most once per hour. No input or data from you is transmitted; Microsoft only receives our server’s IP address and a fixed identifier of the request.

We do not store your input and the result permanently. We keep the result in the web server’s memory for five minutes, so that a repeated check of the same address does not put renewed load on the target website; it is deleted after six minutes at the latest. To limit checks to twelve per minute, we keep a salted hash of your IP address in memory; it is deleted after two minutes at the latest. Both are gone after a restart of the web server. Tools that run entirely in your browser do not transmit your input to us; this is stated for each tool.

You may start the website security check via the input field on the home page, or open another tool for the same domain from a report. In that case, your browser briefly stores the domain in the session storage of this browser tab (tomoris-toolbox-handoff) for the switch to the tool page. The tool page reads the entry when it loads and deletes it immediately. Without JavaScript, or if you open a link in a new tab, the domain appears in the address of the tool page instead (?domain=).

Before every server-side check, Cloudflare Turnstile protects the Toolbox against automated abuse, as described in the following section.

06Cloudflare Turnstile

When direct sending is enabled, Cloudflare Turnstile protects the form against automated abuse; it also protects the server-side check tools of the Toolbox. The token generated in the browser is verified server-side via Siteverify. Success, the expected hostname and the action contact (form) or toolbox (check tools) must match. For the security check, Cloudflare processes browser and connection signals: IP address, TLS fingerprint, user agent and the calling website, but not form content. The verification token is valid for five minutes and can only be verified once. Cloudflare does not state a retention period for these signals. According to its own information, Cloudflare additionally uses them as an independent controller to improve bot detection.

The TOMORIS application code does not transmit the form text as Turnstile content. The preview widget and the separate production widget for tomoris.com use separate keys. As long as direct sending is disabled, Turnstile is not loaded in the form; in the Toolbox, it only loads on the pages of server-side check tools.

07AI assistant

On the AI assistant page and in the AI assistant window, which you open on every page via the icon at the edge of the screen, you can ask questions about the content of this website. The window only loads the assistant and Cloudflare Turnstile when you open it. To answer, our web server searches the public pages of this website for matching sections and transmits your question together with these sections to Anthropic, the provider of the AI model Claude. For follow-up questions, the last up to three questions and answers of the conversation are included. Anthropic generates the answer that is displayed to you. The request is made by our server; we do not transmit your IP address to Anthropic.

Please do not enter any personal or confidential data in the assistant. We only process what you enter in order to answer your question. The application code does not store questions and answers and does not write them to application logs; it only counts how many questions were answered, not answered or rejected. To limit questions to six per minute, we keep a salted hash of your IP address in memory, as with the Toolbox; it is deleted after two minutes at the latest. Before every question, Cloudflare Turnstile protects the assistant against automated abuse (action assistant), as described in the Cloudflare Turnstile section.

Anthropic processes the transmitted content as our processor under Anthropic’s Commercial Terms and Data Processing Addendum. Under these terms, the contracting party for customers in the EEA is Anthropic Ireland, Limited, Ireland. Processing also takes place in the USA by Anthropic, PBC; the transfer is based on the European Commission’s Standard Contractual Clauses, which the Data Processing Addendum incorporates. Under the Commercial Terms, Anthropic does not train models with this content. According to its own information, Anthropic deletes API inputs and outputs within 30 days; content that automated checks flag as a possible violation of the usage policies may be retained by Anthropic for up to two years. Further information can be found in Anthropic’s Commercial Terms, Data Processing Addendum and list of subprocessors.

The conversation history stays in your browser: your browser stores it in the session storage of this tab (tomoris-assistant-verlauf) so that follow-up questions are understood. It is gone when you close the tab or choose “Clear history”. Your browser also stores there where you moved the icon and whether the window is open (tomoris-assistant-fenster), without any content, so that both remain when you change pages. If you choose “Hand over to TOMORIS”, your browser briefly stores the summary of your request in session storage (tomoris-assistant-handoff); the contact form copies it into the message field and deletes the entry immediately. It is only sent to TOMORIS when you submit the form yourself; the section “Contacting us” then applies.

The legal basis is our legitimate interest in answering questions about our content quickly and protecting the service against abuse (Art. 6(1)(f) GDPR); if your question relates to a TOMORIS service, additionally the implementation of pre-contractual measures (Art. 6(1)(b) GDPR). Storing the history and window position in the browser is necessary for the service you have expressly requested (Section 165(3) TKG 2021). Use is voluntary; you can also find all content without the assistant on the linked pages.

The answers are generated by an AI model. They may contain errors and do not replace advice; the linked pages are authoritative. The assistant does not make decisions with legal effect for you.

08Microsoft 365

When direct sending is enabled, the website authenticates server-side via a dedicated single-tenant Entra app with client credentials. Microsoft Graph technically accepts the message and passes it to Microsoft 365 via Exchange Online.

Exchange Online Application RBAC restricts Application Mail.Send to the sending mailbox website@tomoris.com. A positive test for this mailbox and a negative test for a mailbox that is not enabled have been confirmed. The app has no additional tenant-wide Mail.Send permission and no Mail.Read, Mail.ReadWrite, calendar or contact permissions.

09Storage in the browser

The website stores the settings you have expressly chosen in your browser’s local storage:

  • tomoris-theme: light or dark mode
  • tomoris-sound: sounds on or off
  • tomoris-consent-v1: your choice for statistics and ad measurement, valid for 180 days

These setting values stay on your device and restore your choice on your next visit. Display mode and sound remain stored until you delete the website data; once the consent choice expires, we ask again. You can change or withdraw your consent at any time via “Privacy settings” in the footer.

10Statistics and ad measurement

With your consent, we use Google Analytics 4 from Google Ireland Limited, Ireland, to analyze visits, viewed pages, time of use and interactions on tomoris.com and to improve our website. Among other things, technical browser and device information, a pseudonymous cookie ID, page and campaign information and interactions are transmitted to Google. The IP address is processed for the connection; Google states that, for access from the EU, Switzerland or the United Kingdom, individual IP addresses are not logged or stored.

Google Analytics is not loaded before you consent to statistics. With “Necessary only”, you use the website without this measurement. If you also allow “Ad measurement”, statistics and campaign information may be used to evaluate our Google ads. Google Signals and personalized advertising are disabled in our website integration.

A request is only measured as a successfully submitted form event once our server has confirmed its acceptance. The measurement contains the form type; we do not transmit the name, email address, phone number, company or message from the form to Google for this purpose. Clicks on phone or email links are measured as separate interactions. They do not prove that a call took place or an email was sent.

For statistics, Google may set cookies such as _ga and _ga_…. Our integration limits their validity to 180 days, without automatic extension on each visit. If ad measurement is allowed, additional Google measurement cookies may be added. You can withdraw your consent at any time with effect for the future via “Privacy settings” in the footer; the website then stops measurement and removes accessible Analytics measurement cookies. Withdrawal does not retroactively delete data that has already been lawfully processed.

Google may also process data outside the EU or EEA. Information about the provider and the processing can be found in Google’s privacy policy and in the information on Google Analytics and data protection in the EU. Retention of event data in the Analytics property is managed separately from cookie validity.

12Legal bases

  • Provision of the website and server logs: legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).
  • Contact requests: implementation of pre-contractual measures if your request relates to a service (Art. 6(1)(b) GDPR); otherwise legitimate interest in responding (Art. 6(1)(f) GDPR).
  • Toolbox check tools: legitimate interest in providing free check tools and protecting them against abuse (Art. 6(1)(f) GDPR).
  • Abuse protection with Cloudflare Turnstile: legitimate interest in protecting the form and the check tools (Art. 6(1)(f) GDPR).
  • Statistics and ad measurement: your voluntary consent (Art. 6(1)(a) GDPR and Section 165(3) TKG 2021), which you can withdraw at any time via “Privacy settings”.
  • Storage of your settings in the browser: necessary to provide a setting and consent choice you have expressly selected (Section 165(3) TKG 2021).

13Recipients and third countries

The following are technically involved: Hostinger for hosting and delivery; Cloudflare for Turnstile and as the DNS resolver for the DNSSEC check of the DNS security check; Microsoft Entra, Microsoft Graph and Exchange Online for authentication and message handover, Microsoft Entra also for the tenant lookup of the Microsoft 365 domain check; Microsoft, with the web service endpoints.office.com, for the list of Microsoft 365 endpoints; and Sectigo, as operator of crt.sh, for the certificate transparency check. With your consent, Google is additionally involved in statistics and ad measurement. TOMORIS processes requests in the designated Microsoft 365 mailbox. Unconfirmed details on contracts, subcontractors or regions are not presented here as fact.

Cloudflare and Microsoft are companies headquartered in the USA, so processing outside the EU or EEA cannot be ruled out. According to their own information, these providers base such transfers on the EU-U.S. Data Privacy Framework or on the European Commission’s Standard Contractual Clauses. Processing outside the EU or EEA also cannot be ruled out for Sectigo as the operator of crt.sh. For Google, please also refer to the provider information linked above.

For the AI assistant, Anthropic is additionally involved as a processor (Anthropic Ireland, Limited, Ireland, and Anthropic, PBC, USA). The transfer to the USA is based on the European Commission’s Standard Contractual Clauses; details are in the AI assistant section.

14Retention period

The website code does not maintain its own contact database. We store requests in the TOMORIS Microsoft 365 mailbox and delete them once they have been dealt with, unless statutory retention obligations apply. If a request leads to a business transaction, we keep the correspondence as business correspondence under Section 212 UGB for seven years from the end of the calendar year in which it was received.

For server logs at Hostinger and Turnstile signals at Cloudflare, the information in the sections on hosting and Cloudflare Turnstile applies; for input in check tools, the Toolbox section applies.

15Your rights

You have the right of access, rectification, erasure and restriction of processing, the right to data portability and the right to object to processing based on legitimate interests (Art. 15–21 GDPR). To exercise these rights, please contact contact@tomoris.com.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with a supervisory authority. In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at).

No automated decision-making, including profiling, takes place on this website.

16Security and updates

The form uses server-side field and origin checks, a body limit, timeouts, Turnstile and fixed sending targets. Credentials and tokens remain server-side and are never output in the browser. Transmission is encrypted via HTTPS.

This policy is updated when provider information or the actual data flows change.

Status of this policy: October 2026