1. Controller
elunos.ai Labs UG (haftungsbeschränkt)
Neue Mainzer Straße 31
60311 Frankfurt am Main
Germany
Represented by the Managing Directors: Felix Reuter and Konstantin A. Leidig
Commercial register: Local Court (Amtsgericht) Frankfurt am Main, HRB 144323
Email: info@elunos.ai
Contact for data protection matters
Felix Reuter
Email: datenschutz@elunos.ai
Postal address: elunos.ai Labs UG (haftungsbeschränkt), Neue Mainzer Straße 31, 60311 Frankfurt am Main
2. What this policy covers
This policy covers the website elunos.ai, meaning everything you read, click and fill in here. It does not cover the use of our platform or the calls our phone agents handle. Those are covered by the privacy policy for the platform. If you become a customer, our data processing agreement additionally governs how we process data on your behalf.
3. Data we process
- Access data your browser sends with every request: IP address, date and time, the address requested, the page you came from, browser and operating system details
- Details you enter into a form yourself: name, email address, phone number, company, your message and, for job applications, your documents
- Your cookie choice and your language choice
- Usage statistics, but only with your consent (see section 7)
The website requires no account. Everything beyond the access data is something you actively give us.
4. Hosting and server log files
The website is delivered by Vercel Inc. (USA), acting as our processor. Every request creates technical log entries containing the access data listed in section 3. We use them to run the site reliably and securely and to detect errors and attacks. The legal basis is our legitimate interest in a working and protected service (Art. 6(1)(f) GDPR).
We keep no permanent copy of those logs ourselves. At our hosting provider they are deleted automatically after a short period.
The domain elunos.ai is managed and resolved through Cloudflare, Inc. (USA). Your IP address is necessarily involved, because no connection can be established without it.
5. Cookies and similar storage
Without your consent we set only what the website needs to work. The legal basis is § 25(2) no. 2 TDDDG together with Art. 6(1)(f) GDPR.
- elunos_consent stores your cookie choice so we do not have to ask again on every visit. Lifetime 180 days.
- NEXT_LOCALE stores whether you read the site in German or English. Lifetime 12 months.
Everything else, in particular usage measurement, is loaded only once you have agreed.
6. Consent and withdrawal
On your first visit we ask whether we may set analytics cookies. As long as you have not agreed, no analytics service is loaded and no data flows to one. The legal basis for consent is Art. 6(1)(a) GDPR and § 25(1) TDDDG.
You can change your decision at any time with effect for the future. The “Cookie settings” link in the left column of this and every other legal page reopens the dialog. Withdrawing is therefore as easy as giving consent (Art. 7(3) GDPR). Processing carried out before the withdrawal remains lawful.
7. Usage measurement with Google Analytics
Once you consent, we load Google Tag Manager and, through it, Google Analytics 4, both services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use them to learn which pages are read and where visitors leave, so we can improve the site.
This processes a pseudonymous identifier stored in cookies, the pages you open, approximate location derived from the truncated IP address, and device and browser details. Google truncates the IP address and does not combine it with other Google data. Google LLC (USA) may access the data as a sub-processor.
We use Consent Mode: before you agree, all consent signals are set to denied and no analytics or advertising cookies are set. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google cookies expire after two years at the latest, the reports in Google Analytics after 14 months.
8. Fonts
The typeface is bundled when the pages are built and served from our own server. Your browser makes no connection to Google, and no IP address is sent to a font provider.
9. Contacting us
When you use our contact form or write to us, we process your name, email address, any phone number and company, and your message, in order to answer you. The legal basis is Art. 6(1)(b) GDPR where a contract or its preparation is involved, otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).
The enquiry is stored in our database and additionally sent to us by email. We delete it once it has been dealt with and no statutory retention period applies, at the latest after two years.
10. Demo and consultation appointments
For a live demo or a consultation we process your name, email address, company and the slot you choose. The legal basis is Art. 6(1)(b) GDPR (steps prior to a contract).
For the appointment itself we create a Microsoft Teams link through Microsoft Graph, which transfers your name and email address to Microsoft Ireland Operations Limited. Confirmation, calendar entry and reminder are sent by email. If you join the meeting, Microsoft's own privacy terms apply to it in addition.
We delete booking data once the appointment has taken place and no business relationship results from it, at the latest after twelve months.
11. Job applications
If you apply through the website, we process your contact details and the documents you upload in order to decide on your application. The legal basis is § 26(1) BDSG together with Art. 6(1)(b) GDPR. Your documents reach only the people involved in the decision.
We check uploaded files technically for type and size before accepting them. Application documents are deleted no later than six months after the process ends, unless you have agreed to us keeping them for future roles.
12. Partner enquiries
If you apply as a partner or reseller, we process your contact and company details in order to assess and prepare the cooperation. The legal basis is Art. 6(1)(b) GDPR.
13. Newsletter
The newsletter uses double opt-in: after signing up you receive an email with a confirmation link, and only then do we add you. We store your email address and the time of sign-up and confirmation so we can evidence the consent. The legal basis is Art. 6(1)(a) GDPR.
You can unsubscribe at any time using the link in every email or by writing to datenschutz@elunos.ai. We then remove your address from the list.
We may inform existing customers by email about our own comparable services. The legal basis is Art. 6(1)(f) GDPR together with § 7(3) UWG. You can object at any time at no cost beyond the transmission charges.
14. Support widget
A widget appears in the bottom right corner that lets you message us directly. It is our own product and runs on our own platform at app.elunos.ai. No outside provider is involved, and what you type does not leave our systems. The widget loads only after you have answered the cookie notice. It processes the connection data technically required and whatever you write in the chat. The legal basis is our legitimate interest in supporting prospective customers quickly (Art. 6(1)(f) GDPR), or Art. 6(1)(b) GDPR for concrete contractual questions.
15. Protection against abuse
Forms on this website are protected against automated submissions. For that we use Cloudflare Turnstile from Cloudflare, Inc. (USA), a check that works without puzzles. It transmits technical characteristics of your browser and your IP address to Cloudflare in order to tell human input from automated input. We additionally limit the number of submissions per IP address and evaluate a field invisible to you that only machines fill in.
If a page violates our security rules for embedded content, your browser reports this to an address on our own server. That report contains the affected address and the blocked resource. The legal basis for all of this is our legitimate interest in preventing abuse and attacks (Art. 6(1)(f) GDPR).
16. Recipients and processors
We pass on data only where it is necessary for the purposes described. All of the following providers work for us under a data processing agreement pursuant to Art. 28 GDPR.
- Vercel Inc. (USA): hosting and delivery of the website.
- Cloudflare, Inc. (USA): domain management, name resolution and the Turnstile spam protection.
- Supabase, Inc. (USA): database for form submissions and page content. The database itself is located in the EU region Frankfurt am Main.
- Resend, Inc. (USA): sending confirmations, reminders and notifications by email.
- Microsoft Ireland Operations Limited (Ireland): creating and running the Teams appointments.
- Google Ireland Limited (Ireland): Tag Manager and Analytics, only after your consent.
Beyond that we disclose data to authorities where we are legally obliged to. We do not sell data.
17. Transfers to third countries
Some of the providers named are based in the United States or can access data from there. For those transfers we rely on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) and, where the provider is certified under it, on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).
Despite those safeguards, access by US authorities cannot be ruled out entirely. We therefore choose European storage locations wherever we can, as with our database in Frankfurt am Main.
18. Retention
We store personal data only as long as it is needed for the respective purpose. The specific periods are stated with each processing activity above. After that we delete the data unless a commercial or tax retention obligation applies. Such obligations usually run for six or ten years; during that time we restrict processing to fulfilling the retention obligation.
19. Your rights
You have the following rights towards us:
- Access to the data we hold about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Receiving your data in a common format (Art. 20 GDPR)
- Objection to certain processing (Art. 21 GDPR)
- Withdrawal of a consent you have given (Art. 7(3) GDPR)
- Complaint to a supervisory authority (Art. 77 GDPR)
An informal message to datenschutz@elunos.ai is enough. By post you can reach us at elunos.ai Labs UG (haftungsbeschränkt), Neue Mainzer Straße 31, 60311 Frankfurt am Main. We reply within the statutory period of one month.
20. Right to object
Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object on grounds arising from your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds. You may object to direct marketing at any time and without giving reasons (Art. 21(2) GDPR).
21. Competent supervisory authority
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163, 65021 Wiesbaden, Germany
datenschutz.hessen.de
You may equally contact the supervisory authority where you live or work.
22. Changes to this policy
We update this policy when our services or the legal situation change. The version published here applies, identifiable by the date at the top of this page.