Privacy policy

1. Who is responsible?

The controller for this website is Benedikt Huber, Flößergasse 30, 81369 Munich, Germany. Contact us about privacy at info@angel-ai.de.

This policy covers this marketing website and its early-access email list. Use of the Angel AI product is a separate processing activity and is not described as part of this signup.

2. Website hosting and security

Our website and signup database are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit, the hosting infrastructure processes your IP address, request time, requested resource, response status, browser and operating-system information, and any referrer supplied by your browser. These data are used to deliver the website, maintain its security, and investigate faults or abuse.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in operating a secure, reliable website. STRATO acts as our processor under Article 28 GDPR for the services covered by our processing agreement.

STRATO retains visitor IP addresses for up to seven days to detect and prevent attacks. Customer-accessible access logs use anonymised IP addresses and are available for up to six weeks.

3. Early-access invitations and product updates

Joining the list is voluntary. We collect your email address, the consent wording and version, and the times of your request and confirmation. We use these data to verify your request and, after confirmation, to send Angel AI early-access invitations and occasional product updates. Your email address is required for this purpose; you can browse the website without providing it.

We use double opt-in. After submitting the form, you receive a verification email. You join the active list only after opening the link and explicitly confirming. The confirmation link expires after 48 hours. Merely opening a link does not confirm a subscription or unsubscribe you.

The legal basis for the requested invitations and updates is Article 6(1)(a) GDPR, together with Section 7(2) no. 2 UWG. The requested verification step serves to establish and document your consent. Maintaining necessary security and consent evidence is based on Article 6(1)(f) GDPR and our accountability obligations under Articles 5(2) and 7(1) GDPR.

Authorised people operating Angel AI can access the list. A notification containing your confirmed address is sent to our designated operator mailbox, using STRATO’s mail service. We do not sell your address or disclose it for other organisations’ advertising. Marketing emails must include an individual unsubscribe link. We do not use email-open tracking or advertising click tracking in this signup system.

4. Withdrawal and retention

You can withdraw your email consent at any time, without giving a reason, using your individual unsubscribe link or by contacting info@angel-ai.de. Withdrawal does not affect processing that was lawful before withdrawal.

Pending confirmation requests expire after 48 hours. Expired pending records are deleted during the next backend housekeeping run, triggered by a backend request or operator maintenance. Confirmed addresses are retained until you withdraw consent or the early-access/product-update campaign ends.

On withdrawal, we immediately remove your address from the active signup record and cancel unsent owner notifications. Minimal evidence consisting of a keyed address hash, the consent wording, and the relevant timestamps is retained for up to 1095 days after withdrawal or campaign closure to demonstrate consent and defend legal claims, unless a specific legal obligation or ongoing dispute requires otherwise. It is not used to send emails. Routine expiry housekeeping also removes this evidence when its retention period ends.

Copies in operator notification mailboxes and downloaded exports must be removed by the operator when no longer needed. Hosting backups may retain deleted records until their normal rotation; they are not used for routine mailing, and withdrawals must be reapplied if a backup is restored.

5. Form sessions and abuse prevention

The form uses a session cookie to protect submissions against forged requests. The cookie is limited to the API path, is not accessible to JavaScript, and is sent over HTTPS in production. It is a session cookie and is not used for advertising or cross-site tracking. The marketing and legal pages do not require a signup session.

This strictly necessary storage is used to provide the signup or withdrawal function you request, under Section 25(2) no. 2 TDDDG. Associated personal-data processing is based on Article 6(1)(f) GDPR and our legitimate interest in protecting the service.

For rate limiting, the backend temporarily stores keyed hashes derived from the submitting IP address and email address, hourly request counts, and timestamps. It does not store the full address in its rate-limit table. These counters are removed after the applicable request window has ended during housekeeping. No external CAPTCHA, analytics platform, advertising tracker, embedded video, or remotely hosted font is loaded by this website.

6. Contact enquiries

If you email us, we process the contact details and message you provide to handle your request. Article 6(1)(b) GDPR applies where your enquiry concerns a contract or pre-contractual steps you request; otherwise Article 6(1)(f) GDPR applies to our legitimate interest in responding to enquiries. Correspondence is deleted when the enquiry is resolved, unless legal retention duties or the establishment, exercise, or defence of legal claims require longer storage.

7. Recipients and international transfers

Our hosting and email processor and the authorised operator personnel receive the information needed for their roles. This implementation does not intentionally send signup data to a separate marketing platform or a third-country service. STRATO’s applicable processor terms and subprocessor information govern its infrastructure services. Any additional recipient or transfer introduced later requires an updated assessment and privacy notice.

8. Your rights

Subject to the conditions in the GDPR, you can request access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), and data portability (Article 20). You may object to processing based on legitimate interests under Article 21. You may object to direct marketing at any time. Where processing relies on consent, you may withdraw it at any time under Article 7(3).

Contact info@angel-ai.de to exercise these rights. We may need proportionate information to verify that a request concerns your own data.

You can lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, workplace, or the alleged infringement. The authority relevant to our establishment is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA): https://www.lda.bayern.de.

We do not use your signup data for automated decision-making, including profiling, that produces legal or similarly significant effects.

9. Changes to this policy

We update this notice when the website or its processing changes. The date above identifies the current version. A change in wording alone does not expand an existing email consent.