Privacy notice

Who is responsible

The controller for the processing described here is Stone Solutions, a sole proprietorship under the law of the Principality of Liechtenstein, owned by Japhet Stone.

Which law applies

Liechtenstein is part of the European Economic Area, so the General Data Protection Regulation (GDPR) applies directly, supplemented by the Liechtenstein Data Protection Act (DSG). The competent supervisory authority is the Datenschutzstelle Liechtenstein.

Where visitors are in Switzerland, the revised Swiss Federal Act on Data Protection (revDSG) may apply in addition.

Visiting this website

The site is hosted by Vercel Inc. Delivering a page necessarily involves processing your IP address, the page requested, the time of the request, and your browser's user agent, in server log data. This is done on the basis of our legitimate interest in operating the site and keeping it secure (Art. 6(1)(f) GDPR).

This site runs no advertising and sets no advertising cookies. Apart from Google Analytics, which loads only if you allow it, the pages load no scripts, fonts or other resources from third-party servers.

The connection to the site is relayed by Cloudflare, Inc., whose network terminates the encrypted connection, protects the site against abuse and delivers the pages from a location near you. For that purpose Cloudflare processes your IP address and the request data named above, on the same legal basis, and, as configured for this site, stores nothing in your browser.

Audience and performance measurement

We use Vercel Web Analytics to count visits and see which pages are read. It sets no cookies and stores nothing in your browser. Instead, Vercel derives a hash from your IP address and browser user agent, which is reset every day and discarded after 24 hours, so visits cannot be linked to you or followed between days.

We also use Vercel Speed Insights to measure how quickly pages load and respond, using the performance timings your browser already reports. It works the same way: no cookies, nothing stored in or read from your browser, and no identifier that would let a measurement be traced back to you.

Both are done on the basis of our legitimate interest in understanding whether the site works and is fast enough to use (Art. 6(1)(f) GDPR). Because nothing is stored on or read from your device, neither requires your consent — unlike Google Analytics, described below, which does.

Visitor statistics with Google Analytics

If you allow statistics, we use Google Analytics 4, provided by Google Ireland Limited, to understand how visitors find the site and which pages they read. It does not load until you allow it.

Once allowed, your browser connects to Google's servers, and Google Analytics sets the two cookies listed below, which recognise your browser on later visits. It records the pages you view, how you arrived (for example the referring site or search engine), the approximate location derived from your IP address, and technical details such as device type, browser and screen size. According to Google, Google Analytics 4 does not log or store IP addresses.

We have switched off Google signals and all advertising features, so this data is not linked to Google accounts and is not used for advertising. Google keeps the event data for the retention period set in our Google Analytics account and deletes it afterwards.

The basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time under "Your privacy choice" below; the site then stops sending data to Google and deletes the cookies.

What is stored in your browser

Before you answer the privacy question, the site stores nothing in your browser — unless you use the colour-scheme toggle in the header, which remembers your choice. Once you answer, it stores your answer in your browser's local storage. Neither entry is ever sent to us or used to recognise you.

If you allow statistics, Google Analytics sets the two cookies listed below on this site's domain.

Booking a call

To book a call, this site links to our booking page at Cal.com, which opens in a new tab. Until you follow that link, nothing is sent to Cal.com and nothing from Cal.com is loaded on this site; your visit there is covered by Cal.com's own privacy notice.

When you book, the details you enter — your name, your email address, the time you select, and anything you write in the notes field — are processed in order to schedule and hold the meeting (Art. 6(1)(b) GDPR). The appointment is synchronised to our calendar in Google Workspace so that it can take place.

Your privacy choice

You can change your mind at any time. Withdrawing is as easy as giving consent, and does not affect the lawfulness of what was done beforehand.

Business contacts we approach

We approach a limited number of consulting engineering firms in the building sector, such as building services and building physics consultancies, for which our work is relevant. We write to a director or another manager. For this we use your name, job title and business email address, and public information about your company, such as its website, job postings, projects and news. These details come from your company's website and from public sources such as business directories and search results. We never guess email addresses: if yours is not on the website, we write to your company's general address. If you ask, we tell you exactly where your details came from.

We send you one personal email asking whether you have time for a conversation, and possibly a LinkedIn connection request without an offer. We send no reminder emails and do not track whether you open our email. We do this on the basis of our legitimate interest in directing our work to businesses for which it is relevant (Art. 6(1)(f) GDPR).

We keep these details in our customer records, on our own server at Hostinger in Germany, and in our email. If you do not reply, we delete them six months after our message. If a conversation starts, we keep your details as a business contact.

You can object to this at any time. Reply 'stop' or write to us, and we will not contact you again; we handle this within two business days. We then keep only your email address or your company's domain, so that you are not approached again.

Recipients and transfers outside the EEA

We use Vercel Inc. for hosting, audience and performance measurement, Cal.com for scheduling, Google Ireland Limited for email, calendar and visitor statistics, and Hostinger International Ltd. for hosting our customer records on our own server in Germany. Each acts as a processor on our behalf under a data processing agreement, and each may process data outside the EEA — for those transfers we rely on the safeguards provided in their agreements, such as the European Commission's Standard Contractual Clauses. For Google, transfers to the United States can additionally rest on the EU-US Data Privacy Framework, under which Google LLC is certified.

For researching companies and drafting our messages to business contacts we use Claude by Anthropic Ireland, Limited. Anthropic receives the business details we enter, such as your name, job title and company, and processes them under its own terms, possibly also in the United States. We have switched off the use of our data for training its models.

We do not sell personal data and do not share it for advertising.

Cloudflare, Inc. (San Francisco, USA) relays the connection to the site and acts as a processor on our behalf under a data processing agreement, with the same safeguards for transfers outside the EEA as described above.

How long we keep things

Server log data is retained only as long as needed to operate and secure the site. Booking and enquiry correspondence is kept for as long as needed to deal with your enquiry and to meet any retention obligations that apply to us, and is deleted afterwards.

Your rights

You have the right to request access to your personal data, and to request rectification, erasure, restriction of processing and data portability. You may object to processing based on our legitimate interests, and withdraw consent at any time.

To exercise any of these, contact us using the details above.

You also have the right to lodge a complaint with the Datenschutzstelle Liechtenstein, or with the supervisory authority where you live or work.