Logo

Privacy Policy

1. Controller

The controller within the meaning of Art. 4(7) of the EU General Data Protection Regulation (GDPR) is

cdot GmbH
Stubenring 24/13
1010 Wien
Austria

2. Data Protection Contact

For questions and concerns regarding data protection, you can contact us at any time at hello@cdot.ai.

3. Personal Data

Personal data is any information relating to an identified or identifiable natural person. Examples include name, address, email address, telephone number, date of birth, age, gender, social security number or IP address. In addition, there are special categories of personal data (“sensitive data”). The GDPR considers health data, for example, to be such data.

4. Processing of Personal Data

4.1 Contact Form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass on this data without your consent. Legal basis: Art. 6(1)(f) GDPR.

4.2 Website

We automatically collect and store information in so-called server log files, which your browser automatically transmits to us. These are technically necessary to display our website to you and to ensure its stability and security. This information comprises:

  • Browser type and browser version
  • Operating system used
  • Referrer URL
  • Hostname of the accessing computer
  • Time of the server request
  • IP address

Legal basis: Art. 6(1)(f) GDPR.

4.3 Log File Processing and LLM Observability

Pydantic
Pydantic Services Inc., 1207 Delaware Ave #1225 Wilmington, DE 19806, USA

Link to their privacy policy: https://pydantic.dev/legal/privacy-policy

In the course of operating our software products, we collect and store server log files. In addition, we use the Pydantic Logfire system to collect and store server log files and, within our LLM applications, to process data for the technical monitoring, logging and analysis of the processing of requests and outputs (“LLM observability”). The processing serves in particular to ensure technical operation, error analysis, IT security, and the monitoring and improvement of the quality, stability and performance of our systems. The collected data is not used for our own model development or for training new models of our own. Legal basis: Art. 6(1)(f) GDPR.

4.4 Newsletter

You have the option of subscribing to our newsletter. For this purpose, we process your first and last name (if provided) and your email address. The data is used to send you information about updates and new developments. Providing your last name is optional. You can cancel your newsletter subscription at any time. After unsubscribing, we will no longer use your data for sending the newsletter. If we have no business relationship with you and are not subject to any statutory retention obligations, your data will be deleted after you unsubscribe from the newsletter. Consent can be withdrawn at any time with effect for the future, for example via the unsubscribe link in each newsletter or by informal notice to us. Legal basis: Art. 6(1)(a) GDPR.

4.5 Demo Requests

If you request a demo of our software products, we process your first name, your email address and the message you submit with your request. Optionally, you can provide your last name, telephone number and company name. The processing is carried out to handle your request and to contact you to arrange an appointment. Legal basis: Art. 6(1)(b) GDPR.

4.6 Software Products

For registering for and using our software products, we process in particular information about your organization, your email address, your first and last name, and billing information. Legal basis: Art. 6(1)(b) GDPR for the provision and use of our software products, and Art. 6(1)(c) GDPR for the processing of billing information in the context of our retention obligations under tax and commercial law.

4.7 Third-Party Providers, Service Providers and Suppliers

4.7.1

To provide, operate and further develop our website and software products, we use various external service providers and technical providers. Insofar as personal data is processed in this context, this is done in accordance with the applicable data protection regulations and, where necessary, on the basis of a data processing agreement pursuant to Art. 28 GDPR.

4.7.2

These include in particular the following providers:

Vercel
Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States

EU representative: Vercel Inc. c/o EDPO, Avenue Huart Hamoir 71, 1030 Brüssel, Belgien

Link to their privacy policy: https://vercel.com/legal/privacy-policy

Our website and the frontend of our products are hosted by Vercel Inc. Personal data is transferred on the basis of the standard contractual clauses pursuant to Art. 46 GDPR.

Amazon Web Services (AWS)
Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxemburg

Link to their privacy policy: https://aws.amazon.com/de/privacy/

AWS is used for LLM inference.

Supabase
Supabase Pte. Ltd., 65 Chulia Street, #38-02/03 OCBC Centre, Singapore, 01 049513 Singapore

Link to their privacy policy: https://supabase.com/privacy

Supabase is used as a database, for file storage and for authentication.

DigitalOcean
DigitalOcean LLC, 105 Edgeview Drive, Suite 425, Broomfield, CO, 80021

EU representative: Digitalocean Eu B.V., Zekeringstraat 17A, 1014 BM, Amsterdam, Netherlands

Link to their privacy policy: https://www.digitalocean.com/legal/privacy-policy

DigitalOcean is used to provide the backend infrastructure.

Notion
Notion Labs, Inc. 685 Market Street San Francisco, CA 94105 United States

Link to their privacy policy: https://notion.notion.site/Privacy-Policy-3468d120cf614d4c9014c09f6adc9091

Notion is used as an internal documentation system and for customer relationship management (CRM).

Google Workspace
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, Muttergesellschaft: Google LLC (USA)

Link to their privacy policy: https://policies.google.com/privacy?hl=de

We use Google Workspace for email communication and the central document and file management of cdot GmbH.

Lettermint
Lettermint B.V., Willemsvaart 16 B, 8019 AB Zwolle, Niederlande

Link to their privacy policy: https://lettermint.co/de/datenschutz

Lettermint is used as an email service provider.

4.7.3

Depending on the nature and purpose of the respective processing, contact data, usage data, technical data, communication content, billing information and data on the use of our software products may in particular be transmitted to the service providers named. The processing of personal data by the service providers we use is in each case based on the legal basis under Art. 6 GDPR that is relevant for the specific processing purpose.

4.7.4

Some of the service providers we use (Notion and Google Workspace) also process personal data in countries outside the European Union or the European Economic Area (“third countries”), in particular in the USA. In these cases, we ensure that an adequate level of data protection is guaranteed, for example by concluding EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR with the respective provider, through an adequacy decision of the European Commission pursuant to Art. 45 GDPR, or through other appropriate safeguards within the meaning of Art. 44 et seq. GDPR. You can request a copy of the respective safeguards via the contact address given in section 1.

5. Storage Period and Data Deletion

In line with the principle of data minimization, we store personal data only for as long as is necessary for the respective processing purpose. As soon as the respective legal basis for data processing under Art. 6 GDPR ceases to apply (e.g. the purpose has been achieved, the contract has ended, consent has been withdrawn, etc.), we delete the data unless statutory retention obligations prevent this. In particular: server log files are deleted after 30 days, the period required for IT security and error analysis; data from contact form, demo and newsletter requests is deleted as soon as the request has been conclusively processed or consent has been withdrawn and no further follow-up communication takes place; data relating to the use of our software products is processed for the duration of the contractual relationship and beyond that within the scope of statutory retention obligations. In accordance with the retention obligations under tax and commercial law pursuant to § 132 of the Austrian Federal Fiscal Code (BAO) and §§ 190 and 212 of the Austrian Commercial Code (UGB), we retain in particular invoices and accounting records for 7 years.

6. Automated Decision-Making and Profiling

We do not make any decisions based solely on automated processing – including profiling – that produce legal effects concerning you or similarly significantly affect you. The processing of personal data in connection with our website, our software products, the handling of contact and demo requests, the sending of newsletters, and technical logging and LLM observability serves in particular technical provision, IT security, error analysis, communication and contract performance. It is not carried out for the purpose of automatically evaluating personal aspects or automatically making decisions about you.

7. Data Protection Rights

7.1

Data subjects have the right to:

  • Access to the stored data pursuant to Art. 15 GDPR: You have the right to clear, transparent and easily understandable information about how we use your personal data and what rights you have.
  • Rectification of inaccurate data pursuant to Art. 16 GDPR: You have the right to have your personal data corrected if it is inaccurate or incomplete.

  • Erasure of data pursuant to Art. 17 GDPR: You can request the erasure of your personal data if there is no compelling reason for us to continue using it. This is not a general right to erasure, but can be asserted in particular in the following cases:

    • Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
    • You withdraw the consent on which the processing was based and there is no other legal basis for the processing;
    • You object to the processing of your data and (in the case of processing based on legitimate interest) there are no overriding legitimate grounds for the processing;
    • Your personal data has been processed unlawfully;
    • The erasure of your personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which we are subject;

    This right is also subject to exceptions that may entitle us to retain your data. This is particularly the case where we exercise our right to freedom of expression and information, for reasons of public interest in the area of public health, or where we need your data for the establishment, exercise or defence of legal claims.

  • Restriction of processing pursuant to Art. 18 GDPR: You have the right to request that the processing of your personal data be restricted. If processing is restricted, we may continue to store your personal data but will not use it further. You have this right in the following cases:

    • If you contest the accuracy of your personal data, for a period enabling us to verify the accuracy of your personal data;
    • If the processing is unlawful and you request the restriction of use of the personal data instead of its erasure;
    • If we no longer need your personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims;
    • If you object to the processing and it has not yet been determined whether our legitimate grounds override your grounds for objection.
  • Objection to processing pursuant to Art. 21 GDPR: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on legitimate interest; this also applies to profiling based on these provisions. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
  • Data portability pursuant to Art. 20 GDPR: You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit this data to another controller without hindrance from us.
7.2

Where processing is based on consent, the data subject may withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

7.3

Data subjects have the right, irrespective of any other legal remedies, to lodge a complaint with the supervisory authority – in Austria, this is the Data Protection Authority (Datenschutzbehörde). Its address is:

Österreichische Datenschutzbehörde
Barichgasse 40 – 42
1030 Wien
Tel. +43 1 52 152-0

Last updated on 17 September 2026