Data processing

Use of an AI-powered assistant (emeryAI)

1. Supervisor

The provider of this website and the services described below is Elevate GmbH, Infanteriestr. 11a, Building B2, 80797 Munich, Germany (hereinafter „emeryAI“ or „we“).

Contact for privacy inquiries: [email protected]

2. The emeryAI Wizard (Interface)

On this website, we operate an AI-powered assistant from the emeryAI platform. The assistant is based on emeryAI’s brand expertise and allows you to ask questions about our products, services, and offers via text or voice input.

Notice pursuant to Article 50 of Regulation (EU) 2024/1689 (EU AI Act): You are communicating with an automated AI system, not a human employee. The generated responses are based on a language model and, despite careful configuration, may be incorrect, incomplete, or outdated. They do not constitute legally binding information and do not represent medical, legal, or financial advice.

2.1 What data is processed?

Automatically on every call:

• Anonymized IP address (last octet is removed before storage)
• Browser type, device type, screen resolution, language, time zone, referrer URL

During use:

• Your text inputs as well as the AI-generated responses (conversation history)
• Conversation metadata (topic, number of interactions, session duration)

Optional information (only when using the contact form in the assistant):

• Name, Email Address, Phone Number, Company

When using the optional voice feature (Voice Input/Output):

• Audio data for conversion to text – processing only with your explicit, separate consent

2.2 How long will the data be stored?

• Without cookie consent: Session data stored exclusively in the browser (sessionStorage), automatic deletion after 3 hours of inactivity or when closing the browser. After the session ends, you are effectively no longer identifiable (Art. 11 GDPR).
• With cookie consent: Visitor profile is created and stored for 90 days (recognition cookie „emery_visitor_token“).
• Conversation contents in LLM context: Deletion after max. 7 days of inactivity.
• Conversation display (history in the interface): Deletion after another 90 days.
• Form data (leads): 14 months, provided no business relationship is established.

2.3 Cookies and Consent

• Without cookie consent: No permanent cookies, fully usable, no recognition on later visits.
• With cookie consent: The „emery_visitor_token“ cookie (90 days) and local storage entries enable the continuation of previous conversations and personalized response quality. Revocation possible at any time via the interface settings – the cookie and server-side visitor profile will then be deleted.

3. emeryAI Demo Interface

This website also features an interactive product demonstration of emeryAI. The demo shows pre-written conversation flows for demonstration purposes: Your input is not processed using AI, conversation content is not stored, and no cookies are set.

When accessing the demo, technical data is automatically collected by the hosting provider Vercel Inc. (USA), in particular IP address, browser type, and time of access—which is technically necessary for the delivery of the website (Art. 6 para. 1 lit. f GDPR).

4. emeryAI Dashboard (Administration Interface)

The emeryAI Dashboard is the management interface for registered customers and their employees.

Processed data:

• Account data: e-mail address (login via magic link), name and role if applicable
• Customer company data: Company name, address, website URL
• Usage data: access times, executed actions
• Technical data: IP address, browser type, device type

The dashboard uses cookies and local storage entries for session management after login as well as for preferences (e.g., language, workspace selection). Access is protected by magic link login, optional two-factor authentication, and further technical and organizational security measures.

Legal basis: Provision, operation, authentication, and access control are based on Art. 6 para. 1 lit. b GDPR (performance of a contract); IT security measures are based on Art. 6 para. 1 lit. f GDPR (legitimate interest).

Retention period: Account and company data are stored for the duration of the contractual relationship and deleted after termination in accordance with statutory retention periods (typically 6–10 years for tax and commercial documents). Dashboard usage data is deleted after 14 months.

5. Processor

To provide our services, we use the following service providers as processors in accordance with Art. 28 GDPR:

• Google Cloud (Google Cloud EMEA Limited) – EU region: Hosting of the deployed AI language model (Anthropic Claude Sonnet) for the interface assistant, based on a data processing agreement pursuant to Art. 28 GDPR.
• Supabase Inc. (USA, data location Germany): Database, authentication, and Edge Functions (processing logic).
• ElevenLabs Inc. (USA): Speech recognition and speech synthesis – only when using the optional voice feature and only after your separate consent.
• Vercel Inc. (USA, Edge network incl. EU): Application and demo hosting.
• Raidboxes GmbH (Germany): Website hosting (WordPress).
• n8n GmbH (Germany): Workflow automation.

Your inputs will not be used to train the deployed AI language models.

Contracts pursuant to Art. 28 GDPR are in place with all mentioned data processors, ensuring data protection-compliant processing of your data.

6. Transfer to third countries

A transfer of personal data to the USA takes place within the framework of the services of Vercel Inc. (hosting) and – only when using the voice function and after separate consent – ElevenLabs Inc. These transfers are secured by the EU-US Data Privacy Framework (adequacy decision of the EU Commission of July 10, 2023) and/or EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914. You can view the certification of the respective providers at dataprivacyframework.gov.