Privacy
policy

This is an unofficial translation based on the German version 2026-10-01.1 (version ID bce06a24bd2b79b57f3f6bfbf951d349217082a443b36ccf3d2510af3f92b0a2); company name and contact address were updated on 19 October 2026, and section 3.9 (Connection with Google) as well as the mailbox item in section 3.8 follow the German version 2026-10-27.1 (version ID a45e91d5c2f5775e85227cdbe15019e3e2c15b0343478acc07d4feaed55eafb5), and the passages on consumer customers in sections 2 and 3.4 follow the German version 2026-10-29.1 (version ID 935c6b6c6e70e6390c235ec0e7af710ac3973471ffce5746c4937f020af1c7fd), and the search passages in sections 4 and 5 follow the German version 2026-11-01.1 (version ID 13e419361a41f8b8db2d41409db8658473c61507edc961e1d97faef80e515d56), and the visibility item in section 3.7 follows the German version 2026-11-02.1 (version ID 1528020d1fa7c8b16122c050538789ca3730281639b6545914755b5e4e392977). Only the current German version is legally binding.

This privacy policy describes how Agentiq Intelligence GmbH processes personal data when you use the Agentiq app: when accessing the app and its public pages, during registration, login and purchase, when using booked services, when you connect accounts of other services such as Google or Meta to Agentiq, and when you are in contact with us. It applies regardless of the address at which the app is accessed (app.agentiq-intelligence.com or app.agentiqai.de).

The central version is available at agentiq-intelligence.com/de/datenschutz. There, Part A describes visiting our website; this text is Part B there and is identical in wording to the version in the app.

1. Controller and contact

The controller is Agentiq Intelligence GmbH, Neuer Wall 50, 20354 Hamburg, Germany.

• Data protection, access requests and deletion: info@agentiq-intelligence.com
• Account, contract and invoicing: konten@agentiqai.de

We have not currently designated a data protection officer.

2. When we are the controller and when we are a processor

We ourselves are the controller for the data of our customers, their users and their contact persons insofar as account, contract, billing, support and the security of the app are concerned.

By contrast, we process much data on behalf of our customers: enquiries, messages and calls from their customers, conversations in which a customer uses the conversation aid, job applications, receipts, content and visitors of their websites, and data from accounts that a customer connects to Agentiq. For this purpose, we conclude a data processing agreement pursuant to Art. 28 GDPR with customers who use Agentiq as a business. The customer is then the controller, and its privacy notices apply. If you order Agentiq as a consumer for private purposes, we do not conclude such an agreement; we then process this data as the controller under this privacy policy in order to provide the booked service. If you are a customer, a caller, a conversation partner, an applicant or a website visitor of an Agentiq customer, please address your questions to that company first; we support it in answering them.

The following sections describe both cases so that it is visible which data is processed in Agentiq and to whom it goes.

3. What data we process and for what purposes

3.1 Accessing the app and server logs

When the app is accessed, our servers process technically necessary connection data: IP address, time, requested address, browser and device information, and status and error information. We need this data to deliver the app, to detect attacks and errors and to limit the number of requests per sender. For this limitation, the app holds IP addresses only in working memory. We delete logs of our server services, which may contain IP addresses, after 30 days at the latest.

The app itself does not integrate any analytics or advertising services and does not set any cookies for analytics or advertising purposes. What applies on landing pages and websites that Agentiq operates is described in sections 3.12 and 3.13.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and available operation.

3.2 Cookies and storage in your browser

The app stores in your browser only what is necessary for the functions you use:

• Login: a session cookie, for as long as you are logged in, at most 400 days.
• Connection with other services: a cookie that secures the connection process, at most ten minutes.
• Workspace: the most recently selected area, 365 days.
• Started recruiting request: a cookie for the ongoing process, seven days.
• Preview: the business selected in a preview, seven days, and the selected area, 365 days.
• Approval by link: if you open an approval link from an email, the login for it is valid for at most 15 minutes.
• Settings and drafts: appearance, sidebar, view, unfinished entries and the history of internal chats in your browser’s local storage, until you clear it.

The legal basis for storing and reading is Section 25(2) no. 2 TDDDG, because these entries are strictly necessary for the service you have requested; for further processing, Art. 6(1)(b) or (f) GDPR.

3.3 Registration, login and account

For your account, we process email address, name, company, role and permissions, your password exclusively as a hash, the times of registration and login and, for accounts with extended access, a second factor. We log logins of accounts with administrative rights with time and role, without IP address, in order to be able to prove access. If you use a passkey, we store its public key, not the secret on your device.

We operate the login ourselves with the software Supabase Auth on our own servers. If you log in via your Google or Apple account, where this option is offered, we receive your name, your email address and an account identifier from there.

The legal basis is Art. 6(1)(b) GDPR for our contractual partners. For users whom a customer invites, it is Art. 6(1)(f) GDPR; the legitimate interest of both companies lies in secured, traceable access.

3.4 Purchase, contract, withdrawal and payment

Upon purchase, we process your name or the company details and the contact person, whether you order as a consumer or as a business, the booked service, the price, the declarations confirmed at the moment of purchase and the version IDs of the confirmed contract texts. We store this evidence in unalterable form. You can complete a purchase via a confirmation link by email; this link is valid for seven days.

Payment is handled by Stripe (Stripe Payments Europe, Limited, Ireland). Stripe receives your email address and internal identifiers of your account and of the booked service; you enter billing address, tax number and payment details directly with Stripe, and for SEPA direct debit also account holder and IBAN. Stripe is itself the controller for payment processing, fraud prevention and its own legal obligations; Stripe’s privacy notices apply.

If we have a contract signed electronically, we use a signature service based in France. It receives the document as well as the name and email address of the signatories and retains the proof of signature for ten years according to its own terms.

If you use the electronic withdrawal function, we store your name, the information on the contract, the email address for the acknowledgement of receipt, the wording of your declaration and the date and time of its receipt. We confirm receipt to you by email; a copy goes to our withdrawal mailbox.

The legal bases are Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (retention obligations and the legally required acknowledgement of receipt of a withdrawal) and Art. 6(1)(f) GDPR (proof of concluded contracts and of declarations made).

3.5 Emails from Agentiq

We send emails relating to account and contract, such as invitations, login and confirmation links, purchase and withdrawal confirmations and proof of deletion, as well as operational emails relating to booked services. Where agreed, you receive lifecycle emails and weekly evidence reports with key figures on your services; these may contain values from connected services such as Google Analytics or Google Search Console. You can unsubscribe from lifecycle emails and weekly evidence reports at any time with one click.

For sending, we use an email delivery service in the USA. It receives recipient address, subject, content and sending details, stores content and logs for 30 days according to its own statements and processes the data in the USA. If it is not available, we send via the sending access of our email provider in Germany or via our own Gmail account at Google.

If the email service reports that an address permanently rejects emails or that one of our emails has been reported as spam, we store the address with reason and time on a suppression list for as long as it is necessary to prevent these deliveries. We no longer send emails to a permanently rejecting address; after a spam report, only emails that are necessary for the contract or required by law.

The legal basis is Art. 6(1)(b) GDPR; for lifecycle emails, weekly evidence reports and the suppression list, Art. 6(1)(f) GDPR. Our legitimate interest is useful, reliable communication without unwanted deliveries.

3.6 Use of the platform and booked services

In Agentiq, we process what you and your team enter or upload, the results of the agents, tasks, approvals, logs of the runs and the history of your conversations in the chat. The respective service description describes which data a booked module additionally processes. Agentiq performs external actions, such as messages to your customers, publications or changes to advertising campaigns, according to the way of working set for your account: independently within the agreed scope or only after your approval. Agentiq triggers spending only with your approval or within a budget you have approved.

We do not evaluate your use for advertising. To improve our services, we use only aggregated, anonymised insights that allow neither persons nor individual customers to be recognised.

The legal basis is Art. 6(1)(b) GDPR; insofar as we act on behalf of a customer, the customer’s legal basis.

3.7 AI processing

Agentiq provides many services using AI models of external providers in the USA and in the EU. For this purpose, we transmit the content required for the respective task, for example your request, conversation excerpts, company details, content of your knowledge base and results from connected services. Agentiq stores the response in your account.

• Language models: for the Core Agent, the specialist agents, the chat, drafts and automatic replies, evaluations, the classification of incoming messages, reading receipts (section 3.18) and the hints and analysis of the conversation aid (section 3.17). For research questions, a model can run a web search. Images and files that you attach in the chat are sent along.
• Search vectors: your knowledge base and your conversation memory are converted into search vectors so that Agentiq can find matching content again.
• Speech: conversion of speech into text, speech output (reading responses aloud) and real-time voice conversations in onboarding, in interviews with guests (section 3.15) and in the phone reception (section 3.16). For the conversation aid and the dictation function, we use a speech recognition service that processes the audio in the EU and does not store it to improve its models.
• Visibility in AI answers: to measure whether and how your company is mentioned in AI answers, we ask several AI answer services questions about industry, location and company. These questions contain no personal data of your customers. We reach the AI systems Grok and Llama only through the global access of a model broker outside the EU; only these general search questions go there, without contact details and without the address of your business, and every request requires that only endpoints answer that do not store inputs (Zero Data Retention), and prohibits data collection.
• Chat for employees: in the Agentiq Chat module, we process requests exclusively via model access with data centres in the EU.
• Images and videos: see section 4.

Agentiq does not store voice recordings, only the recognised text; in the phone reception and the conversation aid not even that. Before the voice conversation in onboarding, we obtain your consent. If you use your browser’s dictation function in internal chats, the manufacturer of your browser processes the recording according to its terms.

What the providers may do with the data:

• The providers of the language models, the search vectors and the speech services do not use the data to train their models, according to their terms for business customers. As a rule, they delete inputs and outputs after 30 days at the latest; exceptions apply according to their terms, for example to investigate abuse. They do not retain voice recordings for conversion into text.
• One exception is the service for images and videos: according to its terms, it may also use inputs to improve its models (section 4).

We ourselves do not use your data to train general AI models. Response rules that arise from your corrections, and your conversation memory, remain in your account.

The legal basis is Art. 6(1)(b) GDPR; insofar as we act on behalf of a customer, the customer’s legal basis. For the voice conversation in onboarding, it is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

The AI does not make any decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Automatic replies in the inbox are marked as such; the phone reception says at the beginning that an AI assistant is speaking.

3.8 Inbox and customer communication

When you connect communication channels, Agentiq collects incoming messages from your customers in the inbox. We process this data on your behalf.

• Email: via the “Gmail mailbox” connection (section 3.9), via Microsoft 365 (section 3.11) or via IMAP access that you enter yourself. Agentiq regularly retrieves the unread messages of your inbox, at most 50 per retrieval and regardless of their age. Sender address and name, recipient, subject, the text of the message up to 4,000 characters and technical identifiers for assigning the reply are stored. Agentiq assigns contacts and can create tasks. Agentiq stores attachments only as receipts (section 3.18).
• What happens in the mailbox: unless you have switched on the sorting setting, Agentiq does not change your Gmail mailbox. With that setting, the reversible changes described in section 3.9 apply. In a Microsoft mailbox, Agentiq does not change messages. Agentiq marks other mailboxes as read after storing, so that no message arrives twice; if sorting of the inbox is switched on, the message additionally receives a keyword with its category there.
• WhatsApp Business: via Meta’s WhatsApp programming interface with telephone numbers, messages and delivery status.
• Telegram: via a Telegram bot that you connect, with chat identifier and messages.
• Forms and chat of your website operated by Agentiq (section 3.13) and calls in the phone reception (section 3.16).

When a conversation is opened, Agentiq automatically classifies the last incoming message, for example as an enquiry, support or information. For this, channel, display name and up to 2,000 characters of the message go to a language model; the result is only displayed. For a draft reply, sender, subject, up to 12,000 characters of the message and matching content of your knowledge base go to the language model. If the automatic reply is switched on, the model formulates a reply from up to 6,000 characters of the conversation history and your company details. If you correct a draft, Agentiq derives response rules for your account from the incoming message, draft and final version, which influence later replies.

Agentiq sends replies via the channel through which the message arrived. Emails to your customers go exclusively via your own sender: your sending access, Gmail or Microsoft 365.

3.9 Connection with Google

When you connect Google to Agentiq, you grant permissions in Google’s dialog. Agentiq receives access tokens, stores them in encrypted form for your company and uses them only for the functions described here. Agentiq does not receive your Google password. Which functions you can use depends on your booked services. We process the content from your Google services on your behalf; the legal basis for the connection itself is Art. 6(1)(b) GDPR.

Your own Google connection requests these permissions:

• Calendar (calendar.events): displaying appointments, creating and cancelling them on your instruction, with your approval or according to a booking rule you have set up, and determining free times for appointment suggestions, for this purpose only busy periods. Title, description, location, times and participants are processed. If Agentiq creates an appointment with participants, for example a customer meeting or a job interview, it can add a Google Meet link; Google sends the invitation to the participants. Agentiq does not read calendar sharing or calendar settings.
• Gmail (gmail.send): exclusively sending emails that you have approved or that an automation switched on by you sends, also as a reply in the existing Gmail thread. Agentiq does not read any emails via this connection. Connections from the time before this version may still contain the earlier permission gmail.modify; Agentiq no longer uses it. You can remove it in your Google account and re-establish the connection.
• Google Drive (drive.file): after your approval, Agentiq stores a file with the overview of your receipts in your Google Drive and can delete exactly this file again. With this permission, Agentiq reaches only files that it has created itself; Agentiq does not read existing files.
• Google Ads (adwords): ad accounts, campaigns, ads, search terms, conversion actions and performance values for overviews, reports, the chat, ongoing management and approved changes to campaigns, which can trigger advertising spend, for example new search campaigns, budgets or a call extension with your telephone number. In the event of default in payment, Agentiq may pause your campaigns, as described in the terms and conditions.
• Google Search Console (webmasters.readonly): websites, search queries, pages, clicks, impressions and positions as well as the indexing check of individual addresses. As long as a visibility module is booked, Agentiq stores search performance data up to 16 months retroactively; it is part of your handover package.
• Google Analytics (analytics.readonly): read-only access to the key figures and key events of your website’s Analytics property, for results reports and lifecycle emails. Agentiq does not change settings in Google Analytics via this connection.
• Google Business Profile (business.manage): locations, opening hours, descriptions, posts, performance values and reviews. Agentiq stores review texts in order to create draft replies. Agentiq imports photos that you have uploaded as the owner into your material library for your website and your advertising; Agentiq does not import third parties’ photos.
• Account assignment (openid, email): to display which Google account is connected.

Separate “Gmail mailbox” connection (gmail.modify, openid, email). You establish this connection only if Agentiq is to handle incoming emails for you. It is separate from the connection above. With it, Agentiq reads the unread messages of your inbox including their attachments, as described in sections 3.8 and 3.18, sends your replies and, after your click, creates reply drafts in your Gmail mailbox. If you switch on the setting “Im Postfach sortieren” (sort in the mailbox), the inbox agent can add Agentiq labels to messages, mark them as read and – only if you also switch on that option – archive them out of the inbox. These changes are logged and can be undone from the log. Agentiq never permanently deletes messages or drafts it did not create. Until Google has completed its review of this permission, the connection is available only to enabled test accounts.

Separate “Google Merchant Center” connection (content, openid, email). You establish this connection only if you advertise products of your shop through Google Shopping. It is separate from the connections above. With it, Agentiq reads your Merchant Center account, your product entries and their review status at Google, and shows you under “Zugänge” how many products are approved and how many carry a notice. Only after your explicit approval in each case does Agentiq add, update or remove product entries from your shop. Agentiq does not retrieve order or customer data through this connection.

Access via Agentiq’s Google manager account. For Google Ads, Search Console, Google Analytics and your Business Profile, you do not have to connect your own Google account. To do so, you give a Google account of Agentiq, in the respective Google service, access to exactly one ad account, one property, one website or one location. If you do not yet have an Analytics property, Agentiq can create it for you in its own manager account at your request; in doing so, Agentiq transmits the name of your company to Google. Agentiq uses this access only for the shared object and only for your account. It processes the same data as described above, and for Google Analytics the key figures and key events of the shared property for results reports and lifecycle emails. In Search Console, at your request (“Connect”), Agentiq can create your website as a property and verify ownership with Google, automatically via a verification file for a website operated by Agentiq, otherwise via a DNS record that you set. Agentiq’s Google account thereby becomes a verified owner of this property. For this purpose, Agentiq additionally requests the permissions webmasters, siteverification and analytics.edit for its own account. Via this route, Agentiq receives no access to your calendar or your emails.

Where Google data goes. Agentiq uses Google data only for the functions above that are visible to you. For this purpose, Agentiq transmits the excerpts required in each case to:

• providers of language models, when you work with this data in the chat, in reports or in commissioned workflows, for example with appointments, search queries, key figures or reviews, and, for the “Gmail mailbox” connection, for classification, for draft replies and automatic replies and for reading receipts from attachments;
• the provider of the search vectors, when responses with such data are included in your conversation memory, and the speech service for speech output;
• our email delivery service, when lifecycle emails or weekly evidence reports contain key figures from Analytics or Search Console.

All three act on our behalf and receive only the excerpts required for the function.

Agentiq does not sell Google data, does not use it for advertising, does not pass it on to advertising platforms or data brokers and does not use it to develop, improve or train general or non-personalised AI models. The recipients named, according to their terms, likewise do not use it for training (section 3.7); no Google data goes to the service for images and videos. People at Agentiq see Google data only if you give us your agreement for this in the individual case, for example in support, if it is necessary for security or to defend against abuse, or if a law requires it; evaluations for operations are carried out only in aggregated form.

For data that Agentiq receives via Google’s programming interfaces, the Google API Services User Data Policy, including the Limited Use requirements, and the Google Workspace API User Data and Developer Policy apply. The review of the use of this data by Google has not yet been completed.

Ending access. You can remove Agentiq at any time in the connections of your Google account. You remove the access of Agentiq’s manager account in the respective Google service. If Agentiq is an owner of a property in your Search Console, you remove it there under “Users and permissions” and, if applicable, delete the DNS record for verification. You can also end your own Google connection as well as the separate “Google Drive”, “Gmail-Postfach” and “Google Merchant Center” connections in the app under “Zugänge” with “Verbindung trennen”; Agentiq then hands the respective access back to Google and deletes the stored access credentials. Upon request to info@agentiq-intelligence.com, we delete the stored access credentials and the data retrieved from Google (section 8). If your contract ends, we hand the Google connections back to Google from our side when your account is deleted and end the management link of your Google Ads account.

3.10 Connection with Meta

• Meta ad accounts (ads_management, ads_read, business_management): ad accounts, campaigns, ad sets and ads including images and videos, audience settings, budgets and aggregated performance values for reports and approved changes, which can trigger advertising spend.
• WhatsApp Business (whatsapp_business_messaging, whatsapp_business_management): setup via Meta’s embedding procedure. For this, the app loads Meta’s JavaScript package only after your click, as a result of which Meta receives your IP address and browser information. Agentiq processes messages as in section 3.8.
• Conversion feedback: If visitors to your website have agreed to advertising measurement and feedback is switched on, Agentiq transmits event name, time, value and the click identifier from the Meta ad to your Meta ad account; Agentiq does not transmit any further contact data in the process.
• Audiences: at your request and after your approval, Agentiq creates audiences in your ad account. An audience from your contacts is created only if you have confirmed and documented that these contacts have consented to the use for advertising; for this, Agentiq transmits their email addresses to Meta exclusively as a hash value (SHA-256) and can have a similar audience formed from it. Audiences of website visitors are based on the Meta pixel of your website and the visitors’ consent.
• Ad account via Agentiq: if you do not yet have an ad account, Agentiq can create it for you in its own business account at Meta at your request; in doing so, Agentiq transmits the name of your company.

We process this data on your behalf. Meta processes the data under its own responsibility in accordance with Meta’s privacy notices. You can remove the connection in the business integrations of your Meta account.

3.11 Other services that you connect

We process this data on your behalf; the privacy notices of the services additionally apply.

• Microsoft 365 (Mail.Read, Mail.Send, User.Read, offline_access, openid, email): Agentiq reads the unread messages of your inbox including their attachments and sends your replies, as described in sections 3.8 and 3.18; Microsoft stores sent messages in your mailbox. Agentiq marks, moves and deletes nothing there. You remove access in your Microsoft account under “My Apps”.
• LinkedIn: ad accounts, campaign drafts, conversion rules and aggregated performance values for reports. Posts on behalf of a person and messages to applicants via LinkedIn are not activated.
• TikTok (user.info.basic): display name and identifier, to display the connected account; Agentiq does not publish anything on TikTok. Advertising campaigns on TikTok are not activated.
• Webflow, WordPress, WooCommerce, Shopify, Shopware: pages, posts, products, categories and SEO details of your website or your shop, to publish approved changes; Agentiq does not retrieve order and customer data of your shop.
• WordPress.com and Cloudflare: the connection is prepared; Agentiq does not currently retrieve any data through it.
• HubSpot, Lexware Office, orgaMAX, Odoo, DATEV: contacts, quotes, invoices, receipts and transactions that Agentiq reads or creates on your behalf; from Odoo only number, status and total of orders.
• Slack, Microsoft Teams or an address of your own: if you set up a notification in the CRM, Agentiq sends the event there, depending on the chosen format with name, email address and telephone number of the contact.
• ProvenExpert: your reviews, to display them.
• ChatGPT advertising (OpenAI): campaigns and ads of your ad account.
• Job boards: publishing job advertisements via job boards is not activated; job advertisements run via advertising at Meta (section 3.10).
• Domains and mailboxes: registration of domains in your name with registrars in Germany and the Netherlands with the owner details; setup of mailboxes with a mailbox provider in Germany with name and mailbox address.
• GitHub: source code and tasks for software that Agentiq builds for you.
• Business directories and specialist portals: entries with name, address, telephone number and website of your company only after your approval; this function is not yet activated.

3.12 Landing pages under the app address

Under the app’s address, Agentiq delivers landing pages for its own offers and for campaigns. Anyone who fills in a form there transmits name, company, contact details and message to the company that owns the page. We count page views without a cookie and without an IP address. If we test variants of a page, we permanently assign visitors to a variant via a check value formed from test identifier, IP address and browser information, and store only this check value until the test is deleted. We store click identifiers from ads only with consent (section 3.13).

The legal basis is Art. 6(1)(b) GDPR for enquiries, otherwise Art. 6(1)(f) GDPR; our legitimate interest is to recognise which variant of a page is better understood.

3.13 Websites and job advertisements that Agentiq operates for customers

Agentiq creates and operates websites and job advertisements on behalf of its customers. The privacy notices of the respective customer apply to their visitors. In doing so, Agentiq processes:

• connection data as in section 3.1;
• form entries such as enquiries and job applications, which go to the customer;
• its own reach measurement without a cookie and without an IP address;
• only with the visitors’ consent, a random visitor identifier in a cookie (400 days) together with click identifiers from ads, so that an enquiry can be attributed to the ad;
• only with the visitors’ consent, the assigned variant of a page in a cookie (180 days) and a random identifier in the browser’s storage, if the customer tests variants;
• questions and answers in the website chat, if the website has one. A conversation is stored only if the visitor agrees, and then for 30 days;
• quote requests with name, email address and the selected service, which go to the customer;
• embedded appointment booking via Google Calendar only after the visitor has agreed to external content; Google then receives the visitor’s IP address and browser information;
• the visitors’ consent choice (180 days).

3.14 Job applications

Applications are received via job advertisements that Agentiq publishes for a customer. We process this data on behalf of the company advertising the position: Agentiq stores the applicants’ details and documents, including those they submit later via a personal link, sends acknowledgements of receipt and messages according to that company’s specifications and deletes applications together with documents six months after the rejection or the last activity, unless there is consent for a talent pool. If an application starts via WhatsApp, Agentiq processes the telephone number and the answers to the opening questions for this. Applicants can request access or deletion via the job page; the request goes to the company advertising the position. The company advertising the position decides on applications.

3.15 Questionnaires and interviews with guests

On behalf of its customers or for its own consultations, Agentiq conducts questionnaires and voice interviews with invited guests. In the process, answers, transcripts and company details are processed, and in voice mode also the voice. Voice and conversation go to a real-time voice service in the USA, the evaluation and a web search about the company to a language model of the same provider. Agentiq does not store audio. On the completion page, your browser loads an animation of an animation service via a content delivery network; these providers receive your IP address and browser information in the process. Appointment booking via Google Calendar is loaded only after your click; Google then receives your IP address and browser information. The legal basis is, for interviews on behalf of a customer, the customer’s legal basis, and for our own consultations Art. 6(1)(b) GDPR.

3.16 Phone reception

If a customer books the phone reception, an AI assistant answers calls to its telephone number. We process this data on behalf of the customer. A telephone provider in the EU accepts the call and connects it to a real-time voice service in the USA; the caller’s voice and the telephone numbers go there. The assistant says at the beginning that an AI assistant is speaking.

The conversation is not recorded, and Agentiq stores no wording. The caller’s telephone number and the called number, start, end and duration, the concern stated by the caller, the caller’s name and a call-back number, and a booked appointment are stored. At the caller’s request, the assistant forwards the call to a number stored by the customer.

3.17 Conversation aid AMI

With AMI, a person can have hints from the approved knowledge of their company displayed during a sales conversation and have the conversation evaluated afterwards. We process this data on behalf of the customer. Speech processing starts only when the speaking person has confirmed that they have informed their counterpart about it.

The audio of both sides of the conversation goes from the browser directly to a speech recognition service that converts it into text in the EU and does not store it. The most recently spoken sentences and, after the conversation, the recognised text go to a language model that selects the hint and creates the analysis. Agentiq stores neither audio nor wording, only details of the conversation and the structured analysis with commitments, open points and next step. We delete a draft that the person does not confirm after 72 hours. Voice and emotions are not evaluated; supervisors do not see individual conversations.

3.18 Receipts

If receipt capture is switched on, Agentiq stores invoices and receipts that arrive in your inbox as a PDF or image or that you upload, with file name, sender and subject. A language model reads invoice issuer, invoice number, date and amounts from the file and suggests an account; for this, the whole file is transmitted. After your approval, Agentiq sends the collected receipts via your own sender to the tax adviser you have stored and can store an overview in your Google Drive (section 3.9). We process this data on your behalf.

3.19 Contact, support and operations

If you write to us, we process your contact details, the content of your message, associated contract data and the handling history in order to answer your request and to document it in a traceable manner. The legal basis is Art. 6(1)(b) GDPR for questions about a contract, otherwise Art. 6(1)(f) GDPR.

We send operational notifications, for example about disruptions, to our team via a messenger service outside the EU. They identify affected customers only by a short code and contain neither names nor content of your communication; the details are only in the app.

Agentiq staff access data in customer accounts only insofar as this is necessary for operations, for support at your request, for security or on the basis of legal obligations. Cross-tenant evaluations for managing our services are carried out in aggregated form and are logged.

3.20 Free instant check

For the free instant check we process your email address, the website you entered and the check result. We send the result to the email address you entered. The legal basis is Art. 6(1)(b) GDPR, because you request this service. For delivery, the email service named in section 3.5 receives the email address, the subject and the content of the message.

We send further tips only if you expressly select this and then confirm it via the single-use link in the confirmation email. The legal basis is then your consent under Art. 6(1)(a) GDPR. Every further email contains an unsubscribe link. You can withdraw your consent at any time with effect for the future; without confirmation no tips are sent.

4. Recipients

Only bodies that need personal data for the respective purpose receive it. We bind providers that act on our behalf by data processing agreements. Here we name the categories of recipients; an overview by purpose and region is available at Providers by purpose and region. As a customer, you receive the list of our subprocessors by name in the app and as an annex to the data processing agreement. We name the specific recipients of their data to data subjects on request to info@agentiq-intelligence.com.

• Hosting: a data centre operator in Germany; servers and database are located in data centres in Germany.
• AI models and speech: providers of language models, search vectors, speech recognition, speech output and real-time voice conversations in the USA and in the EU (section 3.7).
• Telephony: a telephone provider in the EU for the phone reception (section 3.16).
• Search and search engine data: services for the web search of the AI agents, the provenance check of images, the search for mentions of your company and for search engine data. The web search of the AI agents runs via processors, one of them in France (EU); standard contractual clauses apply to possible processing outside the EU. A further search service serves as a fallback. Search terms, questions and domains are transmitted; if they contain names or places, these too. A search service in the USA processes search queries under its own responsibility and, according to its own statements, retains them for at most 90 days.
• Email: an email delivery service in the USA and our email provider in Germany; a mailbox provider in Germany for mailboxes that we set up for customers.
• Payment and signature: Stripe (own responsibility, section 3.4) and a signature service in France.
• Domains: registrars in Germany and the Netherlands.
• Image and video generation: a service in the USA for images and advertising videos for websites and advertising. The description and the images that serve as a template, such as product photos, are transmitted. A photo of a person goes there only if their consent for this is on file. According to its terms, the service may also use inputs to improve its models and does not guarantee processing in the EU.
• Connected services: Google, Meta, Microsoft, LinkedIn, TikTok and the other services from section 3.11, in each case after your connection and for the functions described.
• Authorities and courts, if we are legally obliged to do so.

5. Transfers to third countries

Some recipients process data outside the EU, primarily in the USA: providers of language models, search vectors and real-time voice conversations, the email delivery service, a search service and the service for images and videos, as well as Google, Meta, Microsoft, LinkedIn and TikTok, insofar as you connect these services. The processor for the web search of the AI agents is based in France; where it or one of its sub-processors processes data outside the EU, the standard contractual clauses apply. The messenger service for our operational notifications is based outside the EU and receives no names of customers and no content. Speech recognition for the conversation aid and the dictation function, and the chat for employees, run via access with processing in the EU.

We transfer data only if the requirements of Art. 44 et seq. GDPR are met: on the basis of an adequacy decision of the EU Commission, in particular for recipients certified under the EU-US Data Privacy Framework, or on the basis of the EU Commission’s standard contractual clauses in the data processing agreements. Services that you connect yourself process data according to their own safeguards under their own responsibility. You can obtain a copy of the safeguards on request to info@agentiq-intelligence.com.

6. Storage period

We store personal data only for as long as is necessary for the respective purpose and delete it thereafter, insofar as no statutory retention obligation precludes this.

• Account and content in Agentiq: for the duration of the contract. You can delete much content yourself; otherwise we delete it at your request.
• Server logs: at most 30 days.
• Free instant check: without consent 30 days, with confirmed consent at most twelve months; confirmation links for tips are valid for seven days.
• Access tokens of connected services: until you end the connection and request deletion, at the latest until your account is deleted.
• Search Console search performance data: up to 16 months retroactively, as long as a visibility module is booked.
• Process diagnosis data: 90 days.
• Stored conversations in the website chat: 30 days.
• Unconfirmed drafts of the conversation aid: 72 hours.
• Call list of the phone reception, receipts, quote requests and appointments: for the duration of the customer’s contract, unless the customer has them deleted earlier.
• Unsubscriptions from notifications: as long as they are necessary to prevent further notifications to this address.
• Job applications: six months after rejection or last activity, with consent for a talent pool until the end of that consent.
• Confirmation links for a purchase: seven days.
• Email suppression list: as long as it is necessary to prevent unwanted deliveries.
• Login logs of accounts with administrative rights: until the account is deleted.
• At providers: according to their periods, at the providers of the language models and at the email delivery service as a rule at most 30 days (sections 3.5 and 3.7).

After the end of a contract, the following sequence applies, calculated from the day on which the termination takes effect:

• Until day 30 you can continue to access your account and view your data.
• Until day 90 you can download your handover package.
• On day 97 we delete the data of your account in the platform, including stored files, hand back connected Google and Meta access and confirm the deletion to you.
• Excluded are documents that we must retain under commercial and tax law: invoices and accounting vouchers eight years, commercial books ten years, commercial and business letters six years. We retain evidence of contracts, consents and deletions for ten years. We block these documents and use them only for this purpose.

For data that we process on behalf of a customer, the periods from the data processing agreement and the customer’s instructions additionally apply.

7. Data security

The connection to the app is encrypted. We store access credentials of connected services in encrypted form; the key is not located in the database. The database separates the data of different customers by means of access rules per customer. We secure accounts with administrative rights at Agentiq with a second factor.

8. Ending access and requesting deletion

You end access to connected accounts at the respective provider, for example in the connections of your Google account, in the business integrations of your Meta account, under “My Apps” in your Microsoft account or in the settings for connected apps at LinkedIn and TikTok. This does not automatically delete the data already stored in Agentiq.

For the deletion of stored access credentials, retrieved data and content generated from it, such as reports, tasks, response rules or memory entries, write to info@agentiq-intelligence.com. The instructions for data deletion describe which information we need for this. We confirm the deletion to you within one month. Only for complex requests can this period be extended under Art. 12(3) GDPR; we will tell you so within that month. Deletion in Agentiq does not delete the originals at the provider, such as your emails, appointments or ads.

9. Your rights

Under the GDPR, you have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). If processing is based on consent, you can withdraw it at any time with effect for the future; the lawfulness of the processing until the withdrawal remains unaffected.

Right to object: If processing is based on our legitimate interest (Art. 6(1)(f) GDPR), you can object to it at any time on grounds arising from your particular situation (Art. 21 GDPR). We then no longer process the data, unless we demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

A message to info@agentiq-intelligence.com is sufficient for your request. We may request information that is necessary to confirm your identity.

10. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your place of residence, your place of work or the alleged infringement. The authority competent for us is the Hamburg Commissioner for Data Protection and Freedom of Information.

11. Obligation to provide data

We need the information that we request as mandatory fields during account opening, purchase and billing, for the contract or for legally complete invoices. Without it, we cannot set up the account, the contract or the service. You can omit voluntary information without this consequence.

12. Changes

Each change receives a new version with its own version ID and an effective date. The current version is available in the app and at agentiq-intelligence.com/de/datenschutz. We inform you in advance of changes that are of significance for existing contracts.