Privacy Policy

At a glance

This website is deliberately built to collect as little personal data as possible. We do not use tracking, advertising networks, or analytics on ai.vodoro.net, and the site loads no fonts, scripts or other resources from third-party servers.

The only personal data we process here is what your browser has to send in order to display the site, and whatever you choose to send us through the contact form, the booking form or by email.

This policy covers the website ai.vodoro.net only. Our rideshare application at vodoro.net is a separate service with its own privacy policy.

Who is responsible

The controller responsible for data processing on this website within the meaning of Art. 4 (7) GDPR is:

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data. Full company details can be found in our Impressum.

Server log files

Every time you open a page, your browser automatically transmits technical information that our server records in so-called log files. These are:

• the page or file requested
• date and time of the request
• amount of data transferred and the HTTP status code
• the referring page, if any
• browser type and version, and the operating system used
• the IP address of the requesting device

This data is not merged with other data sources and is not used to identify you personally.

Legal basis: Art. 6 (1) (f) GDPR. We have a legitimate interest in delivering the website reliably, keeping it secure, and being able to investigate technical faults and attacks.

Retention: Log entries are deleted automatically after 14 days at the latest, unless a specific entry is needed as evidence in the investigation of a security incident.

Hosting

This website is hosted on servers located in Germany. All traffic between your browser and our server is encrypted with TLS; you can recognise an encrypted connection by the https:// prefix and the lock symbol in your browser's address bar.

Where we use external providers to operate the infrastructure, they act as processors on our behalf under a data processing agreement pursuant to Art. 28 GDPR and process data only according to our instructions.

Cookies

We only use cookies that are technically necessary to operate the website. We do not set advertising, profiling or tracking cookies, which is why this site does not need a cookie consent banner.

• A language cookie that remembers which language version of the site you selected.
• A security cookie (CSRF token) that protects forms on this site against cross-site request forgery.
• A session cookie, set only if a session is actually required, for example while a form is being submitted or while you are using the AI assistant. It is what lets the assistant remember your conversation as you move between pages.

Legal basis: § 25 (2) no. 2 TDDDG, as these cookies are strictly necessary to provide a service you have expressly requested, together with Art. 6 (1) (f) GDPR.

You can configure your browser to refuse cookies or to delete them when you close it. If you block the cookies listed above, parts of this website — in particular form submissions — may stop working.

Contact form and email

If you send us an enquiry through the contact form, we process the name, email address and message text you enter in order to handle your request and any follow-up questions.

The same applies if you contact us directly by email: we process the data you send us for the purpose of answering it.

Enquiries are also recorded in our internal customer relationship list so that we can follow them up reliably. That record contains your name, email address, any company name you provide and your message. It is accessible only to us and is not passed to third parties for their own purposes.

Legal basis: Art. 6 (1) (b) GDPR where your enquiry relates to a contract or pre-contractual measures, otherwise Art. 6 (1) (f) GDPR based on our legitimate interest in answering enquiries addressed to us. Where you have given consent, Art. 6 (1) (a) GDPR applies and you may withdraw it at any time with effect for the future.

Retention: We keep your enquiry until it has been dealt with and no further questions arise, and delete it thereafter — unless statutory retention obligations, for example under commercial or tax law, require us to keep it longer.

Please note that email is not an encrypted means of communication end to end. For confidential information, please ask us for a secure transfer channel.

Booking a call

On our booking page you can book a call with us directly. The booking form comes from Nextcloud, the groupware we run on our own server in Germany (cloud.vodoro.net), and is embedded into the page. It only loads when you open that page.

When you book, we process your name, your email address, the time you choose and anything else you enter in the form, in order to arrange and hold the call. The appointment is stored in our calendar. You receive a confirmation by email with the link to the video call and a link to cancel the appointment. These emails are sent through our email provider, Google.

The call takes place in Nextcloud Talk on the same server; you join in the browser without an account. To set up the audio and video connection, your browser contacts a so-called STUN server, which sees your IP address. We use the STUN server that Nextcloud provides for this (stun.nextcloud.com).

While you use the booking form, Nextcloud sets technically necessary cookies on cloud.vodoro.net (a session cookie and security cookies). The legal basis described under Cookies applies.

Legal basis: Art. 6 (1) (b) GDPR, as the call is a pre-contractual measure taken at your request.

Retention: We keep the appointment until the call has taken place and any follow-up questions are settled, and delete it thereafter unless statutory retention obligations require us to keep it longer. If the call leads to an enquiry or an order, your details are recorded in our internal customer relationship list as described above.

AI assistant on this website

This website offers an AI chat assistant that answers questions about our services. It only starts when you open it and send a message; it never contacts you on its own.

When you use it, we process the text of the messages you send, the time of the conversation, the language version of the site you are using, a salted one-way hash of your IP address for abuse prevention, and your browser's user agent. We do not store your IP address itself.

Where it runs: The underlying language model runs on our own server in Germany. Your messages are not sent to OpenAI, Google, Microsoft or any other external AI provider, and they are never used to train a model.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is answering questions about our services efficiently. We weighed this against your interests: the assistant only runs if you open it, we build no profile, and we do not combine the conversation with any other data. Where your enquiry concerns a possible contract, Art. 6 (1) (b) GDPR applies in addition.

Right to object: Because we rely on legitimate interest, you may object to this processing at any time under Art. 21 GDPR. You can do so immediately by using the 'Delete this conversation' button in the chat window, which erases the conversation right away, or by writing to us.

Retention: Conversations are deleted automatically 30 days after they begin. If you ask us to contact you, the contact details you enter in the callback form are stored in our internal customer relationship list as described above.

Please do not enter special categories of personal data within the meaning of Art. 9 GDPR, such as health or religious information, and do not enter other people's personal data into the chat.

Answers are generated automatically. They can be incomplete or wrong, and they are never a binding offer.

No analytics, no advertising, no external content

We do not use web analytics, remarketing, social media plugins, or advertising networks on this website. No user profiles are created.

All fonts, stylesheets, scripts and images are served from our own server. This means that opening this website does not cause your IP address to be transmitted to Google, Meta, or any other third-party provider.

Links to other services

Our website links to external services, in particular our rideshare application at vodoro.net. This privacy policy does not apply to those services. Once you follow such a link, the privacy policy of the respective provider applies.

Recipients of your data

We do not sell personal data and do not pass it on for advertising purposes. Data is only disclosed if you have consented, if we are legally obliged to do so, or if it is necessary to enforce or defend legal claims.

Beyond that, data may be processed by carefully selected service providers acting as processors on our behalf under Art. 28 GDPR, for example for hosting or email delivery. We do not transfer personal data to countries outside the EU or the EEA.

Your rights

Under the GDPR you have the following rights regarding the personal data we hold about you:

• Access (Art. 15 GDPR) — to be told whether and which data about you we process.
• Rectification (Art. 16 GDPR) — to have inaccurate or incomplete data corrected.
• Erasure (Art. 17 GDPR) — to have your data deleted, unless we are required to keep it.
• Restriction of processing (Art. 18 GDPR) — to have processing limited instead of deleted.
• Data portability (Art. 20 GDPR) — to receive your data in a structured, machine-readable format.
• Objection (Art. 21 GDPR) — to object to processing based on our legitimate interests, on grounds relating to your particular situation.
• Withdrawal of consent (Art. 7 (3) GDPR) — to withdraw a consent you have given, at any time with effect for the future.

To exercise any of these rights, an informal message to info.vodoro@gmail.com is enough. Exercising your rights is free of charge.

Right to lodge a complaint

If you believe that our processing of your data violates data protection law, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, workplace, or the place of the alleged infringement (Art. 77 GDPR).

The authority responsible for us is:

Is providing data mandatory?

You are not legally or contractually obliged to provide personal data. However, without the data requested in the contact form we cannot process your enquiry, and without the technical data described under server log files the website cannot be delivered to your browser.

Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR on this website.

Changes to this policy

We update this privacy policy whenever changes to our website or to the legal situation make it necessary. The version published here always applies. The date of the current version is shown at the top of this page.