Privacy Policy

1. Data Protection at a Glance

General Information

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.

2. Controller

Mark Heinsohn
Osterdeich 34
28203 Bremen
Email: mheinsohn@smartwebchat.eu

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

3. Data Collection on This Website

Server Log Files

The provider of this website automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing device
• Time of the server request
• IP address

This data is not merged with other data sources. This data is collected on the basis of Art. 6(1)(f) GDPR.

Chatbot Use

When you use the AI assistant on this website, we process your input in order to generate a reply. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Your messages and the assistant's replies are transmitted to our processor Mistral AI SAS, France, in order to generate the reply. We store the conversation for 30 days and delete it automatically thereafter. The chat window also stores a session identifier and the conversation so far on your device, so that your conversation survives a page change. This data leaves your device only as part of your requests to us. You may object to this processing at any time and request deletion of your conversation. An informal message to privacy@smartwebchat.eu is sufficient.

Newsletter

If you subscribe to our newsletter, we process the email address you provide. Subscription follows the double opt-in procedure: after you sign up, you receive an email containing a confirmation link; your subscription only becomes effective once you click that link. To document your consent, we store the time of sign-up and the part of our website through which you signed up (for example the footer or the newsletter page), together with your IP address, which we store exclusively as a hash value (no plain-text storage). We also store the language in which you signed up, solely for the purpose of sending you the newsletter in that language. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time — via the unsubscribe link at the end of every newsletter email or the "List-Unsubscribe" function of your email program; your consent is thereby considered revoked for the future. Newsletters are sent via Brevo (see "Processors and Third-Party Providers"); your email address is not passed on to third parties for advertising purposes.

Processors and Third-Party Providers

We use the following third-party providers:

• Mistral AI SAS (Paris, France) — AI-powered text generation for chatbot responses as well as the creation of text embeddings for the knowledge base. This is the default setting. The chat input of website visitors and the content of uploaded knowledge sources are processed. Processing takes place on servers within the EU; no transfer to a third country occurs. Legal basis: Art. 6(1)(b) GDPR.
• OpenAI, Inc. (USA) — optional, only if a premium model from OpenAI (e.g., GPT-4o) has been selected for the respective assistant. The chat input of website visitors is processed. Legal basis: Art. 6(1)(b) GDPR. Processing takes place in the USA; the transfer is safeguarded by EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and additionally by the EU-US Data Privacy Framework. The data is not used to train AI models.
• Anthropic PBC (USA) — optional, only if a premium model from Anthropic (Claude) has been selected for the respective assistant. The chat input of website visitors is processed. Legal basis: Art. 6(1)(b) GDPR. Processing takes place in the USA; the transfer is safeguarded by EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The data is not used to train AI models.
• Digistore24 GmbH (Hanover, Germany) — payment and order processing for subscriptions (reseller / merchant of record). The data processed includes payment data (e.g., credit card, SEPA, PayPal), email address, and billing address. To pre-fill the order form we additionally transmit first and last name, company name, country and — for orders from another EU country — the VAT identification number, if you have provided one. We do not transmit your postal address or telephone number. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). The technical infrastructure is provided by Digital Assets AG (Rotkreuz, Switzerland) (covered by an EU adequacy decision). Privacy policy: digistore24.com/page/privacy
• Brevo GmbH (Köpenicker Str. 126, 10179 Berlin, Germany) — sending of transactional and informational emails (registration confirmation, lead notifications, onboarding, system, and newsletter emails). Email addresses and email content are processed. Legal basis: Art. 6(1)(b) GDPR (transactional) or Art. 6(1)(a) GDPR (newsletter, consent). According to its own statements, Brevo processes data on servers within the EU (France, Germany, Belgium). Any sub-processors are listed in Brevo's data protection documentation. Privacy policy: brevo.com/de/legal/privacypolicy

Which AI provider is used in a given case depends on the model selected for the respective assistant. Mistral (processing in the EU) is always the default; OpenAI and Anthropic are only used when a corresponding premium model is actively selected.

Data processing agreements (DPAs) pursuant to Art. 28 GDPR have been concluded with the providers acting as processors. Digistore24 GmbH acts as an independent controller in the context of payment and order processing; the legal basis for the data transfer is Art. 6(1)(b) GDPR (performance of a contract).

4. Customer Account and Company Details

When you create a customer account, we process the data you provide in order to perform the user agreement and to conclude the data processing agreement with you under Article 28 GDPR.

What data we process

• Access data: email address and password. We store the password exclusively as a cryptographic hash (bcrypt) — we do not know it in plain text. Legal basis: Article 6(1)(b) GDPR (performance of a contract).
• Person: first and last name of the individual acting for the company. This identifies the contracting party. When you purchase a paid plan, we transmit the first and last name to Digistore24 GmbH so that the order form is pre-filled (see section 3). Legal basis: Art. 6(1)(b) GDPR.
• Company details: company name, legal form, address, country and telephone number; the VAT identification number if you provide one. These details identify the controller within the meaning of Article 28 GDPR and appear on invoices. Legal basis: Article 6(1)(b) GDPR, and for tax retention additionally Article 6(1)(c) GDPR.
• Record of consent: the time and version of the documents you agreed to, together with a salted, non-reversible checksum of your IP address. We do not store the IP address itself. The record serves the accountability obligation under Article 5(2) GDPR. Legal basis: Article 6(1)(c) GDPR.
• Language setting: the language you selected, so that the interface and emails appear in that language. Legal basis: Article 6(1)(b) GDPR.
• Origin of the sign-up: campaign parameters from the address you used (UTM), the referring website and the first page you visited. These details serve us alone — evaluating how prospective customers find us — and are not necessary for the contract. Legal basis: Article 6(1)(f) GDPR (legitimate interest in measuring the success of our own advertising). You may object to this processing at any time under Article 21 GDPR; we will then delete the details.

Which details are required

Required for concluding the contract are email address, password, first and last name, company name, legal form, address, country and telephone number. Without these details we cannot conclude the user agreement and the data processing agreement, and cannot activate the account. The VAT identification number is optional; not providing it has no disadvantages.

How long we store the data

We store account and company details for the duration of the contractual relationship. After it ends we delete them unless statutory retention obligations apply: we retain invoicing and accounting data for up to ten years under Section 147 of the German Fiscal Code and Section 257 of the German Commercial Code. The record of consent is retained for as long as it is required for accountability. Origin details are deleted at the latest together with the account.

Your rights to information, rectification, erasure, restriction, data portability and objection are described in Section 7. You can request a complete export of your account and company details at any time in your account settings.

5. Contacting Us

If you contact us by email, we store the information you provide, including the contact details you supply, in order to process your inquiry and in case of follow-up questions. We do not pass on this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR, provided your inquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases it is based on Art. 6(1)(f) GDPR; our legitimate interest lies in answering the inquiry addressed to us.

Via the contact form on our website we process your name, your email address, the subject you selected, your message and — if provided — your company. Providing this information is voluntary; without a name, an email address and a message we cannot answer the inquiry. Your inquiry is transmitted to us solely by email and is not stored in a database in the process. We use Brevo GmbH as a processor for sending it (see section 3). You will additionally receive an acknowledgement of receipt at the address you provided.

We delete inquiries from the contact form no later than six months after the matter has been concluded, provided that no contract comes about and no statutory retention periods apply. To protect against automated misuse we limit the number of submissions per internet connection; your IP address is held in volatile form for a maximum of ten minutes for this purpose and is not combined with your inquiry. The legal basis is Art. 6(1)(f) GDPR.

6. Hosting

The processor is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server location is a German data center (Falkenstein or Nuremberg). Details can be found in Hetzner's privacy policy: https://www.hetzner.com/legal/privacy-policy.

The use of Hetzner is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the reliable presentation of our website. A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with Hetzner. All data is processed and stored on servers in Germany. When server snapshots are used, replication within the EU network zone (Germany, Finland) is possible.

To detect technical errors, we use self-hosted monitoring software (GlitchTip), which runs on the same Hetzner infrastructure. No data is transferred to third parties. Personal data contained in error reports is largely removed automatically before storage. Error reports are deleted automatically after 30 days. In addition, we use the self-hosted software Umami for cookie-free traffic analysis (see item 8). Legal basis: Art. 6(1)(f) GDPR.

7. Your Rights

You have the right, at any time, to:

• Information about your stored personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)

To exercise these rights, an informal message to privacy@smartwebchat.eu is sufficient. If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with a supervisory authority.

8. Traffic Analysis (Umami)

For the statistical evaluation of the use of this website, we use the self-hosted analytics software Umami. Umami runs exclusively on our own server infrastructure (Hetzner, Germany); no data is transmitted to third parties. Measurement is cookie-free — no cookies are set and no information is stored on or read from your device. Your IP address is processed only briefly for aggregation purposes and is not stored permanently; no personal usage profiles are created. The legal basis is our legitimate interest in data-sparing traffic analysis (Art. 6(1)(f) GDPR). You can object to this measurement at any time by activating the "Do Not Track" setting in your browser — this setting is respected.

9. Cookies

This website does not use tracking cookies or third-party analytics tools. Only technically necessary cookies required for the operation of the website are used (e.g., the login session). The traffic analysis described in item 8 is self-hosted and cookie-free.