Privacy Policy — Trainator

Controller

Who is responsible

The party responsible for data processing on this website and the Trainator browser extension within the meaning of the GDPR is:

Trainator UG (haftungsbeschränkt)
Haid-und-Neu-Strasse 18, 76131 Karlsruhe, Germany
paulin@trainator.eu

Website

Visiting trainator.eu

When you browse trainator.eu we do not collect, store, or process any personal data. There are no tracking cookies, no analytics scripts, and no fingerprinting of any kind placed on your device.

Your browser will naturally make DNS and TCP connections to our hosting provider's servers to load pages; that is inherent to how the web works. We do not log those requests ourselves and we do not instruct our hosting provider to retain them beyond their standard infrastructure operation.

Browser Extension

Trainator extension

The Trainator browser extension contacts our API to fetch confidence scores. To prevent abuse and to count active users — without identifying individual people — each API request carries a one-way hashed representation of your IP address.

The hash is computed with a rotating server-side salt, which means:

The original IP address is never stored on our servers.
The hash cannot be reversed to recover your IP.
Hashes from different salt periods cannot be linked to each other.

To generate a connection reliability score, the extension also transmits the following search parameters to api.trainator.eu: train identifier, station identifier, travel date, and transfer time in minutes. These parameters are derived from your active search on bahn.de and are not stored beyond the duration of the API request.

No other data — browser type, visited pages, or any persistent identifiers — is transmitted to or retained by Trainator.

Data	Purpose	Legal basis	Retention
Hashed IP (non-reversible)	Abuse prevention, user-count telemetry	Art. 6(1)(f) GDPR — legitimate interest	Max. 90 days, then deleted
Train ID, station ID, travel date, transfer time	Computing the requested reliability score	Art. 6(1)(b) GDPR — provision of the requested service	Not stored; discarded after the API response

Third parties

No data sharing

We do not sell, rent, trade, or otherwise disclose any data to third parties. No advertising networks, data brokers, or analytics providers receive information about you from Trainator.

Your rights

Your rights under GDPR

Under the General Data Protection Regulation you have the following rights:

Right of access (Art. 15) — request confirmation of whether we hold data about you.
Right to rectification (Art. 16) — have inaccurate data corrected.
Right to erasure (Art. 17) — request deletion of your data.
Right to restriction (Art. 18) — limit how we use your data.
Right to object (Art. 21) — object to processing based on legitimate interest.

Because the hashed IP is non-reversible and not linked to an identity, we have no technical means to locate records belonging to a specific person. If you believe data about you is held, contact us and we will assist to the best of our ability.

You also have the right to lodge a complaint with the supervisory authority responsible for Baden-Württemberg:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW)
Lautenschlagerstraße 20, 70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de

Contact

Data protection enquiries

For any questions or requests relating to this privacy policy or the processing of your data, contact us at paulin@trainator.eu.