Draft: this legal text has not been reviewed yet.

Privacy policy

Service provider

Union Finance GmbH
Elsenfelder Straße 32, 63906 Erlenbach am Main, Deutschland

Data processed

Account names, email addresses, authentication data, chats, website versions, uploaded images and usage records support the service. Server/security logs may include IP addresses, request times and technical errors.

Purposes and legal bases

GDPR Article 6(1)(b) may apply to accounts and requested services; Article 6(1)(f) to proportionate security interests; Article 6(1)(c) to legal obligations. Additional consent-based processing must be explained and consent obtained under Article 6(1)(a).

AI and microphone

Messages and task-relevant content may be transmitted to configured OpenAI or Anthropic providers. Microphone access is requested when you start recording. Finished audio is sent to the server and configured OpenAI speech service for transcription. Cancelling a recording does not send a transcription request. Avoid unnecessary or sensitive personal data.

Recipients and international transfers

AI providers and hosting/database services may receive data. Hosting providers and regions, processing agreements, subprocessors and safeguards for transfers outside the EEA still require confirmation. Naming a provider does not establish lawful transfer safeguards.

Cookies and retention

Authentication, language and theme preferences use cookies or similar storage. AIVROM stores your separate Analytics and advertising choices in the versioned aivrom_consent cookie for 180 days, shared by the website and customer panel. Other retention/deletion periods for chats, sites, audio, security and billing data are not finalized.

Your rights

Subject to applicable conditions, you have rights of access, rectification, erasure, restriction, portability and objection. You can withdraw consent prospectively and complain to a competent data protection authority. Contact the controller using the details below.

Business customer data

If you upload personal data about customers or employees, controller/processor roles and any required processing agreement must be determined separately. This policy does not replace a data processing agreement.

Optional Google Analytics

Only after your consent and when configured, the website and customer panel use the same Google Analytics 4 stream. The Google script is not loaded before consent; no denied-consent or cookieless pings are sent. Google receives sanitized page addresses, fixed non-personal page labels, device/browser information and successful email registration/login events. Query strings, fragments, account identifiers, names, email, phone, brief, agent messages and customer content are not included in our events. Chats, settings, admin and customer previews are excluded. Google processes technical network data, including the connection IP address. Google signals and Google advertising personalization are disabled.

Changing Analytics consent

Use Cookie preferences on the website or panel to reject or withdraw Analytics permission. Withdrawal unloads the measuring context, stops future measurement and clears Analytics cookies under our control. Your choice is shared across the configured website and panel domains; open tabs observe cookie changes, regularly recheck the preference and recheck when brought into focus. Previously transmitted data is not withdrawn automatically. Google processing agreements, international-transfer safeguards and GA4 property retention settings still need confirmation; this draft does not certify legal compliance.

Optional Meta and TikTok pixels

Each configured provider needs its own explicit advertising permission. Only public marketing PageViews are sent with cleaned URLs without query strings or fragments and fixed titles. Panel, chats, previews and private pages are excluded. We do not send form content, account IDs or contact details. Automatic matching and automatic event collection must be disabled before activation. Providers receive technical connection data including IP addresses. Withdrawal stops measurement and clears first-party pixel cookies under our control (_fbp/_fbc, _ttp, ttclid, ttcsid variants). AIVROM cannot delete third-party cookies or previously transmitted data. Provider contracts, transfer safeguards and retention settings require review; this remains a legal draft. TikTok first-party cookies and enhanced data postback are disabled. Existing TikTok first-party cookies are removed; our measuring context blocks new writes. Automatic events and advanced matching remain off. Only manually requested, sanitized public PageViews are sent after separate provider consent.

LinkedIn Insight Tag

LinkedIn Insight Tag measures only permitted public marketing page visits after separate LinkedIn advertising consent. Enhanced Matching, form/click collection and signup, trial or purchase conversions are not enabled. Withdrawing consent stops requests and clears accessible LinkedIn first-party cookies. Technical connection data, including IP addresses, can be received by LinkedIn; provider terms, transfers and retention still require legal review.