Privacy Policy

1. Data Controller

The responsible entity for data processing is:
HybridAI GmbH
Im Mediapark 5
50670 Cologne, Germany
Email: datenschutz@hybridai.one

2. Types of Data Processed

We process the following personal data:

• Account data (e.g., names, addresses)
• Contact data (e.g., email, phone numbers)
• Usage data (e.g., visited websites, interest in content)
• Meta-/communication data (e.g., device information, IP addresses)
• Chat histories and interactions with our AI systems

3. Purpose of Processing

We process your personal data for the following purposes:

• Providing our AI chat services
• Improving our services
• Communicating with users
• Fulfilling legal obligations
• Ensuring IT security

4. Legal Bases

The processing of your data is based on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR)
• Contract fulfillment (Art. 6(1)(b) GDPR)
• Legal obligations (Art. 6(1)(c) GDPR)
• Legitimate interests (Art. 6(1)(f) GDPR)

5. Recipients of Data

Your data may be shared with the following recipients:

• Hosting providers (Strato GmbH with Data-Processing Agreement)
• AI service providers (Perplexity, Google, OpenAI, Mistral, Replicate)
• IT service providers (Wordpress, Brevo, ManyChat, N8N, Hubspot)
• Payment service providers (Paypal)
• Clients/end-users of the chat service on their websites

5a. Contractual Data Processing Agreement AI Service Providers

In order to protect the data of our Chat-Bot customers that is being generated and used during training or usage of AI-based models we have signed a contractual data-processing agreement with the AI service providers.

6. Retention Period

We store your personal data only for as long as necessary for the purposes mentioned or as required by legal retention periods. Chat histories are stored for a maximum of 3 months.

7. Your Rights

You have the following rights:

• Access to stored data
• Correction of inaccurate data
• Deletion of data
• Restriction of data processing
• Data portability
• Objection to processing
• Withdrawal of given consents
• Lodging a complaint with a supervisory authority

8. Cookies and Tracking

We use cookies and similar technologies (Google Analytics and PostHog, each with opt-in) for the following purposes:

• Website functionality
• User behavior analysis
• Improving our services

After your consent, PostHog stores both a cookie and an entry in your browser's localStorage (each prefixed with ph_) in order to remember your consent and identification state across page loads. These are removed when you withdraw your consent.

9. Data Security

We implement technical and organizational security measures to protect your personal data against accidental or intentional manipulation, loss, destruction, or unauthorized access.

10. AI-Specific Processing

Our AI chatbots process your inputs to generate personalized responses. This processing is:

• Automated by AI systems
• Based on chat history
• Aimed at providing the best possible answers to your inquiries

11. Embedding on Third-Party Websites

Our chat widget can be embedded by third parties (our clients) on their websites. In such cases:

• Data processing on our clients' websites is their responsibility and subject to their privacy policies.
• We have no direct influence over the type and scope of data processing on our clients' websites.
• Our clients are obligated by our terms and conditions to:
  • Comply with applicable data protection regulations
  • Inform their users about data processing through our widget
  • Obtain necessary consents, if applicable
• For questions regarding data processing on our clients' websites, please contact the respective website operator directly.

12. Use of Google OAuth SSO

We offer the option to log in using your Google account via the OAuth Single Sign-On (SSO) service. This service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

As part of the authentication process, the following data is retrieved from your Google account:

• Your email address

The processing of this data is carried out to simplify the login process and provide our services. The legal basis for this processing is Article 6(1)(b) GDPR (performance of a contract).

Google acts as an independent data controller for the processing of your data within the OAuth process. For more information on how Google processes data, please refer to their Privacy Policy.

If you wish to disconnect your Google account from our service, you can do so at any time in your Google account settings.

13. Use of Google Analytics

Our website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyze how you use the website.

The following data is collected:

• IP address (anonymized if IP anonymization is enabled)
• Visited pages and time spent
• Location data (based on IP address)
• Device type and browser

The processing of this data is based on your consent (Article 6(1)(a) GDPR). The collected data is used to evaluate the use of our website and improve our services.

You can prevent the collection of your data by Google Analytics by installing the opt-out browser add-on provided by Google. For more information, please refer to Google's Privacy Policy.

14. Use of PostHog (Product Analytics and Session Replay)

Our application uses PostHog, a web and product analytics service provided by PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA. We operate the EU instance of PostHog (eu.i.posthog.com); your usage data is processed and stored on servers located in Frankfurt am Main, Germany.

Transfer to a third country: although the data is stored within the EU, PostHog, Inc. is a US-based company. We have concluded the EU Standard Contractual Clauses (Article 46(2)(c) GDPR) and a Data Processing Agreement (Article 28 GDPR) with PostHog to ensure an adequate level of data protection within the meaning of the GDPR.

The following data is collected:

• IP address: on the EU instance of PostHog, IP capture is disabled by default for all new projects. Where it is enabled in the project settings on an exceptional basis, it is used only for geolocation and abuse prevention.
• Pages visited (including the full URL and any query parameters), clicks, and time spent
• Device type, operating system, and browser
• An anonymous device identifier stored in a cookie and in your browser's localStorage
• After you sign in: your user ID, so that usage events can be associated with your account
• After consent and only in screen recordings (Session Replay): layout interactions such as clicks, mouse movements, scrolling, and navigation. All input fields and all rendered text are masked before recording — passwords, chat content, email addresses, and other personal text content are never captured. The visited page URLs (including query parameters) are recorded. Console logs and network metadata are explicitly not captured. The chat widget embedded on customer websites is entirely excluded from Session Replay.

Processing is based on your consent (Article 6(1)(a) GDPR) and is only activated after you accept the cookie banner. Before consent, no cookies or localStorage entries are set for PostHog and no data is transmitted. If you decline consent or withdraw it, capture stops immediately and stored identifiers are cleared locally.

You can withdraw your consent at any time via the cookie settings. For signed-in users, deleting your account additionally triggers deletion of the associated PostHog person record including all linked events (Article 17 GDPR).

Note for non-signed-in visitors: prior to sign-in, your PostHog person identifier is generated locally in your browser and is not known to us in plaintext. To satisfy an access or erasure request from a non-signed-in visitor we need the PostHog person identifier stored in your browser (readable via posthog.get_distinct_id() in the browser console) or another identifying detail.

For more information, please refer to PostHog's Privacy Policy and PostHog's Data Processing Terms.

15. Changes

We reserve the right to adapt this privacy policy to comply with current legal requirements.

16. Contact