'%20clip-path='url(%23clip-path)'%3e%3cpath%20id='Pfad_859'%20data-name='Pfad%20859'%20d='M112.437,39.789a39.512,39.512,0,0,0,10.412-.978c8.686-2.472,10.392-10.258,10.392-18.364,0-13.8-5.331-19.35-18.906-19.35H98.4V2.362c5.407.69,5.464,1.265,5.464,6.554V39.789ZM110.193,6.9c0-3.1,2.186-3.1,4.717-3.1,11.275,0,12.022,7.359,12.022,16.673,0,10-1.265,16.615-12.77,16.615-3.221,0-3.969-.747-3.969-3.795Z'%20transform='translate(-41.996%20-0.468)'%20fill='%23f40752'/%3e%3cpath%20id='Pfad_860'%20data-name='Pfad%20860'%20d='M171.556,39.324V0l-12.08,1.322V2.587c5,.632,5.753.4,5.753,5.634v31.1Z'%20transform='translate(-68.061%200)'%20fill='%23f40752'/%3e%3cpath%20id='Pfad_861'%20data-name='Pfad%20861'%20d='M80.341,39.789,66.305,1.1H55.491V2.362c1.783.287,4.429.287,4.429,2.7a20.239,20.239,0,0,1-.978,3.392L47.495,39.789h3.567l4.315-11.958H70.044l4.315,11.958ZM69.066,25.129H56.354L62.509,8.341Z'%20transform='translate(-20.27%20-0.468)'%20fill='%23f40752'/%3e%3cpath%20id='Pfad_862'%20data-name='Pfad%20862'%20d='M204.888,39.8V3.805H208.8c4.315,0,6.27,1.322,6.27,5.807h1.611l-.23-8.509H187l-.23,8.336h1.61c.346-4.369,1.841-5.634,6.213-5.634h3.97V39.8Z'%20transform='translate(-79.71%20-0.471)'%20fill='%23f40752'/%3e%3cpath%20id='Pfad_863'%20data-name='Pfad%20863'%20d='M271.176,25.067c0,6.727-.46,12.188-8.8,12.188s-8.226-7.186-8.226-13.511V0l-12.08,1.322V2.588c5.062.632,5.753.46,5.753,5.634v18.4c0,9.372,4.487,13.338,13.805,13.338,11.332,0,13.69-5.462,13.69-15.523V.633h-4.142Z'%20transform='translate(-103.311%20-0.001)'%20fill='%23f40752'/%3e%3cpath%20id='Pfad_864'%20data-name='Pfad%20864'%20d='M306.354,38.462a42.618,42.618,0,0,0,10.066,1.494c7.421,0,14.439-2.759,14.439-11.326,0-12.3-18.7-11.5-18.7-20.352,0-3.45,2.071-5.576,5.522-5.576a24.778,24.778,0,0,1,10.3,2.587V1.035A49.594,49.594,0,0,0,318.779,0c-6.442,0-12.943,2.472-12.943,9.946,0,12.13,18.695,11.268,18.695,20.582,0,4.6-2.819,6.727-7.19,6.727-3.739,0-7.823-1.61-10.987-3.45Z'%20transform='translate(-130.525%200)'%20fill='%23f40752'/%3e%3cpath%20id='Pfad_865'%20data-name='Pfad%20865'%20d='M23.039,39.794V1.1H0V39.794H5.233l4.194-7.886L5.236,25.133h4.19l4.187,6.776L9.43,39.794h2.087l4.194-7.886L11.52,25.133h4.19L19.9,31.909l-4.184,7.886Z'%20transform='translate(0%20-0.471)'%20fill='%2366676c'/%3e%3c/g%3e%3c/svg%3e){kind=small}
Privacy policy
How the ADITUS developer portal handles data.
Last updated: 15 September 2026
1. Controller
The controller for processing personal data on this website is ADITUS GmbH, Straße der Nationen 5, 30539 Hannover, Germany. General contact: info@aditus.de, +49 511 866557-30.
2. Data protection officer
ADITUS GmbH has appointed a data protection officer. You can reach the data protection officer directly — separately from the general company contact — at: ADITUS GmbH, – Datenschutzbeauftragter –, Straße der Nationen 5, 30539 Hannover, Germany, email: datenschutz@aditus.de. Please use this address for all questions about data protection and for exercising your rights.
3. What this website does
This website provides information and documentation for the ADITUS API and related developer tools. It does not process payments. The interactive live demo and integration tester send requests to ADITUS demonstration and API services so that the documented flows can be displayed. Enter only test data in these tools; do not enter real customer or ticket-holder data.
4. Technical access data and server logs
When you open this website, our hosting and API infrastructure may process the IP address, date and time of the request, requested URL, referrer, browser and operating-system information, and response status and size. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure, stable and abuse-free delivery of the portal and the connected API services, including fault diagnosis and defence against attacks. Log data is not used to identify you personally and not used for advertising profiles. Deletion criteria: log entries are deleted or anonymised as soon as they are no longer needed for security analysis, fault diagnosis and abuse prevention; entries that are required as evidence of a specific security incident are kept until the incident has been finally resolved. We do not state a fixed retention period here because log rotation is handled by the hosting infrastructure described in section 8. Exception: the application-level usage log of the public documentation MCP server (see the privacy note at /mcp) contains no IP address, only a keyed hash of it, and its rows are deleted after 90 days at the latest.
5. Local storage and session storage
We do not set any cookies ourselves on this website; cookies can only occur if you actively consent to analytics (see section 6). We distinguish two categories of browser-storage access. (a) Storage that does not require consent (§ 25(2) no. 2 TDDDG — strictly necessary to provide the service you explicitly request; where personal data is involved at all, the legal basis is Art. 6(1)(f) GDPR). We assess each storage access individually instead of classifying all of them as strictly necessary as a group: some entries are needed for a function you explicitly trigger, while convenience settings are each written only at the moment you actively make the respective choice — storing that deliberate choice is itself the service you request in that moment. localStorage may contain your deliberately selected language (aditus-docs-lang-choice and the legacy aditus-docs-lang), the light/dark theme (aditus-docs-theme and the legacy aditus-theme), the selected TypeScript/JavaScript example language (aditus-code-lang), the language of the internal admin console (aditus-admin-lang, written only when an administrator switches it), collapsed API navigation groups (aditus.docs.sidebar.collapsed), the last successfully retrieved demo-status result for a short cache period (aditus-demo-health-cache), a temporary pending checkout reference so a live demo can resume after a payment redirect (keys starting with aditus-live-demo-pending-pay:, never payment data), and your analytics consent decision (granted or declined) under the key aditus-analytics-consent so we do not ask again. If you use the interactive 'try it' runner of the API reference, the API base URL you select is stored in localStorage as a convenience setting (aditus.docs.baseUrl) until you clear or overwrite it. The API token you enter there is not stored: it is kept only in the transient state of the currently open page and is never written to localStorage, sessionStorage or any other durable browser storage; a token saved by an earlier version of this portal under the key aditus.docs.token is automatically removed the next time you open the portal. Enter only test credentials in these tools. sessionStorage is used for temporary code-tab choices (keys starting with snippet-tab:), the id of the last demo cart (aditus-live-demo-last-cart-id) and short-lived tester state for the return from a payment redirect, including a short-lived session token (aditus-tester:pay-resume). (b) Consent-required access (§ 25(1) TDDDG): only the Google Analytics cookies and identifiers described in section 6, and only after your consent. All values remain in your browser, are not sent to us merely because they exist, and can be deleted through your browser settings. For legacy checkout, the shared cache also stores signed cart-creation grants in sessionStorage under keys starting with aditus-legacy-checkout:, namespaced by tenant and identity, with at most 32 grants valid for up to 24 hours; these grants are cleared when the identity changes. Each grant authorizes only its exact cart and tenant. orderAccessToken remains memory-only. The live-demo localStorage record under aditus-live-demo-pending-pay: may also include the same signed legacy grant so a payment return in a new window opened with noopener can resume without inherited sessionStorage. This record contains no payment data and is removed after consumption or expiry (24 hours, cleaned up on the next read or write).
Cart scope, trust and storage
Unconfirmed form drafts are kept per tab in sessionStorage and remain valid for 2 hours from the last edit. This is an application validity limit, not a guarantee that the browser physically deletes bytes at the TTL; expiry is checked when the application accesses the draft. The saved journey pointer contains no raw email. Tokens are never written to localStorage; browser session helpers may keep short-lived session tokens in tab-scoped sessionStorage. Backend sessions default to 20 minutes. Confirmed registrations, orders and other business data remain in the ADITUS ticketing system under its retention rules; the draft TTL does not delete them.
'shared' shares one cart only between tabs with the same origin, publicKey, trusted identity and event; 'tab' keeps every tab separate. Only one tab edits at a time; coordination between tabs never transmits tokens or email addresses.
6. Google Analytics 4 (consent only)
This developer portal can use Google Analytics 4 (GA4), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, exclusively with your prior consent. The legal basis for the processing of personal data is Art. 6(1)(a) GDPR; the legal basis for storing and reading identifiers on your device is § 25(1) TDDDG. Until you actively agree via the consent banner, no Google Analytics script is loaded, no request is sent to Google and no analytics identifiers are created. If you consent, GA4 measures which public pages and documentation sections are used (page views and a few curated interaction events with static identifiers), and Google may set analytics cookies and identifiers (e.g. _ga). IP handling in the current version of GA4: according to Google, GA4 does not log or store IP addresses; the IP address is used transiently to derive coarse geolocation and to route the request — for EU traffic via EU-based servers — and is then discarded. We additionally set the legacy anonymize_ip parameter as a defensive default. Retention: Google Analytics stores event- and user-level data only for the limited retention period configured in the Analytics property (Google offers settings between 2 and 14 months), after which it is deleted automatically; we make no further claims about specific periods here. The admin area is never measured, and requests to API, shop or queue services are not captured. Names, email addresses, API keys, access tokens, form input, ticket-holder data and payment data are never sent to analytics. You can withdraw your consent at any time via the permanently available 'Privacy settings' link in the footer; withdrawal takes effect immediately for all further events. Google may transfer data to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. If no measurement configuration is present, analytics remains completely disabled and no banner is shown.
6a. Anonymous reach measurement (no consent required)
Independently of your cookie decision, the portal counts page views itself: on each page opened (including navigation within the page), the browser sends only the called page path (without query parameters), the selected portal language, whether it was an initial load or an in-page navigation, and the domain of the referring website, if any, to our server. No cookie is set, nothing is stored on your device and no user identifier is created. Your IP address and browser identifier are used solely and immediately on the server to compute a keyed daily hash that allows distinct visitors to be counted per day; the IP address itself is never stored, the hash cannot be reversed and changes every day, so no profile across days is possible. Automated clients are filtered out. The counts are deleted after 90 days at the latest. Because no personal data is stored and nothing is accessed on your device, this measurement is not covered by Section 25 TDDDG; insofar as the momentary processing of your IP address is concerned, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in an anonymous overview of portal usage). The /admin area is never counted.
7. Fonts, media and external links
The fonts used by this portal are served locally from our own website. We do not load Google Fonts or other font resources from third parties. Some documentation links, release notes or demo resources lead to external websites or APIs. Those providers process data under their own privacy policies when you follow the link or when a browser request to that service is required by an interactive feature.
8. Hosting and recipients
This developer portal and the connected ADITUS demonstration and API services are operated on the infrastructure of a specialised cloud hosting provider established in the USA, which acts as our processor and processes the technical access data described in section 4 on our behalf; processing may take place on servers in the USA (third-country transfer safeguarded in accordance with Chapter V GDPR). We will name the hosting provider on request via our data protection officer. The legal basis is Art. 6(1)(f) GDPR (reliable and secure operation of the portal). Further recipients: Google Ireland Limited receives data only if and after you consent to analytics (section 6). ADITUS's own systems process the requests you trigger in the interactive demo tools. Beyond these categories, we do not disclose personal data collected on this website to other recipients unless we are legally obliged to do so. For clarity, the recipient categories in this section include the optional external AI processor described in section 8a.
8a. Optional AI screenshot analysis
Only when you actively start photo or URL analysis in the Styling tool, a reduced, metadata-stripped rendition of the uploaded image or captured public page is sent to our configured external AI processor to estimate visual design roles such as colors, typography, spacing and radii. For URL analysis, ADITUS opens the public page and creates the screenshot. The original upload or full captured screenshot is not sent to the AI service. ADITUS retains the uploaded image or captured URL screenshot and derived style sets for six months for internal quality control, after which they are deleted; any transient processing and possible third-country transfer by the processor are governed by its applicable data-processing and transfer terms. We will name the current processor and applicable safeguards on request via our data protection officer. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is providing the optional design aid that you explicitly trigger. You can use the Styling tool without this function. Do not upload screenshots or enter URLs for pages containing personal, confidential or secret information.
9. Contact
If you contact us by email, we process the information you provide, including your email address and message, to answer your request and handle any follow-up. Legal basis: if your enquiry relates to a contract with us or to pre-contractual steps taken at your request (for example questions about becoming an ADITUS customer or about an existing integration), the processing is based on Art. 6(1)(b) GDPR; for all other enquiries the legal basis is Art. 6(1)(f) GDPR, our legitimate interest being the proper handling of correspondence addressed to us. We delete correspondence when it is no longer required for these purposes, unless statutory retention duties apply.
10. Your rights
You have the right to request access to, correction or deletion of your personal data, restriction of processing, and data portability where applicable. You may object to processing based on legitimate interests and withdraw consent with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority. To exercise your rights, contact our data protection officer at datenschutz@aditus.de or write to info@aditus.de.
11. Updates
We may update this privacy notice when the website, its services or legal requirements change. The version published on this page is the applicable version for the ADITUS developer portal.