Privacy Policy

<<SET_OPERATOR_NAME>>, <<SET_COMMERCIAL_ADDRESS_SERVICE — NOT a home address; §5 DDG requires a ladungsfähige Anschrift>>. Email <<SET_CONTACT_EMAIL>>.

We have not appointed a data protection officer; the threshold in §38 BDSG does not apply to us. Data protection questions go to the address above.

What we hold: your email address, your interface language, when the account was created, when you last signed in, and — if you sign in with Google — the identifier Google assigns to you.

We do not use passwords. You sign in with a one-time code sent to your email address, or with Google. There is no password to store, to leak, or to reset.

If you use Google Sign-In, we request only your Google identifier, your email address, and whether Google has verified it. We do not receive your name or your profile picture. If you have previously used the email-code method with the same address, we link the two rather than creating a second account.

Why and on what basis: to give you an account and let you sign in. Art. 6(1)(b) GDPR — performance of a contract.

How long: for as long as your account exists. If you do not sign in for 24 months we email you and delete the account 30 days later unless you sign in.

What you type into the intake form is processed to produce your brief and held for at most 24 hours in a temporary job store, then automatically deleted. We do not keep it beyond that.

Your brief is generated using a large language model operated by Anthropic PBC in the United States.

What is transmitted is what you enter in the intake form: your industry, company size, geography, business model, and ownership structure, together with your free-text description of the situation. There is no name field and no company-name field — we do not ask for either. The only identifying detail that can reach the model is whatever you choose to write in the free-text description.

Your account identifier, your email address, and any payment reference are not attached — the request is keyed to an opaque job identifier and carries nothing that links it to your account.

The transfer to the United States takes place on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) together with a data processing agreement.

Your brief is produced with AI assistance. It is a structured analysis, not legal, tax, or financial advice. See our AI Transparency Notice.

Sign-in codes and service notifications are part of the service. Art. 6(1)(b) GDPR. They are sent through Amazon SES in the Frankfurt region, from our own domain.

We send no marketing email unless you separately opt in, and you can withdraw that at any time.

The service runs on Amazon Web Services in the eu-central-1 (Frankfurt) region. Stored data is encrypted at rest; connections are encrypted in transit.

Server and access logs — IP address, time, request path, user agent — are kept for 90 days for security and error diagnosis, then deleted. Basis: Art. 6(1)(f) GDPR; our legitimate interest is keeping the service secure and available.

We set the cookies needed to keep you signed in and to remember your language. They are strictly necessary for a service you have requested, so under §25(2) TDDDG they do not require your consent. See the Cookie Policy for the full list.

You have the right to access your data (Art. 15), to have it corrected (Art. 16), to have it deleted (Art. 17), to restrict processing (Art. 18), to receive it in a portable format (Art. 20), to object to processing based on legitimate interest (Art. 21), and to withdraw consent at any time (Art. 7(3)).

To exercise any of these, email <<SET_CONTACT_EMAIL>>. We will confirm and act within one month, and usually far sooner.

You may also complain to a supervisory authority. The one responsible for us is <<SET_SUPERVISORY_AUTHORITY>>.

We rely on the processors below.

Each acts under a data processing agreement, or, where they act as a controller in their own right, under their own privacy notice.

None. Your brief is generated content, not a decision about you. Nothing here produces a legal effect on you or similarly significantly affects you within the meaning of Art. 22 GDPR.

This is version 1.0, effective <<SET_EFFECTIVE_DATE>>. If we make material changes we will tell registered users by email before they take effect.