Draft, as of 19 October 2026. This translation is for information only; the German version is binding. Complete and have it legally reviewed before publication.
1. Controller
[Name of the company or person]
[Street and house number]
[Postcode and town]
Email: [email protected]
Data protection officer: [Name and contact, if appointed; otherwise delete this paragraph]
2. In brief
- This website does not load any content from third-party servers and does not use any analytics or advertising tools.
- The platform sets only one cookie: for login.
- For AI answers, we transmit inputs to our AI provider Anthropic.
- We do not use our customers’ content to train AI models.
3. Visiting the website
When you visit a page, our server processes technically necessary data: IP address, time, the address requested and information from your browser. For login, the contact form, the website chat and webhooks, we keep the IP address in memory for no more than about two minutes in order to limit excessive requests from the same address. Our software does not write access logs. [If an upstream web server or hosting provider writes access logs: add provider and retention period]
The legal basis is our legitimate interest in a secure and functional service (Art. 6(1)(f) GDPR).
4. No third-party content, no analytics
The fonts, scripts and images of this website are stored on our own server. We do not use any audience measurement tools, advertising pixels or social media plugins. More on this under Cookies.
5. Contact form and email
When you write to us, we process your name, email address, company and message in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if a contract is concerned, otherwise our legitimate interest in answering (point (f)). We store enquiries in our database and delete them [period, e.g. six months after the enquiry is closed] unless there is an obligation to retain them. Emails are processed by [email provider].
6. Account and platform
For an account, we process name, email address and password. We store the password only as a secure hash (scrypt). In the workspace, we store the content you create: agents, knowledge sources, conversations, flows and their runs, projects, documents of the tools, team members with roles, API keys (only as a hash) and a change log. The legal basis is the contract with you (Art. 6(1)(b) GDPR).
Where you process data of other persons in the platform, for example of your visitors in the website chat, you are responsible for this. In that case we act as a processor pursuant to Art. 28 GDPR; details are governed by the data processing agreement.
7. AI processing
So that agents and flows can answer, we transmit the respective input, the agent’s instructions and relevant passages from the knowledge to Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA. Anthropic processes the data as our processor. We base the transfer to the USA on [the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework – check against the current contract with Anthropic before publication].
Under Anthropic’s commercial terms, data transmitted via the API is not used to train the models by default. [Add retention period at Anthropic according to the current contract]
Without stored access to Anthropic, KI.ordo runs in demo mode with sample answers; in that case no data is transmitted to Anthropic.
8. Retrieval of web pages
When you import web pages as knowledge or let agents and flows read web pages, our server retrieves these pages. The operator of the page sees the address of our server, not yours.
9. Payments
For billing, we process billing address, payment details and services booked (Art. 6(1)(b) and (c) GDPR). [Payment service provider, if used, with a link to its privacy notice] We retain invoices for up to ten years in accordance with § 147 AO and § 257 HGB.
10. Recipients
We only pass on data if this is necessary for the service, required by law or you have consented. Our service providers are listed on the Subprocessors page.
11. Retention period
- Login sessions: 14 days or until logout.
- Content in the workspace: until you delete it or until 30 days after the end of the contract.
- Backups: daily; each backup is overwritten after seven days.
- Billing data: in accordance with the statutory periods.
12. No automated decisions
We do not make decisions within the meaning of Art. 22 GDPR that are based solely on automated processing and produce legal effects concerning you.
13. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw consent at any time with effect for the future. To do so, write to us at [email protected].
You can also lodge a complaint with a data protection supervisory authority, for example [the state authority responsible for the provider’s registered office].
Right to object: If we process data on the basis of our legitimate interest, you may object at any time on grounds relating to your particular situation.
14. Security
How we protect data is described in our security policy.
15. Changes
We adapt this policy when our service or the legal situation changes. The version published here at any given time applies.