Version: 1.0 · Date: 2026-09-28
A one-page summary. The binding contract is the AVV (German); an English courtesy translation is available.
Who is responsible
| Your organisation | Controller for the content of its workspaces |
| AUVY GmbH | Processor for that content, bound by the AVV (Art. 28 GDPR) |
| AUVY GmbH as controller | Accounts, sign-in, billing and platform security, see the Product Privacy Notice |
| Consumers | No processing on behalf; AUVY is controller, also for a personal workspace one of AUVY's apps creates |
Key facts
| Contract | The AVV applies as soon as a workspace is created for your organisation, including when an app creates it at sign-in, and at the latest when you accept the business terms; no signature needed |
| Apps | AUVY's own apps such as Outeva are brands of AUVY GmbH and fall under the AVV; third-party apps are recipients on your instruction |
| Where data is stored | Only with Hetzner in Helsinki (EU) |
| AI models, compute and voice | Processed per request by Amazon Bedrock, Microsoft Azure and Google Vertex AI in EU regions; Amazon stores nothing, Microsoft may keep Azure OpenAI prompts and responses for up to 30 days for abuse monitoring, Google may cache inputs in memory for up to 24 hours; never used for training |
| Sub-processors | Live register; changes announced 30 days ahead, with a right to object |
| Breach notification | Within 24 hours of AUVY becoming aware |
| Deletion | Within 30 days after the contract ends; backups rotate out after a further 30 days |
| Audits | Once a year with 20 business days' notice, or on specific cause |
| Professional secrets (§ 203 StGB) | Only after activation in text form, for Business and Enterprise customers |
Contact
Privacy: privacy@auvy.ai · Security: security@auvy.ai