Privacy Policy

1. Controller

The controller for the data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

These details are taken from the existing imprint of this website. Please verify they are current before publishing.

Data protection officer: [Insert name and contact details — or delete this paragraph if no DPO has been appointed]

2. At a glance

This website is deliberately lean. So you do not have to read the whole document, here is the essence:

• We set no cookies and use no web tracking and no analytics services.
• Simply viewing the pages creates server log files containing your IP address.
• As soon as you actively do something — submit the contact form, write or speak to the chat assistant “Peter”, start the AI avatar or call us — your input is transferred to AI providers in the USA.
• Chat and phone content is forwarded to the operator (Telegram/WhatsApp, or a call note). Please do not enter sensitive data there.
• Phone calls are not recorded by default; however, a call note containing your phone number and name is stored.

3. Hosting and server log files

This website runs on a server operated by Host Europe GmbH. According to our check, the server is located in Strasbourg, France (European Union). No content delivery network (e.g. Cloudflare) is placed in front of it.

On every request the web server automatically records:

• your full IP address (IP anonymisation is currently not enabled),
• date and time of the request,
• the requested address and the HTTP status code,
• the amount of data transferred,
• the previously visited page (referrer) and the browser/device identifier (user agent).

The server software also compiles access statistics from these logs. The data serves secure, stable operation and troubleshooting and is not merged with other data sources.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
Retention: [Insert the concrete log file retention period]

4. Cookies and local storage

This website sets no cookies — neither first-party nor third-party, neither for analytics nor for advertising. A cookie banner is therefore not required.

Only the following values are stored in your browser's local storage. They do not leave your device and are not transmitted to us:

You can delete these values at any time via your browser settings.

5. Web fonts (Google Fonts)

For its typography this website loads the “Inter” font from the servers fonts.googleapis.com and fonts.gstatic.com. In doing so your IP address is transmitted to Google; a transfer to the USA cannot be ruled out.

Legal basis: Art. 6(1)(f) GDPR (consistent presentation).
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and/or Google LLC, USA.

Note to the operator: Embedding Google Fonts from Google servers is legally contested. Self-hosting the font files removes this transfer entirely and is recommended.

6. Contact form

You can send us an enquiry via the form at /kontakt or /contact.

Mandatory fields: name, company, business e-mail address, desired solution and your consent.
Optional fields: phone number, country, company size, preferred language, preferred date and your message.

What happens to your input:

• It is sent as an e-mail via our own server — to peter@davinci-ai.de and additionally to a Gmail mailbox of the operator (davinciai24@gmail.com). This second copy means your details are also processed by Google.
• In parallel, a notification containing all form content is sent via Telegram to the operator's account and — where the service is active — additionally via WhatsApp through a relay service we operate.
• Your e-mail address, any phone number you provide, your company and your request are additionally recorded in a log file on our server.

Spam protection: The form contains an additional field invisible to you (honeypot) and limits submissions per IP address (8 per hour). The IP address is held only briefly in memory for this and is not stored.

Legal basis: Art. 6(1)(a) GDPR (the consent you give in the form) and Art. 6(1)(b) GDPR (pre-contractual steps).
Retention: [Insert retention period for contact requests and the log file]

7. AI chat assistant “Peter”

An AI assistant called “Peter” is available on the pages of this website. It is an AI system, not a human being.

Processing of your input: Your message is transmitted via our server to Anthropic, where it is answered by the language model Claude Haiku. Anthropic PBC is based in the USA.

What we store:

• The conversation history is kept on our server in memory only (the last six exchanges) and discarded at the latest two hours after your last message. The chat is not persistently stored there.
• However: for every answered question a notification is sent to the operator — via Telegram and, where active, via WhatsApp. It contains your question (truncated to 500 characters) and Peter's answer.
• If your message contains an e-mail address or phone number, it is detected automatically and stored permanently in a log file on our server.
• Peter is also instructed to politely ask during the conversation for your company name and a way to contact you so we can reach you. Providing this is voluntary.

Please note: Do not enter health data, credentials, trade secrets or other confidential information into the chat. The assistant's answers are provided without warranty and are no substitute for legal, medical or investment advice.

Legal basis: Art. 6(1)(a) and (f) GDPR — using the chat is voluntary; legitimate interest in customer communication and handling enquiries.
Retention: conversation history max. 2 hours; detected contact data and notifications: [insert period]

8. Speech input in the chat

The chat assistant offers speech input. If you use it, your browser records a short audio clip — after you have granted microphone access.

• The audio is transmitted to our server and from there to OpenAI, where it is converted to text using the Whisper speech recognition model. OpenAI processes the data in the USA.
• On our server the audio is held only transiently in memory and is not stored.
• The recognised text is then treated like a normal chat message — section 7 applies, including forwarding to the operator.

Legal basis: Art. 6(1)(a) GDPR. Speech input only happens when you actively trigger it.

9. Talking AI avatar

A button starts a talking AI avatar. It is loaded in an embedded window from our subdomain chat.davinci-ai.ai; the session itself runs at the provider LiveAvatar (api.liveavatar.com).

• The avatar runs in so-called full mode: speech recognition, language model and speech output are handled by the provider. Your microphone signal and the conversation content are transmitted to the provider.
• A session is technically limited to five minutes.
• The access token is requested by our server; our API key is not passed to your browser.

Legal basis: Art. 6(1)(a) GDPR — the avatar only starts if you actively open it and grant microphone access.
Provider, server location and retention: [add legal entity, location and retention period of the avatar provider]

10. AI phone assistant

Calls to +1 (971) 257-6411 are answered by an AI phone assistant. You are speaking to an AI system, not to a human being. We will confirm this at any time on request.

Providers involved: The telephone connection is provided by Twilio; the spoken dialogue runs on the real-time speech model of OpenAI. Both process the data in the USA. For knowledge retrieval, text passages are embedded as vectors at OpenAI.

What data is generated:

• Your phone number in international format, time, duration, direction and status of the call, plus a call identifier.
• Name and company, insofar as you state them during the call — the assistant actively asks for them.
• A call note containing your request, the key points, the detected language and any transfer target. This note contains your full, unmasked phone number.
• A contact record keyed by your phone number, summarising name, company, language, last request and the number of your calls — so the assistant is aware of earlier conversations when you call again.
• Call metrics (e.g. duration, number of turns, transfers) for quality improvement, plus audit records of transfers and write operations.
• Callback requests and messages you leave.

Recording: Calls are by default neither recorded as audio nor fully transcribed. Both are technically switched off and are only enabled after your explicit consent during the call. What is stored is the structured note described above.

Data minimisation: Phone numbers are masked in technical logs. In the call note to the operator the number is deliberately stored in full so that a callback is possible.

Retention periods configured in the system:

These periods are set in the configuration but have not yet been legally fixed and justified.

Do-not-call list: On request we add your number to a suppression list; outbound calls and callbacks to that number are then blocked.

Erasure: Your telephony-related data can be deleted specifically by your phone number. An informal message to info@davinci-ai.de is sufficient.

Legal basis: Art. 6(1)(b) GDPR (handling your request) and Art. 6(1)(f) GDPR (legitimate interest in traceable handling and callbacks).

11. Embedded media and external links

Video and audio content (demo video, background music) is served from our own server. No video platforms such as YouTube or Vimeo are embedded.

The website links to our own and affiliated services — among them geoscan.davinci-ai.de, trading.davinci-ai.de, ai-doctor.ai and ai-anwalt.ai. Once you follow a link, the privacy policy of that service applies.

12. Recipients and processors

We do not pass your data on for advertising purposes and do not sell it. To provide the functions described, the following service providers are involved:

Data processing agreements under Art. 28 GDPR must be concluded and/or documented with all providers listed.

13. Transfers to third countries

As described above, chat, speech, avatar and telephony data is transferred to providers in the United States. Under data protection law the USA is a third country without a general adequacy level; in particular there is a risk of access by US authorities.

Basis for the transfer: [Insert per provider: standard contractual clauses under Art. 46 GDPR and/or certification under the EU-US Data Privacy Framework; add a transfer impact assessment]

Using the chat, speech input and avatar is voluntary. If you wish to avoid this transfer, please use the contact form or simply send us an e-mail.

14. Your rights

Under the GDPR you have the following rights towards us:

• Access to the data we process about you (Art. 15).
• Rectification of inaccurate data (Art. 16).
• Erasure (Art. 17) — telephony-related data can be deleted specifically by your phone number.
• Restriction of processing (Art. 18).
• Data portability (Art. 20).
• Withdrawal of consent with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): Where we process data on the basis of a legitimate interest — in particular the server log files, the call notes of the phone assistant and the notifications to the operator — you may object at any time. We will then stop processing the data unless we can demonstrate compelling legitimate grounds. An informal message to info@davinci-ai.de is sufficient.

To exercise your rights, a message to info@davinci-ai.de is enough. We will respond within the statutory period of one month.

Right to lodge a complaint: You may complain to a data protection supervisory authority. The authority likely responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 27, 91522 Ansbach, Germany. Please confirm competence.

15. Security

The website is only accessible over an encrypted connection (HTTPS/TLS). Access keys for the AI services used are stored exclusively on the server and are never passed to your browser. The interfaces are rate-limited against bulk requests.

Transmitting data over the internet can in principle have security gaps; complete protection against access by third parties is not possible.

16. Automated decisions, minors, changes

Automated decision-making: No automated decision within the meaning of Art. 22 GDPR that produces legal effects concerning you takes place. The AI assistants provide information and record requests; they do not make binding decisions for you and are no substitute for medical, legal or investment advice.

Minors: Our service is aimed at businesses, not at children. We do not knowingly collect data from persons under 16.

Changes: We update this privacy policy when the processing described here changes. The version published on this page is the authoritative one.

Contact for data protection matters: info@davinci-ai.de