Product Privacy Notice

AUVY — In-Product

AUVY GmbH · Am Haag 8 · 82166 Gräfelfing · HRB 311039 (AG Munich) · VAT ID DE461400892

Data protection: privacy@auvy.ai · Security: security@auvy.ai · General: contact@auvy.ai

Version: 1.0 · Last updated: 2026-09-28

Application to consumer customers (B2C): In contracts with consumers within the meaning of § 13 German Civil Code (BGB), no processor relationship exists. AUVY is controller within the meaning of Art. 4 No. 7 GDPR for all personal data processed in that context — including content the consumer brings into their personal workspace. The purposes, legal bases, retention periods, recipients and data subject rights described below apply accordingly; this Notice replaces the DPA as the sole basis of processing. Professional secret-holder data (§ 203 German Criminal Code) remains prohibited for consumer contracts (see § 6).

§ 1 Purpose of this Notice

This Privacy Notice informs you under Art. 13 and 14 GDPR about the processing of personal data by AUVY GmbH ("AUVY") when you use AUVY as an end user of your workspace.

This notice applies in addition to the General Terms and Conditions – AUVY and the DPA; in case of conflict, the individual contractual provisions prevail.

§ 2 Controller and Contact Details

The controller for the processing activities described in this notice is:

AUVY GmbH · Am Haag 8 · 82166 Gräfelfing · Germany

Represented by managing directors Achim Ströbel and Patrick Schröppel.

• Data protection: privacy@auvy.ai

• Security: security@auvy.ai

• General: contact@auvy.ai

We have not currently appointed an external Data Protection Officer.

§ 3 Role Allocation in Detail

Data category	AUVY role	Legal basis
Workspace content, prompts, uploaded files, AI outputs ("Customer Data")	Processor for B2B workspaces; controller for B2C consumer workspaces and for personal workspaces one of AUVY's apps creates	DPA (B2B) or this notice (B2C, personal workspaces)
Account master data (name, email, workspace role)	Controller	this notice
Authentication, session tokens	Controller	this notice
Billing and contract data	Controller	this notice
Security, audit and diagnostic logs for platform operation	Controller	this notice
Telemetry on platform stability (pseudonymized)	Controller	this notice
Product usage analytics (pseudonymized, first-party)	Controller	this notice

The following sections describe exclusively processing activities in which AUVY is the controller. For processing of Customer Data, the DPA applies.

§ 4 Processing Activities and Legal Bases

§ 4.1 Account Creation and Authentication

• Data: name, email address, password hash, workspace membership and role, Better Auth session and sign-in metadata, and MFA / WebAuthn factors where enabled.

• Purpose: service provision, access control, identity verification.

• Legal basis: Art. 6 (1)(b) GDPR (contract performance) and (f) GDPR (legitimate interest in secure authentication).

§ 4.2 Workspace Administration

• Data: workspace name, memberships, roles, settings, license assignments.

• Purpose: configuration and administration of the customer workspace.

• Legal basis: Art. 6 (1)(b) GDPR.

§ 4.3 AI Inference and Customer Data Processing

Substantive AI inference on Customer Data takes place under processor terms; insofar, the Customer is controller and AUVY is processor (see DPA).

For operational telemetry of the inference pipeline (latencies, model routing, errors), AUVY collects pseudonymized metadata as controller to ensure service operation (Art. 6 (1)(f) GDPR). Content itself is not part of this telemetry.

To understand and improve how AUVY is used, AUVY records product usage events (for example that a session was active, a feature was used, or onboarding was completed) linked to the account ID, as controller (Art. 6 (1)(f) GDPR). These events are processed only on AUVY-operated infrastructure in Helsinki — no third-party analytics provider, advertising identifier, IP address, or workspace content is involved — and are deleted after 90 days.

§ 4.4 Security and Audit Logs

• Data: login events, authentication successes/failures, geo-IP, user agent, security-relevant actions (workspace settings, role changes, token creation).

• Purpose: protection against unauthorized access, traceability, fulfillment of security obligations toward customers.

• Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in security) in conjunction with Art. 32 GDPR.

§ 4.5 Billing and Contract Administration

• Data: contractual party master data, invoice data, payment records, acceptance logs of GTC/AUP versions.

• Purpose: invoicing, tax obligations, evidence of GTC inclusion.

• Legal basis: Art. 6 (1)(b) GDPR (contract performance), (c) GDPR (statutory obligations, in particular § 14 UStG, §§ 147 AO, 257 HGB).

• Payment processing: Stripe Payments Europe Ltd., Ireland.

§ 4.6 Support and Communication

• Data: content of your inquiries, contact details, possibly workspace IDs for reproduction.

• Purpose: processing of support requests.

• Legal basis: Art. 6 (1)(b) and (f) GDPR.

§ 4.7 Product Improvement

• Data: exclusively anonymized and aggregated usage statistics (e.g., number of active sessions, feature usage).

• Purpose: stability and further development of the platform.

• Legal basis: Art. 6 (1)(f) GDPR.

• Important: Customer Data is not used for product improvement or training purposes (see § 5).

§ 4.8 Apps and Integrations

(1) AUVY's own apps. Outeva and AUVY's other apps are brands of AUVY GmbH, not third parties. What they process in a workspace, AUVY GmbH processes: under the DPA for business customers, otherwise under this notice.

(2) Account through an app. When you sign in to an app with "Sign in with AUVY", the app learns who you are: your name, email address and AUVY account. If one of AUVY's apps creates a personal workspace for you at that point, AUVY GmbH is the controller for its content. The app sees only its own areas in that workspace. If an app creates a workspace for your organisation, your organisation is the controller for its content and AUVY processes it under the DPA. What the app itself processes outside AUVY is described in the app's own privacy notice.

• Purpose: signing in to the app, creating the workspace and installing the app.

• Legal basis: Art. 6 (1)(b) GDPR (contract performance).

(3) Integrations and third-party apps. When you enable integrations or apps from other providers in the workspace, AUVY processes connection metadata, OAuth tokens, and tool request/response payloads needed to run them. The other provider may process data under its own terms as an independent recipient.

• Purpose: provide integrations and apps you explicitly enable in the workspace.

• Legal basis: Art. 6 (1)(b) GDPR (contract performance) and, where applicable, Art. 6 (1)(a) GDPR (consent during OAuth).

• Recipients: the connected service and infrastructure required to operate the integration (see subprocessors register). Destination systems you enable act as independent recipients under your control.

§ 4.9 Website Visits and Access Requests

(1) Visiting AUVY websites. The product and auvy.ai, www.auvy.ai, trust.auvy.ai and docs.auvy.ai run on AUVY-operated servers in Helsinki. When you open one, the server processes the technical data your browser sends so the page can be delivered: IP address, date and time of the request, requested URL, referrer URL and browser/user agent.

• Purpose: delivering the pages, protecting them against misuse, and diagnosing errors.

• Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in a secure, working website).

• Recipient: Hetzner Online GmbH as hosting processor in the EU (Helsinki; see § 7).

• Retention: the data is processed only for the duration of the request. AUVY keeps no access logs for these websites and does not use this data to identify visitors.

Some websites of individual AUVY GmbH brands run at Vercel Inc. There, Vercel processes the same technical data as AUVY's processor, and data may reach the USA (§ 8).

The websites use no analytics or advertising cookies and load no third-party tracking scripts. auvy.ai stores your language choice in the auvy-locale cookie when you switch language; sign-in cookies for docs.auvy.ai and other signed-in sites are covered in § 4.1 and the Cookie policy.

(2) Access requests. If you request private security documentation with the Trust Center form, AUVY processes your work email, company name, your message and the requested document.

• Purpose: answering your request, sending you a confirmation email and, where applicable, preparing an NDA or a security review.

• Legal basis: Art. 6 (1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6 (1)(f) GDPR (legitimate interest in answering business enquiries).

• Recipients: AUVY sends the emails through its own mail service, OpenPulse Mail, and Resend Inc. delivers them as processor (see § 7); the request is received in AUVY's security mailbox.

• Retention: as long as needed to handle the request; where the exchange becomes commercial or business correspondence, the periods in § 9 apply.

Providing this data is voluntary. Without a work email address we cannot answer the request.

(3) Contact form. If you write to us with the contact form on auvy.ai or auvy.de, AUVY processes your name, your email address, optionally your company, your message, the page language and the page you came from.

• Purpose: answering your message and keeping the conversation that follows from it.

• Legal basis: Art. 6 (1)(b) GDPR where your message concerns a possible contract, otherwise Art. 6 (1)(f) GDPR (legitimate interest in answering enquiries).

• Recipients: Resend Inc. delivers the message as processor to the contact@auvy.ai mailbox (see § 7). AUVY also keeps the message in its own customer relationship system on servers of Hetzner Online GmbH in the EU.

• Retention: as long as needed to handle it; where the exchange becomes commercial or business correspondence, the periods in § 9 apply.

Providing this data is voluntary. Without a name, an email address and a message we cannot answer. Please do not send confidential documents through the form.

§ 5 AI-Specific Processing

(1) No training on customer data. AUVY does not use Customer Data or AI outputs to train or fine-tune own or third-party AI models.

(2) Contractual assurances by model providers. AUVY uses AI models via AWS Bedrock, Microsoft Azure, Google Vertex AI, and other model providers identified in the Trust Center subprocessor register. Providers process under their applicable contracts and DPAs; submitted content is not designated for model training where covered. This is not a blanket assurance about customer-selected destinations.

(3) Web tools. Product web_search / web_read use Linkup (EU). Only data needed for the active tool call is sent. See register v1.0.

(4) AI inference retention. Amazon Bedrock stores no requests. Microsoft may keep Azure OpenAI prompts and responses for up to 30 days for abuse monitoring. Google may cache inputs in memory for up to 24 hours. Annex 3 to the DPA governs.

(5) Transparency under Art. 50 EU AI Act. Article 50 has applied since 2 August 2026. AUVY handles provider duties for covered AUVY direct-interaction systems, including informing users that they are interacting with AI unless obvious. A business customer acting as deployer remains responsible for deployment-specific notices, including covered emotion-recognition or biometric-categorisation notices and disclosure of deepfakes or certain AI-generated public-interest text. For consumer workspaces, AUVY remains controller for the consumer context described above.

(6) Machine-readable provenance. Where Article 50 (2) applies to AUVY in a provider role, AUVY must implement technically feasible marking and detection measures for covered synthetic content. Marks can be removed or degraded by copying, editing, conversion, screenshots, or downstream tools and do not prove factual accuracy or authorship. AUVY does not claim that every output has persistent machine-readable provenance.

(7) Prohibited and high-risk AI. AUVY may not be used for prohibited practices under Article 5 and is not approved by default for high-risk uses under Annex III; see AUP § 6.

(8) AI literacy. AUVY takes role-appropriate AI-literacy measures for personnel who operate and support AI features. Business customers retain corresponding obligations for persons acting on their behalf. This is not a blanket compliance claim for a customer's deployment.

§ 6 Professional Secret-Holders and Special Data Categories

(1) Input of special categories of personal data within the meaning of Art. 9 GDPR by the Customer is permitted only if the Customer has a valid legal basis and AUVY has been informed in advance (see AUP § 7).

(2) Processing of professional secret-holder data within the meaning of § 203 of the German Criminal Code (in particular data of clients, patients or comparable entrustors of physicians, attorneys, tax advisors, notaries, psychotherapists) is permitted in AUVY only if the Customer has requested activation under § 12 of the AVV (DPA / Annex A) and AUVY has confirmed it in text form. AUVY confirms only once the obligations of employees and sub-processors required under § 12 (2) of the AVV are in place.

Activation is available to customers on a Business or Enterprise contract. The owner requests it in the workspace or in text form to privacy@auvy.ai. Until AUVY has confirmed, the input of professional secret-holder data is prohibited.

§ 7 Recipients and Sub-Processors

(1) For the operation of AUVY, AUVY engages the following sub-processors — both for Customer Data (in processor capacity) and for controller data (data processing in the strict sense under Art. 28 GDPR):

Provider	Purpose	Location
Hetzner Online GmbH	App services, workers, and self-hosted stores (PostgreSQL, MongoDB, Redis, Qdrant, object storage)	EU (Helsinki)
Amazon Web Services EMEA SARL	AI models and compute (Bedrock, EU cross-region routing)	EU (Frankfurt, Stockholm, Ireland, Paris, Milan, Spain)
Microsoft Ireland Operations Ltd.	AI models and compute (Azure OpenAI, Azure AI Foundry); speech-to-text	EU (Frankfurt, Sweden)
Google Cloud EMEA Limited	AI models and compute (Vertex AI: Gemini models and text embeddings)	EU (Netherlands)
Linkup SAS	Product web_search / web_read (web search and page contents)	EU
Stripe Payments Europe, Ltd.	Payment processing, tax logic	EU (Ireland)
Resend Inc.	Delivery of the transactional email (login, confirmations) AUVY sends through OpenPulse Mail; receipt of email sent to project addresses	EU (Ireland)

(2) OpenPulse and Outeva are brands of AUVY GmbH and run on AUVY's servers in Helsinki, so they are not sub-processors. AUVY sends its system email through OpenPulse Mail, and Resend Inc. delivers it. Customer-selected destinations and third-party apps are independent recipients under the customer's control.

(3) The current list with update date is available at trust.auvy.ai/subprocessors (register v1.0, 2026-09-28). “Optional” means data is sent only when the relevant configured feature/path is invoked. Changes are announced at least 30 days in advance; rights to object follow the DPA. Public version history: trust.auvy.ai/changelog.

(4) Disclosure to authorities occurs only in case of mandatory legal obligation.

§ 8 Third-Country Transfers

Where personal data is transferred to third countries, AUVY relies on:

• the EU-US Data Privacy Framework, where the respective provider is certified;

• the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) under Module 2/3;

• supplementary technical and organizational guarantees (encryption, access restrictions, EU region pinning where offered).

Copies of relevant safeguards are available via privacy@auvy.ai.

§ 9 Retention Periods

Data category	Retention
Identity and account master data	while the user account exists; erased or anonymized after a valid identity-erasure request where no legal grounds require retention. Identity erasure does not automatically delete a shared workspace.
Authentication tokens	only as long as the session is active; max. according to expired token lifetime
Customer Data (workspace content)	as per DPA for B2B; export and owner-authorized workspace deletion in product; final deletion generally 30 days after workspace contract termination. Removing one member or identity does not automatically delete content controlled by the remaining workspace.
Security / audit logs	typically 12 months; security-relevant case-by-case extension
Telemetry / diagnostics	pseudonymized; up to 90 days person-relatable, then aggregated/anonymized
Accounting vouchers and invoices	generally 8 years under German commercial and tax law
Annual accounts, inventories, commercial books, comparable accounting records	may be 10 years
Commercial and business correspondence	generally 6 years
Contract and acceptance evidence	category- and purpose-based; extensions apply where tax, audit, litigation, limitation, or other law requires

§ 10 Security Measures

AUVY takes appropriate technical and organizational measures, in particular:

• TLS 1.2+ in transit · AES-256 (or equivalent) at rest for production volumes;

• RBAC, logical tenant separation, Better Auth session controls, and customer MFA / WebAuthn where enabled;

• daily encrypted backups of the Mongo document / trace plane (Postgres / identity backup operated separately);

• workspace audit logs for security-relevant product actions;

• contractual incident notification paths under Art. 33 GDPR and the AVV.

Full TOMs see AVV, Annex 2.

§ 11 Your Rights as a Data Subject

(1) Where AUVY is controller (see § 3), you have the following rights:

• access (Art. 15 GDPR),

• rectification (Art. 16 GDPR),

• erasure (Art. 17 GDPR), insofar as no retention obligations preclude this,

• restriction of processing (Art. 18 GDPR),

• data portability (Art. 20 GDPR),

• objection to processing based on legitimate interests (Art. 21 GDPR),

• withdrawal of granted consent with effect for the future (Art. 7 (3) GDPR).

(2) Where AUVY is processor (Customer Data), please contact your workspace administrator or the contractual party of your company that, as controller, processes the request. AUVY supports the controller under Art. 28(3) GDPR.

(3) Requests directly to AUVY: privacy@auvy.ai. To protect against abuse, we may request additional identity verification.

(4) An identity/account erasure request and a workspace-deletion request have different effects. AUVY can erase or anonymize the requesting person's controller data where legally possible. A shared B2B workspace remains under the organisational controller and is deleted only on an authorised workspace instruction or at the end of the workspace contract.

§ 12 Right to Lodge a Complaint

Notwithstanding other legal remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular the authority competent at AUVY's seat:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)

Promenade 18 · 91522 Ansbach · lda.bayern.de

§ 13 Automated Decisions

AUVY does not make solely automated decisions with legal or similarly significant effect within the meaning of Art. 22 GDPR toward end users in the AUVY product. AI-generated outputs are non-binding suggestions; their use is the Customer's responsibility; see GTC § 14.

§ 14 Changes to this Notice

AUVY adapts this notice when legal frameworks or processing activities change. Material changes are announced at least 30 days in advance via email or in-product.

§ 15 Contact

• Data protection inquiries: privacy@auvy.ai

• Security reports: security@auvy.ai

• General: contact@auvy.ai