← AI-Host4me

Privacy Policy

Last updated: 11 July 2026

AI-Host4me ("we", "us") operates ai-host4me.nl, a free library of ready-to-use Claude Skills. We keep data collection to a minimum and never sell personal data. This policy explains what we process, why, and your rights under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

AI-Host4me is the data controller. Contact: support@ai-host4me.nl.

2. What we process and why

  • Access requests — your e-mail address, an optional name, your reason for requesting access and the requested skill category. Used solely to review and approve your (free) membership. An administrator is notified by e-mail.
  • Member list — approved e-mail addresses. Stored encrypted (AES-256-GCM) in private storage outside the web root; the list is unreadable without the server-side key.
  • Login — passwordless login with a one-time e-mail code (valid 10 minutes), sent from noreply@ai-host4me.nl via our own mail server. A functional session cookie keeps you signed in for up to 8 hours.
  • Administrator 2FA — TOTP secrets for administrator accounts, stored encrypted.
  • Security — temporary counters per IP address for failed login attempts (lockout of 15 minutes, then 1 hour). These reset automatically.
  • Reviews — if you submit a review: name, role, rating, review text and your e-mail address. Only the name, role, rating and text are published, and only after manual approval; your e-mail address is never published.
  • Skill submissions — if you submit a skill: your e-mail address, the uploaded ZIP and the repository URL, used to review the submission.
  • Visitor statistics (only with your consent) — see section 3.

Legal bases: performance of the membership relationship (Art. 6(1)(b) GDPR), your consent for statistics (Art. 6(1)(a)) and our legitimate interest in keeping the service secure (Art. 6(1)(f)).

3. Visitor statistics (consent-based)

Measurement only starts after you accept statistics in the cookie banner. We use two systems for this.

Our own, first-party analytics. We record: the pages you view, the referring page, your browser type (user agent), a random visitor ID stored in your browser, and a hashed version of your IP address (the hash uses a salt that changes daily, so it cannot be traced back to you or linked across days). Raw IP addresses are never stored for statistics. The data stays on our own server, outside the web root.

Google Analytics 4 (measurement ID G-DZTBTYL9CB) for aggregate reporting. It runs in Google Consent Mode v2: until you accept statistics it sends only cookieless, anonymous signals and sets no cookies; only after you accept does it place the _ga / _ga_<stream> cookies (see the Cookie Policy). IP addresses are anonymized and Google's advertising signals (ad storage, ad personalization) stay switched off, so there is no ad targeting or cross-site advertising profiling. Google acts as our processor for this.

4. What we do not do

  • No sale or sharing of personal data for marketing purposes.
  • No advertising networks, no ad personalization, no advertising profiling and no automated decision-making about you.

5. Recipients and processors

  • TransIP (Netherlands) — hosting of the website and e-mail.
  • Google (Analytics) — with your statistics consent, Google processes aggregate analytics data on our behalf. Data may be processed on servers outside the EU under Google's Standard Contractual Clauses and the EU-US Data Privacy Framework.
  • Google Fonts — the site loads its fonts from fonts.googleapis.com; when this happens your IP address is transmitted to Google to deliver the font files. Google does not receive any other data about your visit from us.

6. Retention

  • Membership data: for as long as you are a member. You can cancel at any time via the Cancel membership page, which removes your address from the member list.
  • Access requests and skill submissions: as long as needed to handle them.
  • Statistics: kept in aggregate form for trend reporting; visitor IDs are random and IP hashes rotate daily.

7. Security

Member and 2FA data are stored encrypted, private data lives outside the web root, all traffic uses TLS (HTTPS), and administrator access requires two-factor authentication.

8. Your rights

You have the right to access, rectify, erase and receive your data, and to restrict or object to processing. Where processing is based on consent you may withdraw it at any time (for statistics: via the "Cookie settings" link in the footer). Contact support@ai-host4me.nl. You can also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

9. Changes

We may update this policy; the date at the top shows the latest version. Substantial changes will be announced on the site.