Privacy Policy

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Data Protection Officer

For data protection inquiries, please contact us directly:

3. General Information on Data Processing

3.1 Scope of Personal Data Processing

We generally process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. The processing of personal data of our users regularly takes place only after user consent. An exception applies in cases where prior consent cannot be obtained for actual reasons and the processing of data is permitted by law.

3.2 Legal Basis for Personal Data Processing

When we obtain consent from the data subject for personal data processing operations, Art. 6(1)(a) GDPR serves as the legal basis for processing personal data.

For processing personal data necessary for the performance of a contract to which the data subject is party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for carrying out pre-contractual measures.

When processing personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.

When processing is necessary for the purposes of legitimate interests pursued by our company or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, Art. 6(1)(f) GDPR serves as the legal basis for processing.

3.3 Data Deletion and Retention Period

Personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may continue if this has been provided for by the European or national legislator in EU regulations, laws, or other provisions to which the controller is subject.

We apply the following specific retention periods:

• Server log files: 7 days
• Calendly booking data: 24 months
• Business correspondence: 6 years (commercial retention obligation)
• Accounting-relevant data: 10 years (tax retention obligation)

Deletion occurs automatically through the respective services and systems after the stated periods expire, unless a legal retention obligation prevents deletion. Cookie data is automatically removed through browser settings.

3.4 Data Processing Agreements

We maintain current data processing agreements in accordance with Art. 28 GDPR with all third-party providers who process personal data on our behalf. A list of our data processors can be found in Section 14 of this privacy policy.

4. Website Provision and Log File Creation

4.1 Description and Scope of Data Processing

Each time you visit our website, our system automatically collects data and information from the calling computer system. The following data is collected:

• Browser type and version information
• User's operating system
• User's internet service provider
• User's IP address (anonymized)
• Date and time of access
• Websites from which the user's system reached our website
• Websites accessed by the user's system through our website

4.2 Legal Basis for Data Processing

The legal basis for the temporary storage of data and log files is Art. 6(1)(f) GDPR.

4.3 Purpose of Data Processing

Temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session. Storage in log files is done to ensure website functionality. The data also serves to optimize the website and ensure the security of our information technology systems.

4.4 Storage Duration

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collection for website provision, this occurs when the respective session ends. In the case of data storage in log files, this occurs after a maximum of 7 days.

5a. Newsletter / AILoopwise Blueprint

5a.1 Description and Scope of Data Processing

If you request the AILoopwise Blueprint on our website, we process the following data:

• Email address
• First name (optional)
• Language of the page (English or German)
• Source, e.g. which video or campaign brought you to the page
• Time of your consent and of your confirmation

5a.2 Double Opt-In

After you submit the form, we send you a confirmation email. Only when you click the link in that email do we add you to our mailing list. The link is valid for 7 days. We log the time of the request and of the confirmation so that we can demonstrate your consent.

5a.3 Purpose of Data Processing

We process the data to provide you with the AILoopwise Blueprint and to send you emails with guides for new videos, invitations to our workshop and occasional emails about AILoopwise's AI implementation services.

5a.4 Legal Basis for Data Processing

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

5a.5 Processor and Third-Country Transfer

We use the service Resend (Resend, Inc., USA) to send the emails and manage the contacts. Your data is transferred to the USA in the process. Resend is certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision, Art. 45 GDPR); in addition, the EU Standard Contractual Clauses apply.

5a.6 Storage Duration and Withdrawal

We store the data until you withdraw your consent. You can withdraw your consent at any time via the unsubscribe link in our emails or by email to contact@ailoopwise.com. The withdrawal does not affect the lawfulness of processing carried out until then.

5a.7 Abuse Protection (Cloudflare Turnstile)

To stop the sign-up form from being abused automatically, for example to enter other people’s email addresses, we use Cloudflare Turnstile (Cloudflare, Inc., USA). When the form loads, Turnstile checks technical characteristics of your browser and your IP address; no advertising cookies are set. The legal basis is our legitimate interest in preventing abuse under Art. 6(1)(f) GDPR. Data may be transferred to the USA in the process; Cloudflare is certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision, Art. 45 GDPR); in addition, the EU Standard Contractual Clauses apply.

5a.8 Course Videos (YouTube)

The course pages show videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We only embed them after you click: until then the page shows nothing but our own placeholder, and no data is sent to YouTube. Only the click makes your browser load the video in privacy-enhanced mode from youtube-nocookie.com. YouTube and Google then receive data such as your IP address, the page you are on and technical details about your browser; during playback YouTube may also store information on your device. The legal basis is the consent you give by clicking, under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Data may be transferred to the USA in the process; Google LLC is certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision, Art. 45 GDPR). Further processing is governed by Google’s privacy policy: https://policies.google.com/privacy

7. AI Automation Services

7.1 Description of Data Processing

As part of our AI automation services, we process customer data exclusively within the framework of data processing according to Art. 28 GDPR. Special features of our service:

• We agree with you, per project, where each part of the system runs and who can access the data, typically inside your own systems and accounts. When we use Claude through Anthropic's API, the model call runs at Anthropic and is governed by contract.
• Implementation with GDPR requirements in mind from the start

7.2 Legal Basis for Data Processing

Processing is carried out to fulfill our contractual obligations according to Art. 6(1)(b) GDPR and in accordance with the provisions for data processing according to Art. 28 GDPR.

7.3 Technical and Organizational Measures

Our technical and organizational measures include:

• Encrypted data transmission (TLS)
• Secure authentication and access control

8. Cookies and Similar Technologies

8.1 Description and Scope of Data Processing

Our website uses cookies. Cookies are text files stored in or by the internet browser on the user's computer system. We use the following categories of cookies:

• Technically necessary cookies: These cookies are required for the basic functionality of the website
• Functional cookies: These cookies store your settings (e.g., language selection)
• Analytics cookies: These cookies help us improve the website (only with your consent)

8.2 Legal Basis for Data Processing

Technically necessary cookies are set based on our legitimate interest according to Art. 6(1)(f) GDPR. All other cookies are only set with your express consent according to Art. 6(1)(a) GDPR.

8.3 Cookie Management

You can manage your cookie settings at any time via our cookie banner or in your browser's privacy settings. Details can be found in our separate cookie policy.

8.4 Consent Documentation

We document all cookie consents with timestamps and maintain these records for accountability purposes according to Art. 5(2) GDPR. Consent data is stored locally in your browser and used for verification when needed.

9. Data Subject Rights

If personal data concerning you is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

9.1 Right of Access (Art. 15 GDPR)

You may request confirmation from the controller as to whether personal data concerning you is being processed by us. Where such processing exists, you may request information from the controller about: processing purposes, categories of processed data, recipients of the data, planned storage duration, and other information according to Art. 15 GDPR.

9.2 Right to Rectification (Art. 16 GDPR)

You have a right to rectification and/or completion vis-à-vis the controller, provided that the processed personal data concerning you is inaccurate or incomplete.

9.3 Right to Erasure (Art. 17 GDPR)

You may request that the controller delete personal data concerning you without undue delay, provided that one of the legal reasons applies and the processing is not necessary. We guarantee processing of your deletion request within 30 days.

9.4 Right to Restriction of Processing (Art. 18 GDPR)

Under the legal requirements, you may request restriction of processing of personal data concerning you.

9.5 Right to Data Portability (Art. 20 GDPR)

You have the right to receive personal data concerning you in a structured, commonly used, and machine-readable format or to request transmission to another controller.

9.6 Right to Object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you based on Art. 6(1)(e) or (f) GDPR.

9.7 Right to Withdraw Consent (Art. 7(3) GDPR)

You have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

9.8 Automated Individual Decision-Making Including Profiling (Art. 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision is necessary for entering into or performance of a contract between you and the controller.

We do not use automated decision-making on our website.

9.9 Exercising Your Rights

To exercise your rights, please contact us at contact@ailoopwise.com. We respond to your requests within 30 days.

9.10 Right to Lodge a Complaint (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

10. Data Security and Encryption

We implement technical and organizational security measures to protect your data managed by us against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. Our security measures are continuously improved in accordance with technological developments.

• SSL/TLS encryption for all data transmissions
• Secure server infrastructure in Germany
• Regular security updates and audits
• Access control and authentication
• Data backup and disaster recovery

11. International Data Transfers

Generally, processing of your personal data takes place within the European Union. However, when using certain services, data transfers to third countries may occur:

11.1 Data Transfers to the USA

The following service providers may process data in the USA:

• Vercel Inc. (Hosting Provider) - Data processing based on EU Standard Contractual Clauses and EU-US Data Privacy Framework
• Calendly LLC (Appointment Booking System) - Data processing based on EU Standard Contractual Clauses (2021) and UK Addendum

All mentioned providers have committed to GDPR compliance and offer appropriate guarantees for the protection of your data.

11.2 Your Rights Regarding International Data Transfers

You have the right to obtain information about the appropriate safeguards in connection with the transfer. Contact us at contact@ailoopwise.com for further details.

For our AI services, we agree with you, per project, where each part of the system runs and who can access the data, typically inside your own systems and accounts. When we use Claude through Anthropic's API, the model call runs at Anthropic and is governed by contract.

12. Third-Party Providers and Data Processors

We work with the following third-party providers who process personal data on our behalf:

13. Changes to This Privacy Policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services in the privacy policy, e.g., when introducing new services. The new privacy policy will then apply to your return visit.

14. Contact for Data Protection Matters

For questions about data protection, exercising your rights, or this privacy policy, please contact: