Privacy policy

Controller within the meaning of the GDPR:

AIMPL GbR
Tom Keßler & Simon Pache
Email: business@aimpl.de

We collect and process personal data only to the extent necessary:

User accounts are created exclusively by AIMPL GbR – self-registration is not possible. After an account has been created, the user receives a personal activation link by email that can only be used once and with which they set their own password.

• –The final password is set exclusively by the user when first opening the activation link.
• –For token-based registration (after an inquiry has been approved), the activation link can only be used once and is valid for a limited time.
• –After successfully setting the password, the user receives a confirmation email.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

This website is hosted on Microsoft Azure (region: West Europe). All data is processed and stored exclusively on servers within the European Union. Microsoft Ireland Operations Ltd. is our processor pursuant to Art. 28 GDPR.

Database server: aimpl-server.database.windows.net (Azure SQL, West Europe)

Our support chatbot is available exclusively to signed-in users; without signing in, it is neither visible nor usable. It is operated via Microsoft Azure AI Foundry (West Europe). Chat entries are transferred to Microsoft Azure for processing and are not stored permanently after the session ends. Usage is assigned to the respective account, which receives a usage overview (tokens, costs) in the dashboard. No profiling takes place.

Sign-in uses an email address or username and password through our own authentication system (NextAuth.js with credentials provider).

Passwords are stored exclusively as bcrypt hashes (cost factor 12) – never in plain text. The plain-text password does not leave the server and is released from memory immediately after hashing.

Legal basis: Art. 6(1)(b) GDPR, Art. 32 GDPR (security of processing).

To increase security, we offer optional two-factor authentication (2FA) using TOTP-compatible apps (e.g. Microsoft Authenticator). The secret required for this is stored in encrypted form.

Transactional emails (access details, activation links, confirmations, notifications) are sent via Microsoft Office 365 (West Europe). Microsoft Ireland Operations Ltd. is our processor pursuant to Art. 28 GDPR.

• –Processing takes place exclusively within the European Union.
• –Email addresses are not passed on to third parties.
• –Emails are sent exclusively on a contractual basis (Art. 6(1)(b) GDPR).

We operate an internal ticket system to handle support requests. The following data is stored:

• –Request content (subject, description, priority)
• –Communication history (messages between customer and support)
• –Status and processing history

This data is used exclusively to handle your request. It is not passed on to third parties. Statutory retention periods are observed; after they expire, the data is deleted automatically.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Payments for AI credit are processed via Stripe (Stripe Inc., USA). Credit card data never reaches our servers – processing is carried out exclusively by Stripe. Processing is governed by the Stripe privacy policy.

We use the following categories of cookies:

You can change your cookie settings at any time via the "Cookie settings" link in the footer.

This website uses Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies that enable an analysis of the use of this website.

• –The script is technically only loaded after you have consented to the "Analytics" category in our cookie banner — no data is transferred to Google before your consent.
• –The information generated by the cookie about your use of this website is transferred to a Google server and processed there, partly also in the USA.
• –According to Google, it is certified under the EU-U.S. Data Privacy Framework, which is intended to ensure an adequate level of data protection for the processing of personal data in the USA.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG). You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer.

Further information on how Google Analytics handles user data can be found in the Google privacy policy.

You have the following rights towards us regarding your personal data:

• Art. 15 GDPRRight of access
• Art. 16 GDPRRight to rectification
• Art. 17 GDPRRight to erasure
• Art. 18 GDPRRight to restriction of processing
• Art. 20 GDPRRight to data portability
• Art. 21 GDPRRight to object
• Art. 7(3) GDPRRight to withdraw consent

To exercise your rights, please contact: business@aimpl.de

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information)
datenschutz.hessen.de

We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations. Account data is deleted immediately upon request. AI usage logs are deleted automatically after 12 months. Ticket data is deleted after the statutory retention periods have expired.