Privacy.

This site sets no cookies and loads nothing from third-party servers. We count how many people visit it ourselves, on our own server (section 2, “Visitor count”). The count sets no cookies and stores nothing in your browser. That is why there is no consent banner.

This is a translation for your convenience. The legally binding version is the German Datenschutzerklärung.

1. Controller

2. Visiting the site

When you open a page, your browser sends technically necessary data to the server: IP address, time, the address requested, amount of data transferred, browser identifier and the page you came from. A page cannot be delivered without this information. To make page changes fast, your browser loads linked pages of this website in advance, from the same server.

If you type into the field “What still runs by hand at your company?” on the home page and continue, your browser carries the text in the last part of the address (/en/contact#frage=…) so that it shows up in the chat there as your first answer. The part after the hash sign is never sent to the server, and the page removes it from the address straight away. Nothing has been sent to us at that point. Only if JavaScript is switched off does the text travel as a normal part of the address (/en/contact?frage=…) and may then end up in the server log like any address.

Legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in operating the site without technical faults and in defending against attacks.

Visitor count

We count how many people open this site and where they come from ourselves, on our own server. For this, the page sends one short message per page view to our server once it has been visible for about two seconds. The message contains the page you opened (without the part after “?” or “#”), the language of the page, the name of the website you came from (for example google.com, without the exact address there), and whether your browser window is narrow, medium or wide (phone, tablet, computer).

Cloudflare (section 3) works out your rough country and region from your IP address, for example Germany and Baden-Württemberg, and passes both on to us with the request. We do not store your city.

So that we can tell visitors apart from page views, our server forms an encrypted value from your IP address, your browser identifier and a random value that is created anew every day. We store only this value, and only for the current day; after that we delete it together with the random value. After that, not even we can link an entry to an IP address. We do not store your IP address itself for the count and do not write it to any log.

What remains are totals per day: how many page views and visitors a page had, from which country and region, from which website and with which window width. We delete these totals after 25 months. Once a week our server sends them as a summary to an internal channel of our team on Discord (section 4); only these totals go there.

The count sets no cookies and stores nothing in your browser. We do not count search engine robots and other automated programs. If your browser sends the “Global Privacy Control” signal, the page sends nothing. You can also switch the count off on your device yourself: stop counting on this device. Your browser then remembers this (section 6) and the page no longer sends anything; count again undoes it. On this device right now: without JavaScript nothing is counted.

Legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is knowing the reach of our website: how many people visit it, which pages they read and how they find us. You can object to this at any time (Art. 21 GDPR), for example with the link above.

3. Hosting

This website runs on our own server in Germany, operated for us by our co-founder Jannis Dietrich. The database with conversations, appointments and potential checks and the files from the chat are stored there as well. He processes the data only on our behalf and on our instructions, under a data processing agreement (Art. 28 GDPR).

In front of the server sits Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Your browser connects to Cloudflare over an encrypted connection; Cloudflare passes the request on to our server over a separate encrypted connection and serves unchanging parts of the site such as fonts and images from its cache. In doing so, Cloudflare processes the data listed in section 2 and, because your browser’s encryption ends at Cloudflare, also the content of requests, such as your chat messages. Cloudflare acts as our processor; its data processing agreement (Data Processing Addendum) is part of our contract with Cloudflare. For transfers to the USA, Cloudflare is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); should that lapse, the European Commission’s standard contractual clauses agreed in the contract apply (Art. 46(2)(c) GDPR). Cloudflare keeps the data only as long as needed to deliver and protect the site.

Our server keeps operating logs: the address requested, time, result and duration, without your IP address. They are overwritten continuously; at most 30 MB per service are kept, the oldest entries go first. The legal basis for hosting and logs is Art. 6(1)(f) GDPR (running the site securely and fast).

So that nothing gets lost, we back up the database and files every night on our server. We delete each backup after 14 days. Anything you or we delete on the website therefore disappears from the backups as well within 14 days at the latest. The legal basis is Art. 6(1)(f) GDPR (protection against data loss) and Art. 32 GDPR.

4. Chat and email

On the contact page you can start a conversation with us. For this we process your name, your company (if given), your email address, your messages with their time and whether you want email notifications. This is stored in our database on our server in Germany (section 3). Legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract) or Art. 6(1)(f) GDPR.

By email you receive a confirmation of your address and, unless you switch it off, a message when we have replied (at most one every ten minutes). You can switch this off on the conversation page or via the link in every email. We send these emails via the service Resend (see “Sending emails and our mailbox”).

A secret link leads to your conversation. Anyone who has it can read the conversation, so please don’t pass it on. To prevent abuse we limit how often new conversations can be started. For this we briefly store an encrypted value derived from your IP address and your email address, never the IP address itself. These entries expire after 24 hours at most and are then deleted (legal basis Art. 6(1)(f) GDPR).

You can delete your conversation at any time on the conversation page. Otherwise we delete it twelve months after the last message, unless statutory retention obligations apply. We delete the copy at Discord 30 days later (see “Notifying our team”). You can also simply reach us by email instead of the chat.

Notifying our team

So that we can reply quickly, we also keep every conversation in a non-public channel on our server with the messenger Discord: with your name, your company, all messages (yours, ours and AI answers) and the files you or we send in the conversation. Your email address does not go to Discord; if you write from a company address, only its domain (such as “company.com”) appears in the channel topic, and nothing for addresses from large email providers. Only we read it there, and we also reply to you from there.

For users in the European Economic Area, the provider is Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands; the data is also stored and processed by Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA. Discord processes the content under its own terms of service and privacy policy (discord.com/privacy) and does not offer a data processing agreement. Discord bases transfers to the USA on the EU-U.S. Data Privacy Framework, under which Discord Inc. is certified (adequacy decision of the European Commission, Art. 45 GDPR), and on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). The legal basis for passing data to Discord is Art. 6(1)(f) GDPR: our legitimate interest in answering enquiries quickly, also on the go. If you would rather reach us without Discord, simply email us.

Retention: the channel exists as long as the conversation exists on the website. If you delete the conversation on the conversation page, or the twelve-month retention period runs out, we delete it and its files on the website right away. We then mark the channel at Discord as deleted, replies from there no longer reach you, and 30 days later we delete it with all messages and files. This lets us wrap up open points, such as an agreed appointment, and look into an accidental deletion. How long Discord keeps deleted content in its own systems after that is governed by its privacy policy.

Files in the chat (images and PDF up to 10 MB) are stored on our server in Germany (section 3). Your browser shrinks photos before sending and removes embedded details such as location and device. The files are retrievable only via the secret link to your conversation, and deleted together with the conversation; in the Discord channel they are kept like the messages.

Internal help from our AI in Germany. For each of your messages, a language model on our own server in Germany automatically writes a draft reply for our team. For this, our team bot reads the conversation from the Discord channel. The draft only appears in that channel, marked as a draft, and is never sent to you: what we reply is written by a person. This AI also sums up in one sentence, for our daily overview, what conversations waiting for our reply are about. At our team’s request, the team bot can also fetch the public home page of the domain of your company address and have the AI write a short assessment to prepare the conversation, likewise only in the channel. The AI itself stores nothing. Drafts and assessments then stay in your conversation’s channel at Discord and are deleted with it (see above); we delete the daily overviews after 30 days. Legal basis is Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries quickly and well prepared).

AI answer in the chat

On the conversation page you can request an automatically generated answer with the button “Get an instant AI answer”. Only then, and each time only for this one answer, do we send the messages of this conversation (yours and ours, at most the last 30) to Anthropic in the USA and have an AI language model write an answer. We do not send your name, your company or your email address, but we do send whatever you wrote in your messages yourself, and your most recent files from these messages (up to four images and one PDF of up to ten pages) so that the AI can take them into account. Without a click, nothing goes to Anthropic.

If you choose “Germany” instead of “USA” next to the button, nothing goes to Anthropic unless you expressly allow it (next paragraph). Our own language model then processes the same messages (at most the last twelve) and your most recent image from them on our own server in Germany. Like everything on this website, they get there encrypted via Cloudflare (section 3). On the server, the request and its result exist only in memory: while the request waits and runs (six minutes at most) and then for at most ten more minutes until the page collects the result. We store the answer itself as a message in your conversation and mirror it, like every message, to our Discord channel (see above). This takes longer than with the AI in the USA.

If the AI in the USA cannot be reached, for example because of a disruption at Anthropic or because our daily quota is used up, our AI in Germany writes the answer. You see this above the button and on the answer itself; the previous paragraph applies to that answer. If you chose “Germany” and our AI there cannot be reached, your conversation only goes to Anthropic if you allowed this beforehand with the tick box or confirm it at that moment with the button “Get the answer from the USA”. We do not store the tick box anywhere; it only applies while the page is open.

The answer appears as a separate message in your conversation, marked as an AI answer. We store it like your other messages (deletion and retention period as above). We store no other data about the request, apart from counters against abuse (at most three AI answers per conversation and day, plus the same encrypted value derived from your IP address as above), which are deleted after 24 hours at most. The purpose is to give you a first answer straight away; our team will also reply to you personally. Legal basis is Art. 6(1)(b) GDPR: you request the answer yourself with the click, as part of your enquiry to us.

Anthropic processes the data as our processor. Our contracting party is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland; the data is also processed by Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA. The data processing agreement (Data Processing Addendum) is part of Anthropic’s commercial terms, which we have accepted; transfers to the USA are based on the European Commission’s standard contractual clauses agreed there (Art. 46(2)(c) GDPR). Anthropic may not use the data to train its models and deletes inputs and outputs within 30 days. Only if Anthropic’s automated checks detect a breach of its usage policy does Anthropic keep them for up to two years.

Booking an appointment

On the page “Book a time” you can book an initial call. For this we process your name, your company (if given), your email address, one sentence about your topic, the time you chose, whether we talk by video or phone and, for phone, your phone number. This is stored like the chat in our database on our server in Germany (section 3). There is no account: a secret link leads to your appointment, where you can view and cancel it. We also enter the time, your name, your company, how we will talk, your topic and, for phone, your phone number in our own calendar, which runs on the same server (no further service provider, without your email address).

By email you receive a confirmation with links to the calendar file and to cancel, and a message if we have to reschedule or cancel the appointment. Our team also receives an email (sent via Resend, as for the chat). In addition, we post every booking, cancellation and rescheduling in a non-public channel on our server with the messenger Discord: with your name, your company, the time, how we will talk and your topic, and for phone also your phone number. Your email address does not go to Discord. The same applies to Discord as under “Notifying our team” above (provider, transfer to the USA, legal basis); we delete these posts automatically 120 days after they were written. To prevent abuse, we limit bookings per IP address and per email address, using the same encrypted values as for the chat, which are deleted after 24 hours at most.

The purpose is to arrange and hold the initial call with you. Legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract, at your request), and Art. 6(1)(f) GDPR for the limits. Retention: three months after the appointment we delete it with all details on the website and in our calendar, a cancelled appointment seven days after the cancellation (the calendar entry right away), unless statutory retention obligations apply.

Sending emails and our mailbox

This website sends its emails through the service Resend, from the address kontakt@yando-ki.de: the confirmation and the notices about our replies in the chat, the emails about your appointment, and the notices to our team. For this, Resend receives your email address, your name and the content of the email. In the chat that is your message or our reply with the link to the conversation; for an appointment it is the time, how we will talk and the links to the appointment. The emails to our team also contain your company, your topic and, for phone calls, your phone number.

The provider is Plus Five Five, Inc. (“Resend”), 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend processes the data as our processor; the data processing agreement (Data Processing Addendum) is part of Resend’s terms of service, which we have accepted. For our domain, Resend sends the emails from its data centre in Ireland. Resend stores the details of each email and the sending logs in the USA. For this transfer Resend is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); the standard contractual clauses of the European Commission agreed in the contract also apply (Art. 46(2)(c) GDPR). Resend keeps the emails and their details for 30 days. The legal basis is the same as for the chat and appointment booking: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the notices to our team (replying quickly).

If you write to contact@yando-ai.com or another of our addresses, or reply to one of our emails, your email arrives in our mailbox at Zoho Mail. We also write to you from there. Our contracting party is Zoho Corporation GmbH, Trinkausstr. 7, 40213 Düsseldorf, Germany. Our mailbox is held in data centres in the EU run by Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands. Zoho processes the emails as our processor. We requested the data processing agreement (Art. 28 GDPR) from Zoho on 19 October 2026. Where other companies of the Zoho group outside the EU, for example in the USA, access data, Zoho relies on the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). We read your email to answer your enquiry (legal basis Art. 6(1)(b) or (f) GDPR). We keep it for as long as we need it for that, and longer only where statutory retention obligations apply, for example for business letters.

5. Potential check

On the “Potential check” page you answer five questions about your business: industry, size, the software you use, where manual work arises and what annoys you most. We do not ask for your name or email address. Please do not enter names or your customers’ data in the free-text fields.

When you choose “Start the analysis”, we send your answers to Anthropic in the USA, where an AI language model picks matching suggestions from our catalogue and explains them. Anthropic does not receive your IP address. Without this click nothing goes to Anthropic. Contracting party, data processing, transfer to the USA and retention at Anthropic: see section 4, “Anthropic”.

If the AI in the USA cannot be reached, no other AI analyses your answers. The page then offers to send them to us in the chat; section 4 applies to that.

We store the result together with your answers under a random identifier in our database on our server in Germany (section 3), without any link to you personally, and delete it after 90 days. The identifier is part of the link to the result page after the hash sign; this part is not sent to any server. Anyone who has the link can see the result. You can delete it for good at any time on the result page. To prevent abuse we limit the number of analyses; for this we briefly store an encrypted value derived from your IP address, never the address itself, which expires after 24 hours at most and is then deleted.

In addition, we send your answers and the result (overall assessment, suggestions with reasons and open questions), together with the link to the result page, as a message to a non-public channel on our server with the messenger Discord. This lets us see what comes in and prepare a conversation. Whatever you write in the free-text fields, such as under “What annoys you most”, is sent exactly as you wrote it. The same applies to Discord as under “Notifying our team” in section 4 (provider, transfer to the USA, legal basis). If you delete the result on the result page, we also delete the message at Discord. Otherwise we delete it automatically 90 days after it was written, like the result on our server. How long Discord keeps deleted content in its own systems after that is governed by its privacy policy.

If you choose “Start a conversation” on the result page, the link to your result is in your first message in the chat. Once you send the conversation, the result is linked to your name and email address, and section 4 applies to both. If you delete the result on the result page, only the link in the message remains, and it then leads nowhere.

The purpose is to give you, at your request, a first assessment of what could be automated in your business and, if you wish, to prepare a conversation about it. The result page is marked as created with AI; it is an assessment, not a decision about you. Legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract), and Art. 6(1)(f) GDPR for the limit and the message to our team on Discord.

6. What is stored in your browser

No cookies. The site stores at most three small entries in your browser’s storage (localStorage or sessionStorage), all only when you do something yourself:

• Your conversation. If you start a conversation or open its link, your browser remembers the access key under the key gespraech, so you can find your conversation again. It is only sent to us when you open the conversation, to load it. If you delete the conversation, the entry disappears as well.
• An answer from our AI in Germany in progress. While it writes an AI answer for you in the chat, this tab remembers a request number in its session storage (sessionStorage) under the key ki-auftrag. If you reload the page, the page uses it to cancel the request instead of leaving it running. The entry disappears as soon as the answer has arrived, at the latest when you close the tab.
• Count switched off on this device. If you choose “stop counting on this device” in section 2, your browser remembers this under the key nicht-zaehlen with the value 1, so the page no longer reports your page views. The entry never leaves your device; “count again” deletes it.

The entries for conversation and count stay until you delete them in your browser. Legal basis is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act): they are strictly necessary to provide the conversation you started, the answer you requested or your objection to the count.

7. AI demo with your own file

On the use cases for incoming invoices, orders and enquiries you can choose to have a file of your own read (PDF or image, 5 MB at most). Only once you expressly agree in the form and click “Read it” does your browser send the file to our server. The server passes it, together with the use case and the language of the page, to Anthropic’s AI in the USA, which reads it. The file is sent with everything it contains, including names, addresses or other personal data in the document. Your IP address is not sent to Anthropic. The purpose is solely to show you the result in the demo.

If you choose “Germany” instead of “USA” in the form (photos and scans only), nothing goes to Anthropic, not even for counting, unless you separately agree to it (next paragraph). Our own language model then processes the file on our own server in Germany; it is not stored. Like everything on this website, it gets there encrypted via Cloudflare (section 3). File and result exist only in the server’s memory: while the request waits and runs (six minutes at most) and then for at most ten more minutes until the page collects the result. We log only the use case, file type, image size, duration and status. Everything else in this section applies in the same way.

If you chose “USA” and the AI there cannot be reached, our AI in Germany reads your file (photos and scans only); your consent covers this, and its wording says so. A file you released for “Germany” only goes to the USA if you separately agreed: beforehand with the second tick box, or at that moment with the button “I agree, read it in the USA”. The result shows which AI read the file.

With the AI in the USA, the recipient is Anthropic; the data is also processed in the USA. Contracting party, data processing, transfer to the USA and retention at Anthropic: see section 4, “Anthropic”.

We store nothing. The file and the result exist only in the server’s memory for the duration of the request and end up neither in a database nor in a log. We only log that a reading took place: use case, file type, number of pages, whether the file fitted the use case, duration and the number of tokens processed. Before the reading, we have Anthropic count free of charge how large the file is; for this it is sent there a first time. To prevent abuse we count, as for the chat, how often the demo was called and used, using an encrypted value derived from your IP address (at most five readings an hour and 20 a day). These entries expire after 24 hours at most and are then deleted the next time the demo or the chat is used.

The legal basis is your consent (Art. 6(1)(a) GDPR); counting against abuse is based on our legitimate interest (Art. 6(1)(f) GDPR). You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR) by not sending any further file; a reading that has already run is complete, and nothing of it remains with us. Please only upload documents you may share, ideally a sample or a redacted copy. The result is generated by AI and may contain errors.

8. Your rights

• Access to the data held about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)

An informal message to the address above is enough. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR); the authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

9. Changes

If the site or the law changes, this policy will be updated. The version published here always applies.

As of: 19 October 2026