Privacy Policy

1. Overview

This policy explains how we process personal data when you visit this website (aqentra.ai) and, separately, when you create an account and use our product, the Aqentra AI platform (app.aqentra.ai). Sections 2 to 6 cover this website. Section 7 covers the product and applies only if you sign up for it.

2. Controller

Rasmus Rosenkranz, trading as "Aqentra AI"
Rathenaustraße 234
22337 Hamburg, Germany
Email: rosenkranz.rasmus@gmail.com

3. Hosting and Server Log Data

This website is hosted by Cloudflare. When you visit, our hosting provider automatically records information in server log files: your IP address, browser type and version, operating system, referrer URL, date and time of the request, and the amount of data transferred. This is technically necessary to deliver the website reliably and securely, and it is not combined with other data sources.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of this website)
• Hosting provider: Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C – 8th Floor, 81671 Munich, Germany, part of the Cloudflare, Inc. group. As part of operating its global network, Cloudflare may process data outside the EU/EEA; where that occurs, it is safeguarded by EU Standard Contractual Clauses (Art. 46 GDPR).

4. Cookies and Similar Technologies

Strictly necessary

We use Cloudflare Turnstile to protect our forms (waitlist, pilot access, feedback) against spam and automated abuse. Turnstile runs a non-intrusive challenge in your browser and may set a cookie or process device signals for this purpose. It is provided by Cloudflare, Inc. This is strictly necessary to offer the form securely, so it does not require consent (§ 25(2) No. 2 TDDDG) and is not gated by the cookie banner described below. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse of our forms).

We also store your cookie-consent choice itself in your browser's local storage (not a cookie) so we don't ask you again on every visit. This is strictly necessary to operate the consent banner and does not require consent.

Requires your consent

We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to load additional tools on this site, such as analytics, if and when we configure them. Google Tag Manager, and anything loaded through it, is only activated after you actively accept it in the cookie banner shown on your first visit — it is never loaded beforehand. You can change your choice at any time via "Cookie Preferences" in the footer of every page, which lets you withdraw consent with future effect.

• Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG
• Withdrawal: Anytime, via "Cookie Preferences" in the footer

5. Contact, Waitlist, Pilot Access, and Feedback Forms

If you use one of our forms, we process the information you submit: depending on the form, this may include your name, email address, company, an optional message, or feedback text and rating. Submissions are verified with Cloudflare Turnstile (see above) and then delivered to our inbox by email via Resend (Resend, Inc., USA), our email-delivery sub-processor. We do not store form submissions in a database on this website — they exist only as the email we receive and any reply we send.

• Legal basis: Art. 6(1)(b) GDPR for requests that are steps toward a contract (e.g. pilot access), Art. 6(1)(f) GDPR for general inquiries and feedback (our legitimate interest in responding to you)
• Retention: As long as needed to process and respond to your request, then deleted in the ordinary course of mailbox management, unless we are legally required to keep records for longer
• International transfer: Resend, Inc. is based in the United States; transfers to it are safeguarded by EU Standard Contractual Clauses (Art. 46 GDPR)

6. Your Rights as a Data Subject

Regarding both this website and, if applicable, our product, you have the right to:

• Access the personal data we hold about you (Art. 15 GDPR)
• Have inaccurate data corrected (Art. 16 GDPR)
• Have your data erased, where the legal requirements are met (Art. 17 GDPR)
• Restrict processing, where the legal requirements are met (Art. 18 GDPR)
• Receive your data in a portable format (Art. 20 GDPR)
• Object to processing based on our legitimate interest, including profiling (Art. 21 GDPR)
• Withdraw any consent you have given, at any time, with future effect (Art. 7(3) GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise any of these rights, contact us at rosenkranz.rasmus@gmail.com. We do not currently offer a fully automated self-service tool for this, so requests are handled manually; we will respond within one month, as required by Art. 12(3) GDPR.

The supervisory authority responsible for us is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI)
Ludwig-Erhard-Straße 22, 7th floor, 20459 Hamburg, Germany
datenschutz-hamburg.de

7. Our Product (Aqentra AI Platform)

This section applies only if you create an account and use the Aqentra AI product, for example after clicking "Start for Free." Aqentra AI is offered both as a managed hosted service and as a self-hosted or local deployment that runs within your own infrastructure; which parts of this section apply to you depends on which option you use.

Account data

To create and operate your account we process your email address, a securely hashed password, your name, your role, and account timestamps (such as creation and last login). Legal basis: Art. 6(1)(b) GDPR (performance of the contract to provide the product to you).

Data you upload or connect

If you upload files or connect a data source (such as a Snowflake or Azure SQL warehouse) for analysis, we process the data contained in it on your behalf, including any personal data it contains — for example, if you choose to include your own customers' or employees' data. For that data, we act as a processor on your instructions (Art. 28 GDPR); you remain the controller. A data processing agreement (Auftragsverarbeitungsvertrag) is available on request. Connector credentials you provide for external data sources are encrypted at rest.

AI-assisted analysis

Some features (such as generated summaries and explanations) are powered by a third-party AI model provider — currently Google Gemini, provided by Google. We design these features to minimize what is shared with the model provider to the data and results needed to generate the requested output, but depending on the specific feature you use, this can include data derived from your uploaded content, not only aggregate results. Legal basis: Art. 6(1)(b) GDPR. As Google processes data globally, this may involve transfers outside the EU/EEA, safeguarded by EU Standard Contractual Clauses (Art. 46 GDPR). If you use a self-hosted deployment configured with a fully local model, no data is sent to an external AI provider for that feature.

Infrastructure (managed hosting only)

If you use our managed hosted service, your account and uploaded data are stored in a database operated by Aiven OY, hosted in the Netherlands, and our application runs on Oracle Cloud Infrastructure in Frankfurt, Germany (region eu-frankfurt-1). Both are within the EU/EEA. Account-related transactional emails (such as email verification and password reset) are sent via Brevo (Sendinblue SA, France).

Self-hosted and local deployments

If you choose a self-hosted or local deployment, we do not host or process your data — it stays within your own infrastructure, and we are not a processor for it. Note that even in this mode, if you enable AI-assisted features using an external model provider rather than a fully local model, requests to that provider still leave your infrastructure; refer to your own deployment's configuration to control this.

Session security

We use a strictly necessary session cookie to keep you signed in, secured with standard protections (HttpOnly, Secure, SameSite). This is required to operate the product and does not require consent.

8. Retention

We keep personal data only as long as necessary for the purposes described above, or as required by law. When you delete uploaded data or your account, we may retain a minimal record of that action (such as a deletion timestamp and file name) for audit purposes, without retaining the underlying data itself.

9. Security

We use technical and organizational measures appropriate to the risk, including TLS encryption in transit, hashed passwords, encryption of stored connector credentials, and access controls on uploaded data. No transmission over the internet or method of electronic storage is completely secure, so we cannot guarantee absolute security.

10. Children

This website and product are directed at business users and are not intended for children.

11. Changes to This Policy

We may update this policy as our website, product, or applicable law changes. The version published here is always the current one.