Privacy Policy
This privacy policy (Datenschutzerklärung) applies to the website and the Datenmassiv AI application at datenmassiv.ai.
1. Controller
Controller (Verantwortlicher) within the meaning of the General Data Protection Regulation (GDPR, German: Datenschutz-Grundverordnung, DSGVO):
DATENMASSIV GmbH
Zeitblomstraße 31/2
89073 Ulm
Email: datenschutz@datenmassiv.com
Phone: 0151 2066 9066
2. Data protection officer
The appointment of a data protection officer (Datenschutzbeauftragter) is currently not required by law. If you have any questions about data protection, please contact us at the contact address given above.
3. What data we collect
3.1 Account data
- Email address (for signing in via a sign-in link)
- First and last name (optional, for invitations)
- Organization membership
3.2 Usage data
- Chat histories with AI assistants
- Documents uploaded to knowledge bases
- Audio recordings for transcriptions
- Times and frequency of access
3.3 Technical data
- IP address (for security logging)
- Browser type and version (truncated)
- Operating system
3.4 Contact and access requests
If you contact us via the "Zugang anfragen" (request access) form or by email, we process the data you provide in order to handle your request and to get in touch with you:
- Name
- Business email address
- Company / organization and company size
- Your message (if provided)
The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract) or Art. 6(1)(f) GDPR (legitimate interest in handling requests). The notification from the form is sent via our email service provider in the EU region; the data is not stored in a separate database.
3.5 Billing data
For a paid subscription, we process the data required for billing and invoicing:
- Company name, billing address and email address for invoices
- VAT identification number, if provided
- Booked plan, number of seats, invoices and payment status
The customer enters payment method details such as card number or IBAN directly with the payment service provider Stripe. We do not store any payment method details; Stripe shows truncated details of the stored payment method in the customer portal.
4. Cookies and web analytics
4.1 Necessary cookies
We use technically necessary cookies that are required to operate the website (e.g. theme settings, session management). These cookies are set without consent because they are essential for the website to function.
4.2 Google Analytics 4
We use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GA4 uses cookies that enable an analysis of how the website is used.
- IP anonymization: GA4 anonymizes IP addresses by default. Your IP address is truncated within the EU/EEA before it is transmitted to Google servers.
- Google Consent Mode v2: We use Google Consent Mode v2. No analytics data is collected without your consent.
- No advertising features: Google Signals and ad personalization are deactivated.
- Legal basis: Art. 6(1)(a) GDPR (consent via the cookie banner).
4.3 Cookie consent
On your first visit to our website, a cookie banner is displayed. You can choose between:
- Accept all: necessary and analytics cookies
- Necessary only: only technically required cookies
- Settings: individual selection by category
You can withdraw or change your consent at any time via the "Cookie-Einstellungen" (cookie settings) link in the website footer. The website will then display the cookie banner again.
4.4 Cookies used
| Cookie | Purpose | Retention period | Type |
|---|---|---|---|
| theme | Stores the selected color scheme and light/dark mode | 1 year | Necessary |
| cookie-consent | Stores your cookie consent (localStorage) | Unlimited | Necessary |
| _ga, _ga_* | Google Analytics: distinguishing unique users | 2 years | Analytics |
5. Legal bases for processing
| Processing | Legal basis |
|---|---|
| Account management | Art. 6(1)(b) GDPR (performance of a contract) |
| AI chat processing | Art. 6(1)(b) GDPR (performance of a contract) |
| Knowledge bases | Art. 6(1)(b) GDPR (performance of a contract) |
| Billing and payment processing | Art. 6(1)(b) GDPR (performance of a contract) |
| Retention of invoices and accounting records | Art. 6(1)(c) GDPR (legal obligation) |
| Security logging | Art. 6(1)(f) GDPR (legitimate interest) |
| Web analytics (Google Analytics) | Art. 6(1)(a) GDPR (consent via the cookie banner) |
| Error monitoring (Sentry) | Art. 6(1)(f) GDPR (legitimate interest) |
6. Categories of recipients
To provide our services, we use service providers in the following categories. All processors (Auftragsverarbeiter) are contractually bound pursuant to Art. 28 GDPR.
Cloud infrastructure & hosting
Hosting, database, authentication and delivery of the application. Server location: EU (application, database and file storage in Frankfurt).
AI language models & text processing
Processing of user input by AI models for text generation, analysis and summarization. Server location by default: EU only. We enable models outside the EU only at the request of an organization. If data is then transferred to a third country (in particular the USA), the transfer is based on an adequacy decision (EU-US Data Privacy Framework) or on EU Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR.
Speech and audio recognition
Conversion of audio recordings into text (transcription). Server location: EU (Frankfurt / Germany West Central).
Payment processing (Stripe)
For checkout, subscription management, invoices and the customer portal, we use Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe processes data partly on our behalf and partly as an independent controller, for example for fraud prevention and to comply with regulatory obligations. Transfers to Stripe, Inc. in the USA and to other Stripe companies or subcontractors outside the EU are based on the EU-US Data Privacy Framework or on EU Standard Contractual Clauses. Further information: stripe.com/de/privacy. Legal basis: Art. 6(1)(b) GDPR.
Background processing
Control of longer-running operations such as agents, workflows and imports. Server location: EU.
Web search
Web search in the chat and by AI agents, can be switched off per organization. Server location: EU.
Code execution
Analysis of uploaded files by AI agents in isolated environments. Server location: EU.
Import of public web pages and calendar queries
Retrieval of public web pages for knowledge bases and querying of free time slots in a connected calendar, in each case only when the feature is used. Server location: USA.
Web analytics
Anonymized analysis of website usage (only with consent). IP anonymization active, Consent Mode v2, no advertising features.
Error monitoring (Sentry)
For technical stability and quality assurance, we use Sentry (Functional Software, Inc. or Sentry GmbH). When application errors occur, Sentry records technical information such as error messages, stack traces, browser and operating system type, and the URL accessed. No IP addresses, no cookies, no email addresses and no input content are transmitted to Sentry (sendDefaultPii: false). Sensitive headers such as authorization tokens are removed before sending. Server location: EU (Frankfurt, *.de.sentry.io). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable, error-free service). A data processing agreement pursuant to Art. 28 GDPR is in place with Sentry.
A complete list of the subprocessors (Unterauftragsverarbeiter) used is available on request at the contact address given above.
7. Retention period
We store personal data only for as long as is necessary for the respective processing purpose or as long as statutory retention obligations apply.
| Type of data | Retention period |
|---|---|
| Account data | Until the user deletes the account |
| Invoices and accounting records | Eight years pursuant to Section 147 AO (Abgabenordnung, German Fiscal Code) and Section 257 HGB (Handelsgesetzbuch, German Commercial Code), starting at the end of the calendar year |
| Contact and access requests | Until the request has been fully handled; beyond that only insofar as necessary to initiate a business relationship, followed by deletion |
| Chat histories | For the duration of use, at most until the retention period set by the organization expires; deletion on request or when the account is deleted |
| Knowledge base documents | Until deleted by the user |
| Audio recordings | 30 days by default; when a transcription is deleted, the associated audio recording is also deleted. |
| Security logs | For the duration of the legitimate interest in detecting misuse |
8. Your rights
You have the following rights with regard to your personal data:
- Right of access (Art. 15 GDPR): what data we store about you
- Right to rectification (Art. 16 GDPR): correction of inaccurate data
- Right to erasure (Art. 17 GDPR): right to be forgotten
- Restriction (Art. 18 GDPR): restriction of processing
- Data portability (Art. 20 GDPR): export of your data in a machine-readable format
- Right to object (Art. 21 GDPR): objection to processing
- Withdrawal of consent (Art. 7 GDPR): possible at any time
You can delete or export your account and your data yourself at any time in the account settings. Alternatively, contact us at: datenschutz@datenmassiv.com
9. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes the GDPR (Art. 77 GDPR).
The supervisory authority responsible for us is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart.
10. Notes on AI processing
Important notice
When you use the AI features, your input is transmitted to external AI services. This processing is necessary to provide the service. By default, the AI models run exclusively in EU regions. In the logs and in the memory of the AI agents, common patterns of sensitive data such as email addresses, phone numbers and IBANs are automatically masked.
Recommendation: Do not enter particularly sensitive personal data (health data, financial data, etc.) in the chat.
11. Data security
We take appropriate technical and organizational measures to protect your data pursuant to Art. 32 GDPR, including:
- Encrypted transmission (TLS/HTTPS)
- Access control at organization level (Row Level Security)
- Automatic masking of common sensitive patterns in agent logs
- Regular security reviews
12. Changes to this policy
We reserve the right to update this privacy policy. You can always find the current version on this page.