Privacy Policy

Last updated: June 2026

Convenience translation. The German privacy policy is the legally binding version.

1. Controller

The controller responsible for data processing on this website and within our service is:

Silas Gehring (zalu.ai)
Unterer Sägerweg 104
75305 Neuenbürg, Germany
Email: info@zalu.ai
Phone: +49 163 3717549

2. Overview

We process personal data in two roles: (a) as the controller for our website and for prospects and customers, and (b) as a processor for our customers when they use our AI support tool and process data of their own end users in doing so (see section 8).

3. Data collected when you visit the website

When you visit our website, server log files are processed automatically (IP address, date/time, page accessed, browser/device information).
Purpose: technical operation and security.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
Retention period: generally 7 days.

4. Cookies & local storage

Our website only sets technically necessary cookies, for example to maintain your login session. We do not use analytics or marketing cookies; a consent banner is therefore not required.

Our chat widget does not use cookies, but it stores a pseudonymous identifier and the current chat history in your browser's local storage (localStorage). This serves solely to operate the chat function (recognition within a session, protection against abuse, and enforcement of usage limits) and is technically necessary for this purpose (Section 25(2) no. 2 of the German TTDSG); no cross-site tracking takes place.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the chat function).

5. Contacting us

When you contact us by email or via a form, we process the data you provide in order to handle your inquiry.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR.

6. Registration & contract processing

To provide the service, we process account, usage, and billing data (name, email, company/invoicing details, selected plan).
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Retention period: for the duration of the contract and in accordance with statutory retention obligations (German commercial and tax law, generally up to 10 years).

7. Payment processing

We use Stripe (Stripe Payments Europe, Ltd., The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland) to process payments. The payment data required for this purpose is transmitted to Stripe. More information: stripe.com/privacy.
Legal basis: Art. 6(1)(b) GDPR.

8. Use of AI services & processing on behalf of customers

To provide the support function, we use the AI model Google Gemini (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; where applicable, Google LLC, USA). Inputs are processed to generate responses. The content is not used to train the models. More information: policies.google.com/privacy.

Where our customers use the tool and process personal data of their end users in doing so, we act as a processor pursuant to Art. 28 GDPR. In that case, the respective customer is the controller. Processing is governed by the data processing agreement (DPA) concluded with the customer.

Transparency (EU AI Act, Art. 50): End users are clearly informed that they are interacting with an AI system.

9. Recipients / service providers

Hosting / web server: STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany (servers located in Germany)
Database / backend infrastructure: Supabase, Inc. (server region: EU – Frankfurt, Germany)
AI model: Google Gemini (Google Ireland Limited, Ireland; where applicable, Google LLC, USA)
Payments: Stripe (Stripe Payments Europe, Ltd., Ireland)

10. Transfers to third countries

Where service providers outside the EU/EEA are used, transfers take place on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR) and supplementary safeguards.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You may withdraw any consent you have given at any time. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

Competent supervisory authority: the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Germany.

12. Contact for privacy matters

Silas Gehring – Email: info@zalu.ai