Privacy Policy

1. Controller

Onviga Deutschland GmbH
Ferdinandstraße 29–33
20095 Hamburg
Germany

Phone: +49 (0)40 99 99 71 00
Email: crouds@onviga.com

2. Provision of the website

When you access our website, technically necessary data is processed. This may include your IP address, date and time, requested page, referrer, browser, operating system, and status codes. We process this data to provide the website securely and reliably and to diagnose errors.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our service. Hosting and delivery are provided by Vercel Inc.

3. Waitlist and email communication

When you join the waitlist, we process your first name, last name, email address and, where applicable, an approximate region derived from technical connection data. We use this data to manage your registration, send a confirmation, and provide updates about Crouds.

The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by email. Messages are sent through our email service provider, and waitlist data is stored in Supabase.

4. User accounts and use of Crouds

When you create an account or use Crouds, we process in particular:

• login, account, and profile data;
• contacts, companies, and lists created by you;
• boards, relationships, and other content entered by you;
• team, invitation, and usage data; and
• voice and text input when you use the corresponding AI features.

We process this data to provide the agreed features under Article 6(1)(b) GDPR. If you enter personal data relating to other people, you are responsible for having an appropriate legal basis to do so.

5. AI and research features

When you actively use AI or research features, the input and context data required for the requested feature is sent to OpenAI and, for public web research, to Tavily. This may include names, professional information, network relationships, and your query. The data is processed solely to provide the requested feature.

The legal basis is Article 6(1)(b) GDPR where processing is necessary to perform a contract, and otherwise Article 6(1)(f) GDPR. Our legitimate interest is providing useful AI and research features.

6. Maps and location display

We use Mapbox for map features. When a map is loaded, your IP address, device information, and map usage data may be sent to Mapbox. The legal basis is Article 6(1)(b) GDPR when you use the map feature, and otherwise Article 6(1)(f) GDPR.

7. Audience measurement

We use Vercel Analytics to obtain aggregated information about how our website is used and to improve our service. Technical usage data may be processed for this purpose. We currently do not use Google Analytics.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the statistical analysis and improvement of our service.

8. Cookies and local storage

We use technically necessary cookies and local storage mechanisms, particularly for authentication, sessions, security, and settings. The legal bases are Section 25(2) TDDDG and Article 6(1)(b) and (f) GDPR. If we use technologies requiring consent in the future, they will only be activated after you have provided consent.

9. Recipients and processors

Data is only shared with parties that need it for the purposes described above. These may include the following service providers:

• Vercel for hosting and audience measurement;
• Supabase for database, authentication, and storage;
• OpenAI for AI features;
• Tavily for public web research;
• Mapbox for map features;
• Google Workspace for sending emails; and
• ipapi.co for approximate regional attribution of waitlist registrations.

Where required, data processing agreements pursuant to Article 28 GDPR are in place.

10. International data transfers

Some service providers may process data outside the European Economic Area, particularly in the United States. We rely on an adequacy decision, including the EU-US Data Privacy Framework, or appropriate safeguards such as the European Commission's Standard Contractual Clauses.

11. Retention periods

We retain personal data only for as long as necessary for the relevant purpose or as required by statutory retention obligations. Waitlist data is retained until you withdraw your consent or the waitlist is no longer needed. Account and content data is generally stored until the account is deleted. Security logs are deleted after the technically necessary retention period.

12. Your rights

Subject to the requirements of the GDPR, you have the right to:

• access under Article 15 GDPR;
• rectification under Article 16 GDPR;
• erasure under Article 17 GDPR;
• restriction of processing under Article 18 GDPR;
• data portability under Article 20 GDPR; and
• object under Article 21 GDPR.

You may withdraw consent at any time with effect for the future. Please contact crouds@onviga.com to exercise your rights.

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The Hamburg Commissioner for Data Protection and Freedom of Information is one of the authorities responsible for us.

14. Changes to this policy

We may update this Privacy Policy when our service, service providers, or legal requirements change. The version published on this website at the relevant time applies.