Privacy Policy

4.1 Accessing the pages

When you access the site, our server processes technically necessary data: IP address, date and time, the address requested, the amount of data transferred, the page visited before, and browser and operating system. Without this data, the page cannot be delivered.

We use the data to deliver the page, to remedy faults and to fend off attacks. The data is not combined with other data. We delete the access logs after [14] days, unless a security incident has to be investigated.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in a secure and functioning service.

4.2 Language

We display the site in the language of your browser: German if your browser is set to German, otherwise English. We store nothing for this.

If you choose a language yourself using the language switcher, we store this choice in a cookie named “sub_locale” for one year. It contains only the language code. Storage is strictly necessary to provide the service you have expressly requested and is therefore permitted without consent under Section 25(2) no. 2 TDDDG.

4.3 Light or dark mode

The site follows your device’s setting. If you choose light or dark yourself, your browser stores this choice locally under “nuxt-color-mode”. This information does not leave your device. The same legal basis applies as for the language.

4.4 Fonts and icons

We deliver fonts and icons from our own server. No connection to providers such as Google is established when you visit.

4.5 No analytics, no advertising

We use no analytics, tracking or advertising tools, no pixels and no embedded content from social networks, videos or maps.

4.6 Contact by email

The buttons “Book a first conversation” and “Let’s talk about it” open your own email program with a prepared text. If you have marked places on the page with “I know this”, this selection appears in the text. Your selection is neither stored nor transmitted on the page itself.

We receive your details only when you send the message: your email address, your name and the content. We use them to answer your enquiry and to prepare a conversation.

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry aims at a contract, and otherwise Art. 6(1)(f) GDPR. Our email mailbox is operated by [provider, registered office] on our behalf.

Please note: an ordinary email is not encrypted in transit in every case. Please therefore send us confidential documents only after we have agreed a secure channel.

4.7 Preview image when sharing

If you share a link to our website in a network or messaging service, its server retrieves a preview image from our site. What that service processes in doing so is determined solely by its operator in accordance with its own privacy terms.

4.8 Links to other sites

If a link leads to a third-party site, the privacy policy of its operator applies there. We are not responsible for processing on third-party sites.

5.1 Account and login

For an account, we process name, email address, role, password (only as an encrypted verification value) and, if set up, the details of two-factor authentication. After login, the platform sets a session cookie. It is technically necessary for login and ends on logout or when the session expires. For each session we store the IP address and browser identifier in order to detect misuse.

For invitations, password resets and notifications, we send emails through a delivery service (Section 5.6).

5.2 Change log

The platform records who changed or confirmed what in the model and when. The log serves the traceability of the company model and is part of the service ordered by the customer.

5.3 AI functions in basic access

Functions such as suggestions, evaluations, reading out documents and research use large language models. For this, the platform transmits the content required in each case to a language model and receives a response. In basic access, these requests run through an AI gateway to the provider set in the instance. All parties involved are named in Section 5.6.

The response of a language model is a suggestion. It enters the customer’s model only once a person has reviewed and confirmed it.

5.4 The customer’s own AI model

If a customer stores its own key from an AI provider, the requests go directly to that provider. The customer has its own contract with the provider. The customer alone is responsible for ensuring that this transmission is permissible, including to third countries. In this case, the provider is neither our subprocessor nor our recipient. Research functions always use a model from Anthropic: with the customer’s own Anthropic key, if stored, otherwise through basic access.

5.5 Connections to other systems

If a customer connects its own systems, such as ERP, SharePoint, Shopware or Akeneo, the platform takes over data from these systems into its instance. The customer determines which systems are connected and which data flows. We store the access credentials in encrypted form.

5.6 Service providers and recipients

We use carefully selected service providers who process data only on our instructions and with whom data processing agreements are in place.

5.7 Transfers to third countries

Some service providers are based in the USA. We transfer data there only if the recipient is certified under the EU-US Data Privacy Framework (Art. 45 GDPR) or if the EU Commission’s standard contractual clauses have been agreed with it (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards on request.

5.8 Institute: anonymous patterns only

To improve the method and the platform for all customers, we derive anonymous, aggregated patterns on our customers’ instructions, such as frequent questions or impact relationships. A pattern contains no names, no content verbatim and nothing from which a company or a person can be identified. It is used only once it originates from at least five tenants and no characteristic applies to fewer than three companies. Anonymous patterns are no longer personal data.