Privacy Policy

1. Data Protection at a Glance

General Information

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.

2. Controller

Mark Heinsohn
Osterdeich 34
28203 Bremen
Email: privacy@smartwebchat.eu

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

3. Data Collection on This Website

Server Log Files

The web server does not keep an access log covering all pages of this website. Only requests to the addresses aimed at automated services are logged (robots.txt, sitemap.xml, llms.txt, the addresses under /.well-known/, the interface description and the interface at /api/mcp). No access log is kept for any other page, and in particular not for use of the AI assistant. What is recorded is:

• the program identifier sent by the client (user agent) — it usually indicates which program and which operating system is being used
• the referring address (referrer), where the client sends one
• the time of the request
• a truncated IP address: for IPv4 without the final address byte, for IPv6 without the final 96 bits. The full address is not stored
• the address requested and the response status

Authorisation and session data (Authorization and Cookie headers) are redacted before being written. This data is not merged with other data sources. The logs are held in a size-limited ring buffer and are continuously overwritten from it; an extract created with each software release is deleted automatically after 30 days at the latest. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure operation of the website and in being able to trace automated access.

Chatbot Use

When you use the AI assistant on this website, we process your input in order to generate a reply. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Your messages are transmitted to our processor Mistral AI SAS, France, to search the assistant's knowledge base, regardless of the model selected for the assistant. To generate the reply, your messages and the assistant's replies are sent, depending on that model, to Mistral AI SAS or to OpenAI Ireland Ltd., Dublin, Ireland; with OpenAI, they are processed in the USA. The basis for the transfer to the USA is set out below under “Processors and Third-Party Providers” for OpenAI Ireland Ltd. During the conversation we keep the conversation in a temporary store that does not write to disk. It is deleted 30 minutes after your last message, and no later than 2 hours after your first message. The chat window also stores a session identifier and the conversation so far on your device, so that your conversation survives a page change. This data leaves your device only as part of your requests to us. To prevent misuse, we log certain check results together with the session identifier, including a shortened checksum of individual messages; we delete these entries after 30 days. You may object to this processing at any time and request deletion of your conversation. An informal message to privacy@smartwebchat.eu is sufficient.

Newsletter

If you subscribe to our newsletter, we process the email address you provide. Subscription follows the double opt-in procedure: after you sign up, you receive an email containing a confirmation link; your subscription only becomes effective once you click that link. To document your consent, we store the time of sign-up and the part of our website through which you signed up (for example the footer or the newsletter page), together with your IP address, which we store exclusively as a hash value (no plain-text storage). We also store the language in which you signed up, solely for the purpose of sending you the newsletter in that language. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time — via the unsubscribe link at the end of every newsletter email or the "List-Unsubscribe" function of your email program; your consent is thereby considered revoked for the future. Newsletters are sent via Brevo (see "Processors and Third-Party Providers"); your email address is not passed on to third parties for advertising purposes.

Processors and Third-Party Providers

We use the following third-party providers:

• Mistral AI SAS (Paris, France) — AI-powered text generation for chatbot responses as well as the creation of text embeddings for the knowledge base. This is the default setting. The chat input of website visitors and the content of uploaded knowledge sources are processed. Processing takes place on servers within the EU; no transfer to a third country occurs. Mistral AI additionally stores inputs and outputs for up to 30 days under its own responsibility in order to detect misuse of its services; they are then deleted. Legal basis: Art. 6(1)(b) GDPR.
• OpenAI Ireland Ltd. (Dublin, Ireland) — optional, only if a premium model from OpenAI (e.g., GPT-4o) has been selected for the respective assistant. The chat input of website visitors is processed. Legal basis: Art. 6(1)(b) GDPR. The recipient is the Irish company; the transfer to it takes place within the European Economic Area. Where OpenAI Ireland Ltd. passes the data on to companies of the OpenAI group or to third parties outside the European Economic Area in order to provide the service, it has undertaken towards us by contract to base that transfer on appropriate safeguards under Art. 46 GDPR or on an adequacy decision of the European Commission under Art. 45 GDPR; we disclose the basis applicable in the individual case on request. The data is not used to train AI models.
• Digistore24 GmbH (Hanover, Germany) — payment and order processing for subscriptions (reseller / merchant of record). The data processed includes payment data (e.g., credit card, SEPA, PayPal), email address, and billing address. To pre-fill the order form we additionally transmit first and last name, company name, country and — for orders from another EU country — the VAT identification number, if you have provided one. We also transmit your postal address (street, ZIP code, city) and telephone number from your company details. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). The technical infrastructure is provided by Digital Assets AG (Rotkreuz, Switzerland) (covered by an EU adequacy decision). Privacy policy: digistore24.com/page/privacy
• Brevo GmbH (Köpenicker Str. 126, 10179 Berlin, Germany) — sending of newsletter emails (sign-up confirmation and newsletter), of the request for a review and of four onboarding emails (welcome, installation, results, handover). We send all other emails from our own mailbox at Hetzner Online GmbH (see below). Email addresses and email content are processed. Legal basis: Art. 6(1)(b) GDPR (transactional) or Art. 6(1)(a) GDPR (newsletter, consent). According to its own statements, Brevo processes data on servers within the EU (France, Germany, Belgium). Any sub-processors are listed in Brevo's data protection documentation. Privacy policy: brevo.com/de/legal/privacypolicy
• Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) — sending of all other emails from our own mailbox: registration and account, password, email address change, invitation, deletion confirmation, notifications about enquiries, handovers and credit, trial period reminders, contact form, support and operational alerts. If our hourly sending quota is exhausted, these emails wait in a queue on our own server (Redis database) until they can be sent; there is no fixed maximum duration for this. For account and security emails (such as password or confirmation emails), the queue only holds which email it is and which transaction it relates to, and for the confirmation of an account deletion or an email address change also the email addresses concerned; text and link are generated only when it is sent. Once an email has been sent or has finally failed, it is deleted from the queue; its content may remain in Redis's storage files (append-only file and snapshot) until these are rewritten. Email addresses and email content are processed. Legal basis: Art. 6(1)(b) GDPR; for the contact form, section 5 applies.

Which AI provider generates an assistant's replies depends on the model selected for it. Mistral (processing in the EU) is always the default; OpenAI only generates replies when a corresponding premium model is actively selected.

Data processing agreements (DPAs) pursuant to Art. 28 GDPR have been concluded with the providers acting as processors. Digistore24 GmbH acts as an independent controller in the context of payment and order processing; the legal basis for the data transfer is Art. 6(1)(b) GDPR (performance of a contract).

4. Customer Account and Company Details

When you create a customer account, we process the data you provide in order to perform the user agreement and to conclude the data processing agreement with you under Article 28 GDPR.

What data we process

• Access data: email address and password. We store the password exclusively as a cryptographic hash (bcrypt) — we do not know it in plain text. Legal basis: Article 6(1)(b) GDPR (performance of a contract).
• Person: first and last name of the individual acting for the company. This identifies the contracting party. When you purchase a paid plan, we transmit the first and last name to Digistore24 GmbH so that the order form is pre-filled (see section 3). Legal basis: Art. 6(1)(b) GDPR.
• Company details: company name, legal form, address, country and telephone number; the VAT identification number if you provide one. These details identify the controller within the meaning of Article 28 GDPR and appear on invoices. Legal basis: Article 6(1)(b) GDPR, and for tax retention additionally Article 6(1)(c) GDPR.
• Record of consent: the time and version of the documents you agreed to, together with a salted, non-reversible checksum of your IP address. We do not store the IP address itself. The record serves the accountability obligation under Article 5(2) GDPR. Legal basis: Article 6(1)(c) GDPR.
• Language setting: the language you selected, so that the interface and emails appear in that language. Legal basis: Article 6(1)(b) GDPR.
• Origin of the sign-up: campaign parameters from the address you used (UTM), the referring website and the first page you visited. These details serve us alone — evaluating how prospective customers find us — and are not necessary for the contract. Legal basis: Article 6(1)(f) GDPR (legitimate interest in measuring the success of our own advertising). You may object to this processing at any time under Article 21 GDPR; we will then delete the details.

Which details are required

Required for concluding the contract are email address, password, first and last name, company name, legal form, address, country and telephone number. Without these details we cannot conclude the user agreement and the data processing agreement, and cannot activate the account. The VAT identification number is optional; not providing it has no disadvantages.

How long we store the data

We store account and company details for the duration of the contractual relationship. After it ends we delete them unless statutory retention obligations apply: we retain invoicing and accounting data for up to ten years under Section 147 of the German Fiscal Code and Section 257 of the German Commercial Code. The record of consent is retained for as long as it is required for accountability. Origin details are deleted at the latest together with the account.

If we lift a block on a website address for an account or reinstate it, we log the time, the action, the address and account concerned and the person acting. We delete these entries 180 days after the lifting ends. The purpose is traceability and protection against misuse; the legal basis is Art. 6(1)(f) GDPR.

Interface and mandates. If you create an API key, we store its name, its first characters, a hash value (not the key itself) and the time of its last use until you delete the key. If you grant a mandate to a third party’s program or AI assistant, we store the name of the program, the permitted areas, the term and any revocation. We log each access made under a mandate (time, type of access, result; no content) in order to show you the overview in the dashboard and to detect misuse; we delete the log after 90 days, and immediately together with your account. The legal basis is Art. 6(1)(b) GDPR, and for the log Art. 6(1)(f) GDPR. Which data the provider of the program receives and how it processes them is governed by that provider’s terms.

Notifications in the dashboard. If you allow notifications in your browser, we store the recipient address generated by the browser and the associated keys until you switch off notifications or delete your account; we remove addresses that have become invalid automatically. A notification contains only a general notice (such as “New request”) and a link to the dashboard, no names and no conversation content. It is delivered in encrypted form via your browser manufacturer’s notification service (depending on the browser Google, Apple, Microsoft or Mozilla, some based outside the EU); that service receives the recipient address, the time and the encrypted message. The legal basis is Art. 6(1)(b) GDPR.

Your rights to information, rectification, erasure, restriction, data portability and objection are described in Section 7. You can request a complete export of your account and company details at any time in your account settings.

5. Contacting Us

If you contact us by email, we store the information you provide, including the contact details you supply, in order to process your inquiry and in case of follow-up questions. We do not pass on this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR, provided your inquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases it is based on Art. 6(1)(f) GDPR; our legitimate interest lies in answering the inquiry addressed to us.

Via the contact form on our website we process your name, your email address, the subject you selected, your message and — if provided — your company. Providing this information is voluntary; without a name, an email address and a message we cannot answer the inquiry. Your inquiry is transmitted to us solely by email. It is sent from our own email mailbox at Hetzner Online GmbH (see section 3). You will additionally receive an acknowledgement of receipt at the address you provided. If our hourly sending quota is exhausted, both emails wait in a queue on our own server (Redis database) until they can be sent. There is no fixed maximum duration for this. Once an email has been sent or has finally failed, it is deleted from the queue; its content may remain in Redis's storage files (append-only file and snapshot) until these are rewritten.

We delete inquiries from the contact form no later than six months after the matter has been concluded, provided that no contract comes about and no statutory retention periods apply. To protect against automated misuse we limit the number of submissions per internet connection; your IP address is held in volatile form for a maximum of ten minutes for this purpose and is not combined with your inquiry. The legal basis is Art. 6(1)(f) GDPR.

6. Hosting

The processor is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server location is a German data center (Falkenstein or Nuremberg); in addition, a Hetzner Online GmbH data center in Finland (Helsinki) may be used. Details can be found in Hetzner's privacy policy: https://www.hetzner.com/legal/privacy-policy.

The use of Hetzner is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the reliable presentation of our website. A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with Hetzner. Regular processing and storage take place in a German data centre and, where applicable, in a data centre in Finland (Helsinki); when server snapshots are used, replication within the provider's EU network zone (Germany, Finland) is possible. No processing takes place outside the European Union.

To detect technical errors, we use self-hosted monitoring software (GlitchTip), which runs on the same Hetzner infrastructure. No data is transferred to third parties. Personal data contained in error reports is largely removed automatically before storage. Error reports are deleted automatically after 30 days. In addition, we use the self-hosted software Umami for cookie-free traffic analysis (see section 8). Legal basis: Art. 6(1)(f) GDPR.

7. Your Rights

You have the right, at any time, to:

• Information about your stored personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of a consent you have given, with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected

To exercise these rights, an informal message to privacy@smartwebchat.eu is sufficient. If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with a supervisory authority.

No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The AI assistant generates reply texts; it does not take decisions that produce legal effects concerning you or similarly significantly affect you.

Your right to object under Art. 21 GDPR

Where we process your data on the basis of legitimate interests under Art. 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation. This concerns the logging of automated access (section 3), the origin details of your sign-up (section 4), the abuse limit on the contact form (section 5), the operation of the website including error detection (section 6) and traffic analysis (section 8). If you object, we will no longer process your data in that respect unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. An informal message to privacy@smartwebchat.eu is sufficient; no particular format is required.

8. Traffic Analysis (Umami)

For the statistical evaluation of the use of this website, we use the self-hosted analytics software Umami. Umami runs exclusively on our own server infrastructure (Hetzner, Germany or Finland); no data is transmitted to third parties. Measurement is cookie-free — no cookies are set and no information is stored on or read from your device. Your IP address is processed only briefly for aggregation purposes and is not stored permanently; no personal usage profiles are created. The legal basis is our legitimate interest in data-sparing traffic analysis (Art. 6(1)(f) GDPR). You can object to this measurement at any time by activating the "Do Not Track" setting in your browser — this setting is respected.

9. Cookies and storage access

This website does not use tracking cookies or third-party analytics tools. Only technically necessary cookies required for the operation of the website are used, in particular the dashboard login session. In addition, the chat window stores four items in your browser: a session identifier and the conversation so far, so that your conversation survives a page change (see section 3); the point in time at which you dismissed a notice from the chat window, so that it is not shown to you again for 24 hours; and the fact that your conversation has been handed over to a human, so that the chat continues in handover mode after a page change. These four forms of access to your device are strictly necessary in order to provide the service you have expressly requested and are therefore exempt from consent under Section 25(2) no. 2 TDDDG. The traffic analysis described in section 8 is self-hosted and cookie-free; it stores nothing on your device and reads nothing from it.