1. Controller
The controller under the General Data Protection Regulation (GDPR) is: Nexaluna AI Solutions UG (haftungsbeschränkt) Renkenweg 23 83209 Prien am Chiemsee Germany Email: info@nexaluna.ai Phone: +49 151 28858234
2. Scope
This policy applies to the corporate website at nexaluna.ai, including its English-language pages, and to the communication channels we operate: telephone, including our AI voice assistant, web chat and WhatsApp Business.
Linked products and platforms—particularly PostMaestro.ai—are governed by their own privacy notices.
3. Hosting and delivery
The website is delivered using Amazon Web Services EMEA SARL (AWS). Static content is stored in Amazon S3 and delivered over encrypted connections through Amazon CloudFront. Primary resources run in the Europe (Frankfurt) region. CloudFront uses a global network of edge locations.
When you access the site, technically necessary connection data may be processed, including IP address, date and time, requested resource, referrer and browser or device information. Processing is based on our legitimate interest in secure and efficient delivery under Article 6(1)(f) GDPR.
We have concluded data processing terms with AWS. Where processing outside the EEA cannot be excluded, appropriate safeguards, including EU Standard Contractual Clauses, are used.
4. Technical logs
Logs for the contact interface and error diagnosis are limited to what is necessary. Message content is not written to application logs. Logs are generally deleted after a short period unless security-related retention is required.
5. Contact requests
If you contact us by email or form, we process your contact details, company information and message to respond to your request.
The form is processed through Amazon API Gateway and AWS Lambda and delivered to our inbox through Amazon Simple Email Service (SES). We do not operate a separate database for form messages.
Processing is based on Article 6(1)(b) GDPR where it relates to pre-contractual steps and otherwise on Article 6(1)(f) GDPR. Data is deleted when no longer required, subject to statutory retention duties.
6. Telephony, web chat and WhatsApp (Twilio)
We use the Twilio communications platform (Twilio Ireland Limited, 3 Dublin Landings, North Wall Quay, Dublin 1, Ireland) for inbound and outbound calls, for the web chat on our website and for WhatsApp Business communication. Our business phone number is also provided through Twilio.
Depending on the channel, we process your phone number or WhatsApp identifier, the date, time and duration of the connection, connection and delivery status, the content of chat and WhatsApp messages and—for calls handled by our AI voice assistant—the audio of the conversation and the transcripts generated from it.
Twilio processes this data as our processor. We configure Twilio so that processing and storage take place in the EU region (Ireland data residency). The basis is the Twilio Data Protection Addendum, including the EU Standard Contractual Clauses, available at https://www.twilio.com/en-us/legal/data-protection-addendum. Processing in third countries, for example for support or operational purposes, cannot be entirely excluded and is then based on appropriate safeguards under Chapter V GDPR.
When you use WhatsApp, the underlying infrastructure is operated by WhatsApp Ireland Limited and Meta Platforms Ireland Limited. Metadata such as your phone number, timestamps and device data is processed there under the provider’s own responsibility, and transfers to the United States are possible. If you wish to avoid this, please use email, telephone or our contact form.
Processing is based on Article 6(1)(b) GDPR where the communication relates to pre-contractual steps or contract performance, and otherwise on our legitimate interest in efficient customer communication and availability under Article 6(1)(f) GDPR. Where a call is recorded or analysed beyond mere connection handling, this is based solely on the consent obtained at the start of the call under Article 6(1)(a) GDPR. You may withdraw consent at any time with future effect, end the call at any time or contact us by email instead.
7. AI voice assistant (ElevenLabs)
Our voice assistant uses services provided by ElevenLabs Inc., 169 Madison Ave #2484, New York, NY 10016, USA, for speech recognition, dialogue handling and speech synthesis.
This involves processing the audio of your contributions to the conversation, the resulting transcripts and the context needed to answer your request (for example your concern, a requested appointment or contact details you provide). ElevenLabs processes this data solely on our instructions.
We have concluded a data processing agreement with ElevenLabs, including the EU Standard Contractual Clauses as an appropriate safeguard for transfers to the United States (Article 46(2)(c) GDPR). Contractually, your conversation data is not used to train the provider’s general AI models.
No conversation data is stored at ElevenLabs. We operate the assistant with zero retention at the provider: audio and transcripts are processed there only transiently, for as long as the immediate answer within the running conversation requires, and are not retained afterwards. No conversation archive or recording is created at ElevenLabs that we or anyone else could access later.
Transcripts and audio recordings are only stored permanently if you expressly agree to this at the start of the call or chat. In that case the transcript and the recording are held solely on our own server in Germany (AWS Europe, Frankfurt region) in the CRM system we developed ourselves—not at ElevenLabs and not with any other third party. Without your agreement we keep neither audio nor transcripts.
Processing is based on Article 6(1)(b) or (f) GDPR and, for storing transcripts and voice recordings, on Article 6(1)(a) GDPR. You may withdraw your agreement at any time with future effect, and we will delete the recording. You can also ask to speak to a human at any time, in which case we handle your request without AI assistance.
8. CRM system and customer data
We manage enquiries, conversation outcomes and customer relationships in a CRM system we developed ourselves. We do not use third-party CRM software.
We store in particular your name, company, contact details, the channel and time of contact, the content or a summary of your enquiry, and the processing and proposal status.
Transcripts and audio recordings from calls and chats with our AI assistant only reach the CRM if you agreed to them being stored at the start of the conversation. They are then held solely on our own server in Germany; no conversation data remains with the provider of the voice assistant (ElevenLabs).
The CRM runs on Amazon Web Services EMEA SARL (AWS) infrastructure in the Europe (Frankfurt) region. Data is encrypted in transit and at rest; access is limited to authorised staff and is logged. We have concluded a data processing agreement with AWS, and the EU Standard Contractual Clauses apply to any third-country elements that cannot be excluded.
Processing is based on Article 6(1)(b) GDPR for initiating and performing contracts and on Article 6(1)(f) GDPR for our legitimate interest in orderly customer and enquiry management. We delete data once the purpose ceases to apply, at the latest after statutory commercial and tax retention periods of up to ten years. Data from enquiries that do not lead to a contract is generally deleted within 24 months.
9. Newsletter
We use a double opt-in procedure for our newsletter: after you sign up, we send an email to the address you provided and ask you to confirm it. Only once you click the confirmation link do we add the address to the distribution list. If confirmation is missing, we delete the sign-up after seven days.
We process your email address, the language you selected, the time of sign-up and confirmation, the place on the website where you signed up and a non-reversible hash of your IP address. This information is used solely to send the newsletter and to evidence your consent; we do not store the IP address itself.
Processing is based on your consent under Article 6(1)(a) GDPR and, for logging the sign-up, additionally on our legitimate interest in being able to evidence it under Article 6(1)(f) GDPR. Delivery uses Amazon Simple Email Service (SES) provided by Amazon Web Services EMEA SARL; the distribution data is held in our own system in the Europe (Frankfurt) region.
We do not measure success using tracking pixels, open rates or click tracking.
You can withdraw your consent at any time with future effect: via the unsubscribe link at the end of every newsletter email, via the form below, or informally to info@nexaluna.ai. After you unsubscribe we remove the address from the distribution list; evidence of the sign-up and the unsubscription is kept for up to 90 days and then deleted.
10. Cookies, consent and analytics
On your first visit, a bar at the bottom of the page asks which services may run. Until you decide, we only store entries that are indispensable for operating the website: your privacy choice itself, the link between a running chat and its session, and the detection of technical faults. This is based on Section 25(2)(2) TDDDG in conjunction with Article 6(1)(f) GDPR.
All other services are grouped into the purposes "Functional", "Analytics" and "Marketing" and stay disabled until you consent. The legal basis is then your consent under Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR. Declining puts you at no disadvantage; all content remains fully accessible.
For analytics we use Google Analytics 4 once you have consented, and Google Ads to measure how our advertising performs. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This involves processing the pages you visit, time on page and interactions, the source of your visit, an approximate location at city level and device and browser details. Your IP address is truncated before it enters the analysis, and we do not combine it with other data sets or with your Google account. Google retains the event data for a maximum of 14 months.
We use Google Consent Mode v2. Before you consent, no Google script is loaded and no connection to Google servers is established. Once consent is given, a transfer to Google LLC in the United States cannot be excluded. Google LLC is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), and the EU Standard Contractual Clauses apply in addition. Please note that US authorities may be able to access this data and that you may not have legal remedies comparable to those in the EU.
We keep your choice for twelve months, together with the time and a reference number, in your browser’s local storage so that we can honour and evidence it. Withdrawal takes effect for the future, and we delete the cookies belonging to the purposes you switched off.
Our cookie policy lists every service with its provider, cookie names, retention periods and purposes. You can also change or withdraw your choice directly there.
11. External links and social media
The website links to external services and our social profiles. Data is only sent to the relevant provider when you actively open a link. The external provider is responsible for subsequent processing.
12. Your rights
Where the statutory conditions are met, you have rights including:
- access to your personal data
- rectification of inaccurate data
- erasure or restriction of processing
- data portability
- objection to processing based on legitimate interests
- withdrawal of consent with future effect
13. Right to complain
You may complain to a data protection authority. Our competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, poststelle@lda.bayern.de, www.lda.bayern.de.
14. Updates
We update this policy when technical functions or legal requirements change. The published version is authoritative.
