Skip to main content
← Back

Privacy Policy

Last updated: October 16, 2026

This translation is provided for informational purposes only; the German version is the sole legally binding text.

1. Data Protection at a Glance

General Information

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.

2. Controller

Mark Heinsohn
Osterdeich 34
28203 Bremen
Email: privacy@smartwebchat.eu

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

3. Data Collection on This Website

Server Log Files

The web server does not keep an access log covering all pages of this website. Only requests to the addresses aimed at automated services are logged (robots.txt, sitemap.xml, llms.txt, the addresses under /.well-known/, the interface description and the interface at /api/mcp). No access log is kept for any other page, and in particular not for use of the AI assistant. What is recorded is:

  • the address requested and the response status
  • the time of the request
  • the program identifier sent by the client (user agent) — it usually indicates which program and which operating system is being used
  • the referring address (referrer), where the client sends one
  • a truncated IP address: for IPv4 without the final address byte, for IPv6 without the final 96 bits. The full address is not stored

Authorisation and session data (Authorization and Cookie headers) are redacted before being written. This data is not merged with other data sources. The logs are held in a size-limited ring buffer and are continuously overwritten from it; an extract created with each software release is deleted automatically after 30 days at the latest. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure operation of the website and in being able to trace automated access.

Chatbot Use

When you use the AI assistant on this website, we process your input in order to generate a reply. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Your messages and the assistant's replies are transmitted to our processor Mistral AI SAS, France, in order to generate the reply. We store the conversation for 30 days and delete it automatically thereafter. The chat window also stores a session identifier and the conversation so far on your device, so that your conversation survives a page change. This data leaves your device only as part of your requests to us. You may object to this processing at any time and request deletion of your conversation. An informal message to privacy@smartwebchat.eu is sufficient.

Newsletter

If you subscribe to our newsletter, we process the email address you provide. Subscription follows the double opt-in procedure: after you sign up, you receive an email containing a confirmation link; your subscription only becomes effective once you click that link. To document your consent, we store the time of sign-up and the part of our website through which you signed up (for example the footer or the newsletter page), together with your IP address, which we store exclusively as a hash value (no plain-text storage). We also store the language in which you signed up, solely for the purpose of sending you the newsletter in that language. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time — via the unsubscribe link at the end of every newsletter email or the "List-Unsubscribe" function of your email program; your consent is thereby considered revoked for the future. Newsletters are sent via Brevo (see "Processors and Third-Party Providers"); your email address is not passed on to third parties for advertising purposes.

Processors and Third-Party Providers

We use the following third-party providers:

  • Mistral AI SAS (Paris, France) — AI-powered text generation for chatbot responses as well as the creation of text embeddings for the knowledge base. This is the default setting. The chat input of website visitors and the content of uploaded knowledge sources are processed. Processing takes place on servers within the EU; no transfer to a third country occurs. Legal basis: Art. 6(1)(b) GDPR.
  • OpenAI Ireland Ltd. (Dublin, Ireland) — optional, only if a premium model from OpenAI (e.g., GPT-4o) has been selected for the respective assistant. The chat input of website visitors is processed. Legal basis: Art. 6(1)(b) GDPR. The recipient is the Irish company; the transfer to it takes place within the European Economic Area. Where OpenAI Ireland Ltd. passes the data on to companies of the OpenAI group or to third parties outside the European Economic Area in order to provide the service, it has undertaken towards us by contract to base that transfer on appropriate safeguards under Art. 46 GDPR or on an adequacy decision of the European Commission under Art. 45 GDPR; we disclose the basis applicable in the individual case on request. The data is not used to train AI models.
  • Digistore24 GmbH (Hanover, Germany) — payment and order processing for subscriptions (reseller / merchant of record). The data processed includes payment data (e.g., credit card, SEPA, PayPal), email address, and billing address. To pre-fill the order form we additionally transmit first and last name, company name, country and — for orders from another EU country — the VAT identification number, if you have provided one. We do not transmit your postal address or telephone number. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). The technical infrastructure is provided by Digital Assets AG (Rotkreuz, Switzerland) (covered by an EU adequacy decision). Privacy policy: digistore24.com/page/privacy
  • Brevo GmbH (Köpenicker Str. 126, 10179 Berlin, Germany) — sending of newsletter emails (sign-up confirmation and newsletter), of the request for a review and of four onboarding emails (welcome, installation, results, handover). We send all other emails from our own mailbox at Hetzner Online GmbH (see below). Email addresses and email content are processed. Legal basis: Art. 6(1)(b) GDPR (transactional) or Art. 6(1)(a) GDPR (newsletter, consent). According to its own statements, Brevo processes data on servers within the EU (France, Germany, Belgium). Any sub-processors are listed in Brevo's data protection documentation. Privacy policy: brevo.com/de/legal/privacypolicy
  • Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) — sending of all other emails from our own mailbox: registration and account, password, email address change, invitation, deletion confirmation, notifications about enquiries, handovers and credit, trial period reminders, contact form, support and operational alerts. If our hourly sending quota is exhausted, these emails wait in a queue on our own server (Redis database) until they can be sent; there is no fixed maximum duration for this. For account and security emails (such as password or confirmation emails), the queue only holds which email it is and which transaction it relates to, and for the confirmation of an account deletion or an email address change also the email addresses concerned; text and link are generated only when it is sent. Once an email has been sent or has finally failed, it is deleted from the queue; its content may remain in Redis's storage files (append-only file and snapshot) until these are rewritten. Email addresses and email content are processed. Legal basis: Art. 6(1)(b) GDPR; for the contact form, section 5 applies.

Which AI provider is used in a given case depends on the model selected for the respective assistant. Mistral (processing in the EU) is always the default; OpenAI is only used when a corresponding premium model is actively selected.

Data processing agreements (DPAs) pursuant to Art. 28 GDPR have been concluded with the providers acting as processors. Digistore24 GmbH acts as an independent controller in the context of payment and order processing; the legal basis for the data transfer is Art. 6(1)(b) GDPR (performance of a contract).

4. Customer Account and Company Details

When you create a customer account, we process the data you provide in order to perform the user agreement and to conclude the data processing agreement with you under Article 28 GDPR.

What data we process

  • Access data: email address and password. We store the password exclusively as a cryptographic hash (bcrypt) — we do not know it in plain text. Legal basis: Article 6(1)(b) GDPR (performance of a contract).
  • Person: first and last name of the individual acting for the company. This identifies the contracting party. When you purchase a paid plan, we transmit the first and last name to Digistore24 GmbH so that the order form is pre-filled (see section 3). Legal basis: Art. 6(1)(b) GDPR.
  • Company details: company name, legal form, address, country and telephone number; the VAT identification number if you provide one. These details identify the controller within the meaning of Article 28 GDPR and appear on invoices. Legal basis: Article 6(1)(b) GDPR, and for tax retention additionally Article 6(1)(c) GDPR.
  • Record of consent: the time and version of the documents you agreed to, together with a salted, non-reversible checksum of your IP address. We do not store the IP address itself. The record serves the accountability obligation under Article 5(2) GDPR. Legal basis: Article 6(1)(c) GDPR.
  • Language setting: the language you selected, so that the interface and emails appear in that language. Legal basis: Article 6(1)(b) GDPR.
  • Origin of the sign-up: campaign parameters from the address you used (UTM), the referring website and the first page you visited. These details serve us alone — evaluating how prospective customers find us — and are not necessary for the contract. Legal basis: Article 6(1)(f) GDPR (legitimate interest in measuring the success of our own advertising). You may object to this processing at any time under Article 21 GDPR; we will then delete the details.

Which details are required

Required for concluding the contract are email address, password, first and last name, company name, legal form, address, country and telephone number. Without these details we cannot conclude the user agreement and the data processing agreement, and cannot activate the account. The VAT identification number is optional; not providing it has no disadvantages.

How long we store the data

We store account and company details for the duration of the contractual relationship. After it ends we delete them unless statutory retention obligations apply: we retain invoicing and accounting data for up to ten years under Section 147 of the German Fiscal Code and Section 257 of the German Commercial Code. The record of consent is retained for as long as it is required for accountability. Origin details are deleted at the latest together with the account.

Your rights to information, rectification, erasure, restriction, data portability and objection are described in Section 7. You can request a complete export of your account and company details at any time in your account settings.

5. Contacting Us

If you contact us by email, we store the information you provide, including the contact details you supply, in order to process your inquiry and in case of follow-up questions. We do not pass on this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR, provided your inquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases it is based on Art. 6(1)(f) GDPR; our legitimate interest lies in answering the inquiry addressed to us.

Via the contact form on our website we process your name, your email address, the subject you selected, your message and — if provided — your company. Providing this information is voluntary; without a name, an email address and a message we cannot answer the inquiry. Your inquiry is transmitted to us solely by email. It is sent from our own email mailbox at Hetzner Online GmbH (see section 3). You will additionally receive an acknowledgement of receipt at the address you provided. If our hourly sending quota is exhausted, both emails wait in a queue on our own server (Redis database) until they can be sent. There is no fixed maximum duration for this. Once an email has been sent or has finally failed, it is deleted from the queue; its content may remain in Redis's storage files (append-only file and snapshot) until these are rewritten.

We delete inquiries from the contact form no later than six months after the matter has been concluded, provided that no contract comes about and no statutory retention periods apply. To protect against automated misuse we limit the number of submissions per internet connection; your IP address is held in volatile form for a maximum of ten minutes for this purpose and is not combined with your inquiry. The legal basis is Art. 6(1)(f) GDPR.

6. Hosting

The processor is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server location is a German data center (Falkenstein or Nuremberg). Details can be found in Hetzner's privacy policy: https://www.hetzner.com/legal/privacy-policy.

The use of Hetzner is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the reliable presentation of our website. A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with Hetzner. Regular processing and storage take place in a German data centre; when server snapshots are used, replication within the provider's EU network zone (Germany, Finland) is possible. No processing takes place outside the European Union.

To detect technical errors, we use self-hosted monitoring software (GlitchTip), which runs on the same Hetzner infrastructure. No data is transferred to third parties. Personal data contained in error reports is largely removed automatically before storage. Error reports are deleted automatically after 30 days. In addition, we use the self-hosted software Umami for cookie-free traffic analysis (see section 8). Legal basis: Art. 6(1)(f) GDPR.

7. Your Rights

You have the right, at any time, to:

  • Information about your stored personal data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)
  • Withdrawal of a consent you have given, with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected

To exercise these rights, an informal message to privacy@smartwebchat.eu is sufficient. If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with a supervisory authority.

Your right to object under Art. 21 GDPR

Where we process your data on the basis of legitimate interests under Art. 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation. This concerns the logging of automated access (section 3), the origin details of your sign-up (section 4), the abuse limit on the contact form (section 5), the operation of the website including error detection (section 6) and traffic analysis (section 8). If you object, we will no longer process your data in that respect unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. An informal message to privacy@smartwebchat.eu is sufficient; no particular format is required.

No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The AI assistant generates reply texts; it does not take decisions that produce legal effects concerning you or similarly significantly affect you.

8. Traffic Analysis (Umami)

For the statistical evaluation of the use of this website, we use the self-hosted analytics software Umami. Umami runs exclusively on our own server infrastructure (Hetzner, Germany); no data is transmitted to third parties. Measurement is cookie-free — no cookies are set and no information is stored on or read from your device. Your IP address is processed only briefly for aggregation purposes and is not stored permanently; no personal usage profiles are created. The legal basis is our legitimate interest in data-sparing traffic analysis (Art. 6(1)(f) GDPR). You can object to this measurement at any time by activating the "Do Not Track" setting in your browser — this setting is respected.

9. Cookies and storage access

This website does not use tracking cookies or third-party analytics tools. Only technically necessary cookies required for the operation of the website are used, in particular the dashboard login session. In addition, the chat window stores four items in your browser: a session identifier and the conversation so far, so that your conversation survives a page change (see section 3); the point in time at which you dismissed a notice from the chat window, so that it is not shown to you again for 24 hours; and the fact that your conversation has been handed over to a human, so that the chat continues in handover mode after a page change. These four forms of access to your device are strictly necessary in order to provide the service you have expressly requested and are therefore exempt from consent under Section 25(2) no. 2 TDDDG. The chat window creates a counter of the pages you have viewed only if proactive engagement based on page views has been configured for the assistant in question; this is not the case for the assistant on this website. The traffic analysis described in section 8 is self-hosted and cookie-free; it stores nothing on your device and reads nothing from it.