Version: 1.0 · Date: 2026-09-26
A one-page summary. The binding contract is the AVV (German); an English courtesy translation is available.
Who is responsible
| Your organisation | Controller for the content of its workspaces |
| AUVY GmbH | Processor for that content, bound by the AVV (Art. 28 GDPR) |
| AUVY GmbH as controller | Accounts, sign-in, billing and platform security, see the Product Privacy Notice |
| Consumers | No processing on behalf; AUVY is controller |
Key facts
| Contract | The AVV applies automatically when you accept the business terms; no signature needed |
| Where data is stored | Only with Hetzner in Helsinki (EU) |
| AI and voice | Processed per request by Amazon Bedrock and Microsoft Azure in EU regions; Amazon stores nothing, Microsoft may keep Azure OpenAI prompts and responses for up to 30 days for abuse monitoring; never used for training |
| Sub-processors | Live register; changes announced 30 days ahead, with a right to object |
| Breach notification | Within 24 hours of AUVY becoming aware |
| Deletion | Within 30 days after the contract ends; backups rotate out after a further 30 days |
| Audits | Once a year with 20 business days' notice, or on specific cause |
| Professional secrets (§ 203 StGB) | Only after written activation, for enterprise customers |
Contact
Privacy: privacy@auvy.ai · Security: security@auvy.ai