Privacy policy

1. Controller

Kahlstorf GmbH, represented by its managing director Dr. Jürgen Tiedge,
Kuchelweg 10, 22605 Hamburg, Germany. Hamburg local court, HRB 201799.
E-mail: info@clever-ai.org · Telephone: +49 172 4032674.

2. What data we process

a) Sign-in by e-mail link (magic link / OTP)

To sign in you enter your e-mail address; we send you a one-time sign-in link. Processed are: e-mail address, sign-in times, technical session characteristics. No password is collected.

a2) Sign-in with Google or Microsoft

Alternatively you can sign in with an existing Google or Microsoft account. In doing so, the chosen provider transmits to us your e-mail address, the confirmation of the sign-in and a technical identifier; we do not receive a password. The provider can see that you are signing in to CLEVER. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract, or the usage agreement). The privacy notices of Google Ireland Ltd. and Microsoft Ireland Operations Ltd. apply in addition.

b) Use of the application

The role selected within the demo or beta, your entries and the views you open, insofar as required for operation.

c) Server and log data

When the site is accessed, technically necessary data arises (IP address, time, requested resource, browser type), among other things for delivery and to prevent misuse.

d) Local storage

We use your browser's local storage (localStorage) for functional purposes (for example language, session). No tracking or advertising cookies are set.

e) Communication by e-mail and video conference

For e-mails to and from addresses under clever-ai.org, and for video conferences, we use Microsoft 365 (Exchange Online, Microsoft Teams). Processed are: name, e-mail address, content and attachments of messages, times, and for meetings additionally display name, audio, video and chat content as well as technical connection data. Meetings are recorded only after all participants have been informed in advance.

f) Booking an appointment via the website

You can choose a time for a conversation via the website. For this you provide name, e-mail address and company, optionally a message; in addition the chosen time and your consent are processed. Providing this is voluntary. Alternatively you can reach us through the contact form or by e-mail. The appointment is stored in a calendar in Microsoft 365 (Exchange Online); the invitation to your e-mail address is sent from there on our behalf and may contain a link to Microsoft Teams. When free times are displayed, only whether a slot is taken is queried; content of other appointments is not shown. To prevent misuse, your connection address is counted briefly in memory and not stored.

3. Purposes and legal bases

• Providing sign-in and the application — Art. 6(1)(b) GDPR (steps prior to entering into a contract / usage relationship).
• Security, stability, prevention of misuse — Art. 6(1)(f) GDPR (legitimate interest in secure operation).
• Contact via the help form — Art. 6(1)(b) or (f) GDPR.
• Communication by e-mail and video conference — Art. 6(1)(b) GDPR insofar as it concerns a contract or its initiation; otherwise Art. 6(1)(f) GDPR (legitimate interest in communicating with interested parties and business partners).
• Booking an appointment via the website — Art. 6(1)(a) GDPR (consent). You may withdraw your consent at any time with effect for the future, informally to info@clever-ai.org; the lawfulness of processing carried out until then remains unaffected.

4. Processors and recipients

We use carefully selected service providers with whom data processing agreements (Art. 28 GDPR) are in place:

For booking appointments (section 2 f) we use Microsoft 365 (Exchange Online, Microsoft Teams) from Microsoft Ireland Operations Ltd., Dublin, as listed in the table. Appointment, name, e-mail address, company and message are held in the calendar and in the invitation e-mail. The data is processed within the EU data boundary; a transfer to the USA is possible in individual cases, based on the EU-US Data Privacy Framework and standard contractual clauses (SCC).

The uploaded contract texts are transmitted to Anthropic for analysis. They are processed there solely to answer the respective request and are not used to train models.

For transfers to the USA we rely on EU standard contractual clauses or applicable adequacy mechanisms.

5. Retention period

We store personal data only for as long as it is required for the stated purposes or as long as statutory retention obligations exist. Test and beta accounts and the associated data are deleted after the test phase has ended, or on request. Appointments and the associated details remain stored for as long as they are required for the business relationship or because of statutory retention obligations; on request they are deleted (section 6).

6. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). An informal message to info@clever-ai.org is sufficient to exercise them. You also have the right to lodge a complaint with a data protection supervisory authority.

7. No automated decision with legal effect

CLEVER's risk assessments are decision aids. No automated decision within the meaning of Art. 22 GDPR is taken in respect of you; decisions are always made by the users themselves.