Privacy Policy

1. Data Protection at a Glance

General Information

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.

2. Controller

Mark Heinsohn
Osterdeich 34
28203 Bremen
Email: privacy@smartwebchat.eu

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

3. Data Collection on This Website

Server Log Files

The web server does not keep an access log covering all pages of this website. Only requests to the addresses aimed at automated services are logged (robots.txt, sitemap.xml, llms.txt, the addresses under /.well-known/, the interface description and the interface at /api/mcp). No access log is kept for any other page, and in particular not for use of the AI assistant. What is recorded is:

• the address requested and the response status
• the time of the request
• the program identifier sent by the client (user agent) — it usually indicates which program and which operating system is being used
• the referring address (referrer), where the client sends one
• a truncated IP address: for IPv4 without the final address byte, for IPv6 without the final 96 bits. The full address is not stored

Authorisation and session data (Authorization and Cookie headers) are redacted before being written. This data is not merged with other data sources. The logs are held in a ring buffer of at most 30 MB per service and are continuously overwritten from it, usually after 6 days; an extract created with each software release is deleted automatically after 30 days at the latest. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure operation of the website and in being able to trace automated access.

AI assistant on this website

When you use our AI assistant, we process your input in order to reply to you. Your messages are transmitted to our processor Mistral AI SAS, France, to search the assistant's knowledge base, regardless of the model selected for the assistant. To generate the reply, your messages and the assistant's replies are sent, depending on that model, to Mistral AI SAS or to OpenAI Ireland Ltd., Dublin, Ireland; with OpenAI, they are processed in the USA. The basis for the transfer to the USA is set out below under “Processors and Third-Party Providers” for OpenAI Ireland Ltd. During the conversation we keep the conversation in a temporary store that does not write to disk. It is deleted 30 minutes after your last message, and no later than 2 hours after your first message. The chat window also stores a session identifier and the conversation so far on your device, so that your conversation survives a page change. If you later open a page of this website with the chat window and your last message was more than 30 minutes ago, it deletes both; without such a visit, the data remains in your browser until you delete it there. As long as you have not written a message, the chat window deletes nothing: the session identifier, the greeting and your answer to the question about the analysis then remain in your browser until you delete them there. Once you write a message, they are deleted as described above. The chat window creates the session identifier as soon as the page is opened, even if you do not open the chat window. This data leaves your device only as part of your requests to us, with one exception: if a notice above the chat button has been set up for a page, the chat window also sends the session identifier to us without any action on your part as soon as the condition for that notice is met (see below, “Notice above the chat button”). Once the conversation has ended, we analyse it in order to improve our advice and our product. We keep two things: first, counts, such as which objections came up and which next step was suggested, without a session identifier, without free text and without any time information; second, the wording of the conversation, from which we first remove e-mail addresses, phone numbers, links and automatically recognised names of persons and companies, and which we store without a session identifier and without date or time. Some of the counts, such as whether an objection was resolved or how many product questions remained open, are determined from this wording by a language model. We delete this wording after 30 days at the latest. The automatic removal may miss individual details. We keep the counts permanently. For the analysis, we transmit this cleaned-up wording to our processor OpenAI Ireland Ltd., Dublin, Ireland; it is processed in the USA. An OpenAI language model reads it, determines that part of the counts and summarises recurring patterns for a regular report to us. We do not transmit your session identifier or any other identifier. The basis for the transfer to the USA is set out below under “Processors and Third-Party Providers” for OpenAI Ireland Ltd. Changes to our assistant are decided by people; the assistant does not learn from the conversations on its own. If you click “Sign up for free” in the chat, the link contains an identifier that is calculated from your session identifier. We use it to record that the link was clicked and whether a trial was then started. For this we store only this identifier and the type of event, without date or time, without your e-mail address and without your account, and we delete these entries after 30 days at the latest. These entries are not linked to the stored wording or to the counts. If you answer “No” to the question about the analysis in the chat, or withdraw your “Yes”, the link does not contain this identifier. To prevent misuse, we log certain check results together with the session identifier; we delete these entries after 30 days. The legal basis for replying is Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in answering enquiries); for the analysis, including the transfer to OpenAI, and for the measurement it is Art. 6(1)(f) GDPR, our legitimate interest being to improve our advice and to see whether it leads to trials. You may object to this processing at any time under Art. 21 GDPR: before the conversation ends by choosing “No” or “Withdraw” in the chat, otherwise informally to privacy@smartwebchat.eu. As the stored wording carries no session identifier, we cannot attribute it to you via an identifier once the conversation has ended; attribution via the content remains possible, for example via details that the automatic removal did not cover or missed.

Notice above the chat button

For individual pages or for all pages, we can set up the chat window to display a short notice above the chat button on its own initiative, for example after you have spent a certain amount of time on the page. When a page is opened, the chat window asks us whether such a notice has been set up for that page; it sends the path of the page, but not your session identifier. When the condition for the notice is met, the chat window sends your session identifier and the path of the page to us without you clicking anything. We use this to check whether the notice has already been triggered for this session identifier within a set period; if so, it is not shown again. Otherwise, we store an entry with your session identifier, the time and the notice concerned, and the chat window displays the notice; if you click it to open the chat, we record in this entry that you did so and when. We do not store the path of the page. We delete these entries after 30 days. We use them so as not to show the notice too often and to count how often it was triggered and how often it was clicked. We do not combine them with the stored wording, the counts from the analysis of the conversations or the entries of the trial measurement. If you close the notice using the “×”, the chat window does not display any such notice in this browser for 24 hours and does not ask for one during that time (see section 9). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to offer visitors our help at the right point without disturbing them repeatedly. You may object to this processing at any time under Art. 21 GDPR by sending an informal message to privacy@smartwebchat.eu.

Newsletter

If you subscribe to our newsletter, we process the email address you provide. Subscription follows the double opt-in procedure: after you sign up, you receive an email containing a confirmation link; your subscription only becomes effective once you click that link. To document your consent, we store the time of sign-up and the part of our website through which you signed up (for example the footer or the newsletter page), together with your IP address, which we store exclusively as a hash value (no plain-text storage). We also store the language in which you signed up, solely for the purpose of sending you the newsletter in that language. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time — via the unsubscribe link at the end of every newsletter email or the "List-Unsubscribe" function of your email program; your consent is thereby considered revoked for the future. Newsletters are sent via Brevo (see "Processors and Third-Party Providers"); your email address is not passed on to third parties for advertising purposes.

Processors and Third-Party Providers

We use the following third-party providers:

• Mistral AI SAS (Paris, France) — AI-powered text generation for chatbot responses as well as the creation of text embeddings for the knowledge base. This is the default setting. The chat input of website visitors and the content of uploaded knowledge sources are processed. Processing takes place on servers within the EU; no transfer to a third country occurs. The legal basis for processing by Mistral AI on our behalf is Art. 6(1)(b) GDPR. Mistral AI additionally stores inputs and outputs for up to 30 days under its own responsibility in order to detect misuse of its services; they are then deleted.
• OpenAI Ireland Ltd. (Dublin, Ireland) — in two cases: first, optional, only if a premium model from OpenAI (e.g., GPT-4o) has been selected for the respective assistant; the chat input of website visitors is then processed, legal basis: Art. 6(1)(b) GDPR. Second, for the analysis of conversations with the AI assistant on this website (see above, “AI assistant on this website”); the cleaned-up wording of these conversations is processed, legal basis: Art. 6(1)(f) GDPR. The recipient is the Irish company; the transfer to it takes place within the European Economic Area. Where OpenAI Ireland Ltd. passes the data on to companies of the OpenAI group or to third parties outside the European Economic Area in order to provide the service, it has undertaken towards us by contract to base that transfer on appropriate safeguards under Art. 46 GDPR or on an adequacy decision of the European Commission under Art. 45 GDPR; we disclose the basis applicable in the individual case on request. The data is not used to train AI models.
• Digistore24 GmbH (Hildesheim, Germany) — payment and order processing for subscriptions (reseller / merchant of record). The data processed includes payment data (e.g., credit card, SEPA, PayPal), email address, and billing address. To pre-fill the order form we transmit your email address, first and last name, company name, country, your postal address (street, ZIP code, city) and — for orders from another EU country — the VAT identification number, if you have provided one, as well as an internal account number that we use to match your payment to your account. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). The technical infrastructure is provided by Digital Assets AG (Rotkreuz, Switzerland) (covered by an EU adequacy decision). Privacy policy: digistore24.com/page/privacy
• Brevo GmbH (Köpenicker Str. 126, 10179 Berlin, Germany) — sending of newsletter emails (sign-up confirmation and newsletter), of the request for a review and of four onboarding emails (welcome, installation, results, handover). We send all other emails from our own mailbox at Hetzner Online GmbH (see below). Email addresses and email content are processed. Our Brevo account is set to delete the sending logs (recipient address, subject, time and delivery status) after one month. Our Brevo account is set so that opens of these emails and clicks in them are not attributed to individual recipients. Legal basis: Art. 6(1)(b) GDPR (transactional) or Art. 6(1)(a) GDPR (newsletter and review request, consent in each case); for the four onboarding emails, section 4 (“Emails with tips and offers”) applies. According to its own statements, Brevo processes data on servers within the EU (France, Germany, Belgium). Any sub-processors are listed in Brevo's data protection documentation. Privacy policy: brevo.com/de/legal/privacypolicy
• Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) — sending of all other emails from our own mailbox: registration and account, password, email address change, invitation, deletion confirmation, notifications about enquiries, handovers and credit, trial period reminders, contact form, support and operational alerts. If our hourly sending quota is exhausted, these emails wait in a queue on our own server (Redis database) until they can be sent; there is no fixed maximum duration for this. For account and security emails (such as password or confirmation emails), the queue only holds which email it is and which transaction it relates to, and for the confirmation of an account deletion or an email address change also the email addresses concerned; text and link are generated only when it is sent. Once an email has been sent or has finally failed, it is deleted from the queue; its content may remain in Redis's storage files (append-only file and snapshot) until these are rewritten. Email addresses and email content are processed. Legal basis: Art. 6(1)(b) GDPR; for the trial period reminders, section 4 (“Emails with tips and offers”) applies, for the contact form section 5.

Which AI provider generates an assistant's replies depends on the model selected for it. Mistral (processing in the EU) is always the default; OpenAI only generates replies when a corresponding premium model is actively selected. In addition, we analyse the conversations with the AI assistant on this website with OpenAI (see above).

Data processing agreements (DPAs) pursuant to Art. 28 GDPR have been concluded with the providers acting as processors. Digistore24 GmbH is not a processor but an independent controller for payment and order processing. We base the transfer of your data to it on Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures).

4. Customer Account and Company Details

When you create a customer account, we process the data you provide in order to conclude and perform the user agreement with you, including the agreement on data processing (Annex 1 to the Terms of Use, Art. 28 GDPR).

What data we process

• Access data: email address and password. We store the password exclusively as a cryptographic hash — we do not know it in plain text. Legal basis: Article 6(1)(b) GDPR (performance of a contract).
• Person: first and last name of the individual acting for the company. This identifies the contracting party. When you purchase a paid plan, we transmit the first and last name to Digistore24 GmbH so that the order form is pre-filled (see section 3). Legal basis: Art. 6(1)(b) GDPR.
• Company details: company name, legal form, address, country and telephone number; the VAT identification number if you provide one. These details identify the controller within the meaning of Article 28 GDPR and appear on invoices. Legal basis: Article 6(1)(b) GDPR, and for tax retention additionally Article 6(1)(c) GDPR.
• Record of consent: the time and version of the documents you agreed to, together with a salted, non-reversible checksum of your IP address. We do not store the IP address itself. The record serves the accountability obligation under Article 5(2) GDPR. This also includes which version of the notice on emails with tips and offers was shown at your registration and in which language, and — if you consented or objected — the time, version and language of your consent or the time of your objection. Legal basis: Article 6(1)(c) GDPR.
• Language setting: the language you selected, so that the interface and emails appear in that language. Legal basis: Article 6(1)(b) GDPR.
• Origin of the sign-up: campaign parameters from the address you used (UTM), the referring website and the first page you visited. These details serve us alone — evaluating how prospective customers find us — and are not necessary for the contract. Legal basis: Article 6(1)(f) GDPR (legitimate interest in measuring the success of our own advertising). You may object to this processing at any time under Article 21 GDPR; we will then delete the details.

Emails with tips and offers

If you consented during registration, we send you tips and offers by email (Art. 6(1)(a) GDPR); for this purpose we store the time of your consent. Without consent, we send you, as a customer, information and offers about our own similar services on the basis of our legitimate interest in direct marketing (Art. 6(1)(f) GDPR, Section 7(3) of the German Act against Unfair Competition (UWG)). You can end your consent and these emails at any time via the unsubscribe link or by email to privacy@smartwebchat.eu.

Which details are required

Required for concluding the contract are email address, password, first and last name, company name, legal form, address, country and telephone number. Without these details we cannot conclude the user agreement and the data processing agreement, and cannot activate the account. The VAT identification number is optional; not providing it has no disadvantages.

How long we store the data

We store account and company details for the duration of the contractual relationship. This also applies to accounts without a paid subscription, for example after the trial has ended: they remain in place until you delete the account or the contractual relationship ends. After it ends we delete them unless statutory retention obligations apply: we retain order and payment records (such as the notifications from Digistore24 about purchases, payments and refunds) as accounting vouchers for eight years, books and records for ten years and business letters for six years (Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code), in each case counted from the end of the calendar year in which they were created; the period is extended for as long as the documents are relevant to a tax whose assessment period has not yet expired. The record of consent is retained for as long as it is required for accountability. Origin details are deleted at the latest together with the account.

If we lift a block on a website address for an account or reinstate it, we log the time, the action, the address and account concerned and the person acting. We delete these entries 180 days after the lifting ends. The purpose is traceability and protection against misuse; the legal basis is Art. 6(1)(f) GDPR.

Interface and mandates. If you create an API key, we store its name, its first characters, a hash value (not the key itself) and the time of its last use until you delete the key. If you grant a mandate to a third party’s program or AI assistant, we store the name of the program, the permitted areas, the term and any revocation. We log each access made under a mandate (time, type of access, result; no content) in order to show you the overview in the dashboard and to detect misuse; we delete the log after 90 days, and immediately together with your account. The legal basis is Art. 6(1)(b) GDPR, and for the log Art. 6(1)(f) GDPR. Which data the provider of the program receives and how it processes them is governed by that provider’s terms.

Notifications in the dashboard. If you allow notifications in your browser, we store the recipient address generated by the browser and the associated keys until you switch off notifications or delete your account; we remove addresses that have become invalid automatically. A notification contains only a general notice (such as “New request”) and a link to the dashboard, no names and no conversation content. It is delivered in encrypted form via your browser manufacturer’s notification service (depending on the browser Google, Apple, Microsoft or Mozilla, some based outside the EU); that service receives the recipient address, the time and the encrypted message. We have no contract of our own with these services; your browser determines which service delivers the notification. According to their own privacy notices, Google and Microsoft rely on the EU-U.S. Data Privacy Framework and on standard contractual clauses for transfers to the USA, and Apple and Mozilla on standard contractual clauses. The legal basis is Art. 6(1)(b) GDPR.

Your rights to information, rectification, erasure, restriction, data portability and objection are described in Section 7. You can request a complete export of your account and company details at any time in your account settings.

5. Contacting Us

If you contact us by email, we store the information you provide, including the contact details you supply, in order to process your inquiry and in case of follow-up questions. We do not pass on this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR, provided your inquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases it is based on Art. 6(1)(f) GDPR; our legitimate interest lies in answering the inquiry addressed to us.

Via the contact form on our website we process your name, your email address, the subject you selected, your message and — if provided — your company. Providing this information is voluntary; without a name, an email address and a message we cannot answer the inquiry. Your inquiry is transmitted to us solely by email. It is sent from our own email mailbox at Hetzner Online GmbH (see section 3). You will additionally receive an acknowledgement of receipt at the address you provided. If our hourly sending quota is exhausted, both emails wait in a queue on our own server (Redis database) until they can be sent. There is no fixed maximum duration for this. Once an email has been sent or has finally failed, it is deleted from the queue; its content may remain in Redis's storage files (append-only file and snapshot) until these are rewritten.

We delete inquiries from the contact form no later than six months after the matter has been concluded, provided that no contract comes about and no statutory retention periods apply. To protect against automated misuse we limit the number of submissions per internet connection; your IP address is held in volatile form for a maximum of ten minutes for this purpose and is not combined with your inquiry. The legal basis is Art. 6(1)(f) GDPR.

6. Hosting

The processor is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server location is a German data center (Falkenstein or Nuremberg); in addition, a Hetzner Online GmbH data center in Finland (Helsinki) may be used. Details can be found in Hetzner's privacy policy: https://www.hetzner.com/legal/privacy-policy.

The use of Hetzner is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the reliable presentation of our website. A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with Hetzner. Regular processing and storage take place in a German data centre and, where applicable, in a data centre in Finland (Helsinki); when server snapshots are used, replication within the provider's EU network zone (Germany, Finland) is possible. No processing takes place outside the European Union.

To detect technical errors, we use self-hosted monitoring software (GlitchTip), which runs on the same Hetzner infrastructure. No data is transferred to third parties. Personal data contained in error reports is largely removed automatically before storage. Error reports are deleted automatically after 30 days. In addition, we use the self-hosted software Umami for cookie-free traffic analysis (see section 8). Legal basis: Art. 6(1)(f) GDPR.

7. Your Rights

You have the right, at any time, to:

• Information about your stored personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of a consent you have given, with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected

To exercise these rights, an informal message to privacy@smartwebchat.eu is sufficient. If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of Bremen (Der Landesbeauftragte für Datenschutz und Informationsfreiheit), Georgstraße 122–124, 27570 Bremerhaven, office@datenschutz.bremen.de.

Your right to object under Art. 21 GDPR

Where we process your data on the basis of legitimate interests under Art. 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation. This concerns the logging of automated access (section 3), the origin details of your sign-up (section 4), the abuse limit on the contact form (section 5), the operation of the website including error detection (section 6) and traffic analysis (section 8). If you object, we will no longer process your data in that respect unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. You may object to the use of your email address for direct marketing (section 4) at any time without giving reasons; we will then no longer use it for this purpose. An informal message to privacy@smartwebchat.eu is sufficient; no particular format is required.

No automated decision-making

We do not take decisions based solely on automated processing within the meaning of Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you. The AI assistant generates reply texts. The analysis of conversations (section 3) serves to improve our advice and product and to see whether the advice leads to trials; it does not lead to any decision about you.

8. Traffic Analysis (Umami)

For the statistical evaluation of the use of this website, we use the self-hosted analytics software Umami. Umami runs exclusively on our own server infrastructure (Hetzner, Germany or Finland); no data is transmitted to third parties. Measurement is cookie-free — no cookies are set and no information is stored on or read from your device. Your IP address is processed only briefly for aggregation purposes and is not stored permanently; no personal usage profiles are created. The legal basis is our legitimate interest in data-sparing traffic analysis (Art. 6(1)(f) GDPR). You can object to this measurement in your browser at any time by activating the "Do Not Track" setting; the analytics script respects it.

9. Cookies and storage access

This website does not use tracking cookies or third-party analytics tools. Only technically necessary cookies required for the operation of the website are used, in particular the dashboard login session. In addition, the chat window stores six items in your browser: a session identifier and the conversation so far, so that your conversation survives a page change (see section 3); the time of your last message, so that the chat window deletes the session identifier and the conversation on your next visit if more than 30 minutes have passed since then; your answer to the question in the chat window whether we may analyse the conversation, together with the session identifier, so that it still applies after a page change — it is deleted together with the session identifier and the conversation; the point in time at which you dismissed a notice from the chat window, so that it is not shown to you again for 24 hours; and the fact that your conversation has been handed over to a human, so that the chat continues in handover mode after a page change. These six forms of access to your device are strictly necessary in order to provide the service you have expressly requested and are therefore exempt from consent under Section 25(2) no. 2 TDDDG. The traffic analysis described in section 8 is self-hosted and cookie-free; it stores nothing on your device and reads nothing from it.