Privacy Policy

6. Contact by form and email

You can reach us via the contact form (/contact), the demo form (/ai-vi-kennenlernen) or directly by email to info@ai-think.de. Through the forms we collect the following information:

Mandatory fields

• First name, last name
• Email address
• Contact form: subject and message
• Demo form: company, position, industry, company size and interests

Optional fields

• Phone number
• Demo form: message and how you heard about us

If you arrive via an ad or a tagged link, we additionally take the campaign details from the address you opened (utm_source, utm_medium, utm_campaign, utm_term) and the Google Ads click identifier (gclid). Nothing is stored in your browser for this.

We do not need your consent to answer your enquiry, which is why these forms have no mandatory checkbox. We also handle enquiries with the support of an AI assistant (section 6f). A person always reviews and sends every reply.

Purpose: answering your enquiry, arranging a demo appointment
Legal bases: Art. 6(1)(b) GDPR where your enquiry aims at a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries and handling them efficiently, also with AI support). For the campaign details Art. 6(1)(f) GDPR (legitimate interest in recognising which campaign an enquiry came from)
Transmission: the form is submitted over an encrypted connection (TLS) to our own server in Germany (data centre in Nuremberg), which sends the details on to our internal address by email. IP address and browser identifier are not included. The mailbox is hosted with Microsoft 365 (section 6f). No third-party form service is involved.
Retention period: see section 13
Objection: you can object at any time to processing based on Art. 6(1)(f) GDPR by email to privacy@ai-think.de.

6b. Product videos (YouTube)

On our product pages we embed videos hosted on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For users outside the EEA, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, is the controller.

YouTube is not contacted before you consent. Initially you only see a preview image served from our own server. The player is loaded only once you click a video and thereby agree. If you decline, the website remains fully usable; you can watch the videos via the direct link to YouTube instead.

We use the privacy-enhanced mode (youtube-nocookie.com). According to Google, no cookies are set for analytics purposes in this mode before a video is played. A connection to Google servers, and therefore the transfer of your IP address, still takes place when the player loads.

Data processed

• IP address (technically required to establish the connection)
• Browser and device information, operating system, screen resolution
• URL accessed, plus date and time of access
• Information about video playback
• If you are signed in to Google, Google can associate the access with your account. Sign out beforehand if you do not want this.

Purpose: Presenting our product videos
Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG
Third-country transfer: USA, based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR); Google LLC is certified under the DPF. Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR apply in addition.
Retention: Storage is carried out by Google; please refer to Google's privacy policy for details.
Withdrawal: At any time via the privacy icon at the bottom left of every page. Withdrawal takes effect immediately; the lawfulness of processing carried out until then remains unaffected.

More information: Google privacy policy

6c. Ad measurement (Google Ads)

We run ads on Google. To identify which ad led to an enquiry, we use Google Ads conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

No script is loaded from Google without your consent. No connection is established, no identifier is assigned and nothing is stored on your device. If you decline, the website remains fully usable; we simply do not learn which ad brought you here.

For the sake of completeness: if you consent to audience measurement only and decline ad measurement, the shared Google container still loads, because it serves both purposes. Google then sends a hit without any identifier to an advertising domain, which essentially communicates your refusal. Nothing is stored on your device and no identifier is assigned; your IP address and the page you visited are transmitted. If you decline both, this does not happen either.

The tag is loaded through Google Tag Manager, a management tool from the same provider. Its container, too, is only loaded after your consent.

If you consent, an event is transmitted to Google when you complete an enquiry. We do not transmit names, email addresses or the content of your enquiry. Personalised advertising is explicitly switched off.

Data processed

• Cookie identifier used to recognise the ad click
• IP address (technically required to establish the connection)
• Browser and device information
• Time and type of the action triggered (enquiry submitted, appointment opened)

Purpose: Measuring the success of our ads
Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG
Third-country transfer: USA, based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR); Google LLC is certified under the DPF. Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR apply in addition.
Retention: Conversion cookies expire after 90 days. Storage is carried out by Google; please refer to Google's privacy policy for details.
Withdrawal: At any time via the privacy icon at the bottom left of every page. Withdrawal takes effect immediately; the lawfulness of processing carried out until then remains unaffected.

More information: Google privacy policy

6d. Audience measurement (Google Analytics 4)

To understand how our website is used and which content is in demand, we use Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data as a processor within the meaning of Art. 28 GDPR; a corresponding agreement is in place.

No script is loaded from Google without your consent. No connection is established, no identifier is assigned and nothing is stored on your device. If you decline, the website remains fully usable; we simply lack the statistical analysis.

The tag is loaded through Google Tag Manager, a management tool from the same provider. Its container, too, is only loaded after your consent.

We have restricted the collection further: Google signals are switched off, so no cross-device attribution via signed-in Google accounts takes place. Use for personalised advertising is disabled as well. Google Analytics 4 does not store IP addresses; they serve only for a rough location estimate and are discarded afterwards.

Data processed

• Cookie identifier to distinguish returning from new visits
• Pages accessed, time on page and the order of the visit
• Approximate location at city level, derived from the IP address
• Device type, screen resolution, browser and operating system
• Source of the visit, such as search engine, advertisement or direct access

Purpose: Statistical analysis of usage in order to improve the content and structure of the website
Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG
Third-country transfer: USA, based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR); Google LLC is certified under the DPF. Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR apply in addition.
Retention: Usage data is deleted automatically after 14 months. Storage is carried out by Google; please refer to Google's privacy policy for details.
Withdrawal: At any time via the privacy icon at the bottom left of every page. Withdrawal takes effect immediately; the lawfulness of processing carried out until then remains unaffected.

More information: Google privacy policy · How Google Analytics uses data

6e. Guide download in return for consent (double opt-in)

On the pages /en/guide-audit and /en/guide-crisis-exercise (in German: /leitfaden-audit and /leitfaden-krisenuebung) we offer the guides “Audits with AI avatars” and “Cyber crisis exercise with AI avatars” as PDF.

Details in the form

• Mandatory: first name, email address, company, your consent (checkbox)
• Optional: last name, role in the company
• Automatic: the chosen guide, the language of the page and, if you arrive via an ad or a tagged link, the campaign details (utm_source, utm_medium, utm_campaign, utm_term) and the Google Ads click identifier (gclid)

Process

1. You fill in the form and tick the checkbox. It is not pre-ticked. Without the tick the form cannot be submitted, and our server rejects the request.
2. We send you an email with a confirmation link. It contains no advertising.
3. The link takes you to a page on our website. Your consent only applies once you click “Confirm now and get the guide” there (double opt-in). You then receive the download link, on the page and by email. It is valid for 7 days.

If you do not confirm, we will not contact you and you will receive nothing further. The confirmation link is valid for 14 days.

Wording of the consent

“Yes, I would like to receive the guide and I agree that AI-THINK. UG may contact me by email about AI-VI, audits and crisis exercises. I can withdraw this consent at any time by email to privacy@ai-think.de or via the unsubscribe link in every email. More in the privacy policy.”

Proof

As proof of your consent we record: your email address and name, the guide, the wording and version of the consent text, the time of the request and the time of confirmation, and the campaign details. These details reach us as two emails (on request and on confirmation) and are added to our list of consents (section 6f).

Purpose: sending the guide and contacting you by email about AI-VI, audits and crisis exercises
Legal bases: Art. 6(1)(a) GDPR and § 7(2) no. 2 UWG (your consent); for proof of consent Art. 6(1)(c) and (f) GDPR in conjunction with Art. 7(1) GDPR; for the campaign details Art. 6(1)(f) GDPR
Transmission: encrypted (TLS) to our own server in Germany (data centre in Nuremberg), from there by email to our mailbox at Microsoft 365 (section 6f). IP address and browser identifier are not included. No third-party form service is involved.
Retention period: see section 13

Withdrawal

You can withdraw your consent at any time without giving reasons:

• by email to privacy@ai-think.de
• by replying “Unsubscribe” to one of our emails
• via the unsubscribe link in every email you receive through this website (with a short confirmation on our page)

The withdrawal applies to the future. You may keep a guide you have already downloaded. We add your address to a block list so that we do not contact you again. You can sign up again with a new confirmation at any time.

Measuring the request

If you have consented to ad measurement, the page reports once after submission that a guide was requested (see section 6c). We do not transmit names or email addresses.

6f. AI-supported handling of enquiries

Enquiries from the forms on this website (sections 6 and 6e), appointment bookings (section 7) and emails to info@ai-think.de and privacy@ai-think.de reach us by email. To handle them we use two service providers, both as processors under Art. 28 GDPR.

Email and storage: Microsoft 365

Our mailboxes, drafts and calendars, our enquiry list, the files on individual prospects and the list of consents are hosted with Microsoft 365 (Exchange Online, OneDrive and SharePoint). The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The data is stored on Microsoft servers within the EU Data Boundary (European Union and EFTA). The basis is the data processing agreement for Microsoft products and services (Microsoft Products and Services Data Protection Addendum). For individual access, for example by support, a transfer to the USA cannot be ruled out. It is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Microsoft Corporation is certified, and on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We hold our online meetings with Microsoft Teams, which is part of this contract.

AI assistant: Claude (Anthropic)

An AI assistant, Claude on the Claude Team plan, supports us. It reads incoming emails in the mailboxes info@ai-think.de and privacy@ai-think.de and classifies them: enquiry, guide, consent, withdrawal, data protection request or advertising. It maintains the enquiry list and the list of consents including the block list, and prepares replies as drafts. In doing so it processes the details from your message, such as name, email address, phone number, company, role and the text of your message.

The assistant does not send you any emails. Every email to prospects is reviewed and sent by a person on our team. Data protection requests are always answered by a person. There is no automated decision-making within the meaning of Art. 22 GDPR.

The provider is Anthropic Ireland, Limited, Dublin, Ireland. We use the business plan Claude Team. The basis is Anthropic's Commercial Terms of Service with the Data Processing Addendum incorporated into them. Anthropic does not use content from this plan to train its models. Processing in the USA is possible. It is based on the EU Standard Contractual Clauses in the Data Processing Addendum (Art. 46(2)(c) GDPR).

Legal bases: Art. 6(1)(f) GDPR (legitimate interest in handling enquiries promptly and in an orderly way, also with AI support); for the list of consents Art. 6(1)(c) and (f) GDPR in conjunction with Art. 7(1) GDPR (proof of your consent, see section 6e)
Retention: see section 13
Objection: you can object at any time to processing based on Art. 6(1)(f) GDPR by email to privacy@ai-think.de.

6g. Spam protection of the forms (Cloudflare Turnstile)

We protect our forms against automated submissions with Cloudflare Turnstile. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile is only loaded when you start filling in a form, not when you open the page. It mostly checks invisibly whether a human is filling in the form. In doing so, Cloudflare processes your IP address, details about your browser and device (user agent, TLS characteristics) and the identifier of our website. According to Cloudflare, Turnstile sets no cookies for tracking purposes. On submission, our server checks the result with Cloudflare and transmits your IP address for this.

For bot detection on our website, Cloudflare is our processor (Art. 28 GDPR). To improve its bot detection, Cloudflare states that it processes the same signals as an independent controller on the basis of its legitimate interest.

Purpose: protecting the forms against spam and abuse
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in working, abuse-free forms); for access to your device § 25(2) no. 2 TDDDG (strictly necessary for submitting the form, which you requested)
Third-country transfer: USA, based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR); Cloudflare, Inc. is certified under the Data Privacy Framework.
Further information: Cloudflare privacy policy https://www.cloudflare.com/privacypolicy/ and Turnstile privacy addendum https://www.cloudflare.com/turnstile-privacy-policy/

6h. Email signatures (Signitic)

To design our email signatures in Microsoft 365 consistently, we use the service Signitic of SAS Positive Group Lyon, 3 Avenue Antoine Pinay, Parc d'Activités des 4 Vents, 59510 Hem, France (RCS Lille Métropole 900 837 667).

The signature is inserted into the email by an add-in in Outlook while it is being written; the content of our emails does not pass through Signitic's servers. Signitic processes names, job titles and contact details of our staff.

Links and banners in our signatures run via Signitic's servers, which evaluate clicks statistically. If you click such a link, Signitic processes technical data of the request (such as IP address and browser details) before redirecting you to the destination. According to the provider, the evaluation is anonymised for us; we cannot see who clicked.

Purpose: consistent external presentation and measuring the success of our communication
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a consistent external presentation and in measuring the success of our communication)
Data processing: A data processing agreement under Art. 28 GDPR is in place with Signitic.
Storage location: data centres in the EU (Amazon Web Services). Where data is transferred to third countries in individual cases, this is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Provider's data protection officer: dpo@signitic.com
Further information: https://www.signitic.com/en/resources/politique-de-confidentialite-signitic

7. Appointment booking (Calendly)

For booking demo and consultation appointments we use the service Calendly of Calendly LLC, 115 E Main St., Ste A1B, Buford, GA 30518, USA. Its EU representative under Art. 27 GDPR is DPO Centre Europe, Friedrichstraße 88, 10117 Berlin, Germany, email: eurep@calendly.com.

We do not embed Calendly in this website, we only link to it. No connection to Calendly is made before you click. In emails we also send appointment links in which your name and email address are already filled in, so you do not have to type them. These details only reach Calendly when you open the link.

Data processed

• Your details in the booking form: first name, last name, email address, desired topic and, if you wish, a message
• Appointment data: date, time, time zone, type of appointment and the link to the online meeting
• Technical data on calendly.com: IP address, browser, device, approximate location and time zone (to provide and secure the service)

Calendly checks free slots against our Microsoft 365 calendar and creates a Microsoft Teams link for the appointment (section 6f). Calendly sends you a confirmation and reminders by email. We receive a notification of the booked appointment with your details; it is handled like an enquiry (section 6f).

Roles: For the booking data, Calendly is our processor under Art. 28 GDPR; the basis is Calendly's Data Processing Addendum, which forms part of its terms of use. For visits to the website calendly.com itself, for example for cookies set there, Calendly is an independent controller. Calendly shows its own cookie banner for this.

Data transfer to the USA: Calendly processes data in the USA and uses further service providers, mostly in the USA. The transfer is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework of 10 July 2023 (Art. 45 GDPR); Calendly LLC is certified under the Data Privacy Framework. In addition, the EU Standard Contractual Clauses apply (Art. 46(2)(c) GDPR).

Purpose: arranging and managing demo and consultation appointments, sending appointment confirmations and reminders
Legal bases: Art. 6(1)(b) GDPR (pre-contractual measure at your request, the appointment you asked for); otherwise Art. 6(1)(f) GDPR (legitimate interest in efficient scheduling)
Retention with us: see section 13. At Calendly, as long as needed to manage appointments; we can delete appointment data in our account.
Calendly privacy notice: https://calendly.com/privacy
Data processing addendum (DPA): https://calendly.com/dpa
Sub-processors: https://calendly.com/help/calendly-sub-processors-gdpr-ccpa
Data Privacy Framework, Calendly entry: https://www.dataprivacyframework.gov/participant/6050

10. AI transparency

Some of the images on this website were generated by an AI system: the portraits of AI-VI and the avatar gallery. The people shown there do not exist, these are synthetic images, not photographs of real people.

We label this content directly at the point where it appears, with an "AI-generated" badge, so that it is recognisable at the moment you first see it.

Written with AI support are the articles in our blog: the first draft was produced with an AI system and then reviewed, revised and editorially signed off by a person. The figures they cite are backed by sources listed under each article.

Not AI-generated are: the photos of our team, product screenshots and the remaining written text on this website.

Background: Art. 50 of Regulation (EU) 2024/1689 (AI Act) requires that artificially generated or manipulated content be disclosed as such. The obligation has applied since 2 August 2026.
Questions about this: info@ai-think.de

11. Data processing in our products (AI-VI)

This section does not concern your visit to this website but the use of our products AI-VI Audit Assistant and AI-VI Cybersecurity Coach by our customers.

Our role

For our customers we process personal data as a processor pursuant to Art. 28 GDPR. The respective customer remains the controller. In every plan, customers receive a data processing agreement with the complete list of sub-processors.

For individual customer installations, different or additional service providers may be agreed. In that case, the list in the respective data processing agreement is authoritative.

Sub-processors

• netcup GmbH
  Purpose: operation of the application, databases, file storage and our own mail server, plus encrypted offsite backup.
  Location: data centre in Nuremberg, Germany; backup in the data centre in Vienna, Austria.
  Safeguard: processing within the EU; certified to ISO/IEC 27001:2022 (TÜV NORD, valid until 17 November 2027).
• Trooper.AI (Media Trooper GmbH, Idstein)
  Purpose: GPU servers on which our own models process text.
  Location: data centres in Germany.
  Safeguard: processing within the EU. In our products, our own models process the texts on these servers; uploaded documents do not leave the EU. For handling enquiries to us, by contrast, we use the AI assistant Claude (section 6f).
• Creatify Lab, Inc., Mountain View, USA
  Purpose: generation of the avatar videos.
  Location: USA, processing at Amazon Web Services, region us-west-2.
  Data transferred: only the answer texts reviewed and approved by the customer, from which the video is spoken. For a custom avatar, additionally the image and audio recordings of the person shown, who has given written consent beforehand.
  Safeguard: EU Standard Contractual Clauses 2021 (Module 2) pursuant to Art. 46(2)(c) GDPR in the Data Processing Addendum with Creatify. Transfers are encrypted. According to its own statement, Creatify does not use the data for training but only to provide the service. Generated videos and custom avatars are stored in our account at Creatify. We delete them there at the latest when the contract with the respective customer ends. Creatify accesses this data only through engineering and support for troubleshooting.

Operation at the customer and certification

In the Enterprise plan, the products can be operated in the customer's own infrastructure. In that case, too, the avatar videos are generated by the provider in the USA named above. AI-THINK. itself is not certified to ISO 27001 or SOC 2; the certification mentioned above belongs to the hosting provider.

12. Recipients and processors

These service providers receive personal data from visitors to this website or from people who contact us. The service providers of our products are listed in section 11.

13. Retention periods

• Enquiries that do not lead to an order: 12 months after the last contact
• Customers: according to statutory retention periods, for example under commercial and tax law
• Proof of consent: as long as we use the consent, then 3 years
• Unconfirmed guide sign-ups (no click on the confirmation link): deletion after 30 days. We also delete the notification about the sign-up after 30 days if you have confirmed; as proof of your consent we then keep only the confirmation (see proof of consent).
• Withdrawals: your email address remains on a block list so that we do not contact you again
• Server log files: 3 months, IP addresses shortened (section 5)

Our server does not store unconfirmed sign-ups. It only sends the details by email to our mailbox; the confirmation and download links carry their content themselves.

14. Your rights

You have the right to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent given (Art. 7(3) GDPR), at any time and without giving reasons, without affecting the lawfulness of processing carried out before the withdrawal
• Lodging a complaint with a data protection supervisory authority (Art. 77 GDPR)

You exercise all of these rights by email to privacy@ai-think.de. Data protection requests are always answered by a person.