Privacy Policy

1. Controller

Controller as defined by GDPR Art. 4(7):

Priviq GmbH
[Address]
Email: privacy@priviq.ai

2. Your rights

You have the right at any time to:

• Access your stored data (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent (Art. 7(3) GDPR)
• Lodge a complaint with the supervisory authority (Art. 77 GDPR)

Send requests to privacy@priviq.ai. We respond within 30 days.

3. Hosting & Server Logs

This website is hosted on Hetzner Online GmbH servers, Industriestraße 25, 91710 Gunzenhausen, Germany. Servers are located exclusively in Germany. A data processing agreement (DPA) under GDPR Art. 28 exists with Hetzner.

On access, technically necessary data is stored (IP address with last octet anonymised, timestamp, requested URL, browser type). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operation and security). Retention: 7 days, then auto-deleted.

4. Contact forms & demo requests

Information you provide via the contact form or email is stored for processing and follow-up.

Data collected: Name, email (required); company, role, firm size, interest (optional); your message; consent version; daily-rotating IP hash.

Legal basis: Art. 6(1)(a) GDPR (consent) and/or Art. 6(1)(b) GDPR (pre-contractual measures).
Retention: Until withdrawal, or at most 24 months after last contact.

5. Booking (Cal.com, self-hosted)

Booking runs on a self-hosted Cal.com instance at termin.test-priviq.ai. The instance also runs on our German servers at Hetzner. No transmission to Cal.com Inc. occurs.

Data collected: Name, email, timezone, selected slot, optional calendar-sync token if you connect your calendar.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures).
Retention: 180 days after appointment, then auto-purged via pg_cron.

6. Bot protection (Altcha, self-hosted)

We use Altcha for form bot protection. Altcha is open-source, proof-of-work-based — no cookies, no fingerprinting, no third-party transmission. The server side runs on our own servers.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protection against automated abuse).

7. Analytics (Plausible, EU-hosted)

Plausible Analytics, operated by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Plausible sets no cookies and stores no personal data. IP addresses are used to derive location and then discarded.

Legal basis: Art. 6(1)(f) GDPR.
DPA: in place.
Details: plausible.io/data-policy

8. Processors

We engage the following processors, each with a DPA under GDPR Art. 28:

9. No transfer to third countries

We process your data exclusively within the European Union. No transfer to third countries (in particular the USA) takes place. We do not use Google Fonts, Google Analytics, Meta Pixel, LinkedIn Insight Tag or comparable services.

10. Audit log (GDPR Art. 30 & 32)

We log aggregated, pseudonymised event data (action, timestamp, pseudonymised IP hash, user-agent fingerprint, outcome). No plaintext IPs. Retention: 90 days.

11. Report a security issue

Found a vulnerability? We welcome responsible disclosure at security@priviq.ai. See our security.txt.

12. Changes

We update this policy when the legal situation or our processing changes. The current version is always available here. Version date at the top.