Privacy Policy

1. Controller

Groundlens
Mirko Imperio Trotta
Lehrhöfer Straße 22
63457 Hanau, Germany
Email: [email protected]

2. Contact Form

When you submit a contact form inquiry, we collect:

• Name and email address
• Optional company name
• Message content
• Submission timestamp

Purpose: To respond to your inquiry and assess fit for our services.

Legal basis: Art. 6(1)(b) GDPR (pre-contract steps) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

Retention: We retain inquiry data for 12 months unless a contract is established.

Recipients: Formspree (for technical delivery of the contact form). Inquiries are then forwarded by email, reviewed manually, and may be handled in Google Workspace.

3. Qualification Form (Tally)

We use Tally.so for our qualification form.

Purpose: To collect your fit assessment information and scope requirements.

Legal basis: Art. 6(1)(b) GDPR (pre-contract steps).

When you submit the qualification form, Tally processes your data according to their privacy policy. We receive your submitted responses for internal review and follow-up.

4. “Ask Groundlens” Website Guide

When you send a message through the “Ask Groundlens” guide, we process the message, up to eight recent chat messages, a short working state derived from the conversation, your selected language, a random session identifier generated in your browser, the conversation turn, and technical connection data such as your IP address and request headers.

Purpose: To understand follow-up questions, provide a useful conversational reply, maintain bounded context during the open page session, route you to relevant public pages, protect the service from misuse, and maintain its security.

Operation: Our self-hosted n8n instance sends the current message, recent chat context, and bounded working state to the OpenAI API. The language model drafts a short reply using locked placeholders wherever Groundlens facts are needed. Separate deterministic Groundlens code validates the reply, replaces those placeholders with approved commercial facts, and supplies allowlisted links. The guide has no tool access and cannot create HubSpot or other CRM records, send emails or messages, arrange a callback, or write to customer or production systems. Guide conversations do not receive routine human review.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a voluntary, data-minimised website guide and operating it securely). Art. 6(1)(b) GDPR applies only where this processing is objectively necessary to take a specific pre-contract step that you request.

Recipients and location: The guide runs on infrastructure hosted by Hetzner in Germany. OpenAI Ireland Ltd. and OpenAI’s authorised sub-processors process the model request to provide the API service. Cloudflare terminates the encrypted website connection and forwards the full guide request, including message, recent context, and working state, to our origin; it also processes technical connection and security data as part of that service.

Retention: The recent chat history and working state are kept only in the memory of the open browser page and are cleared when the page is reloaded or closed. Completed n8n guide executions, including the message and request headers, are marked for deletion as soon as the response finishes and are normally removed permanently within about two hours. OpenAI states that API inputs and outputs are not used to train its models unless the customer explicitly opts in; its standard abuse-monitoring logs may contain inputs and outputs and are retained for up to 30 days by default, unless longer retention is required by law or necessary to protect the service or third parties. See OpenAI’s API data controls. Our origin proxy records connection metadata such as the IP address and request path, but not the message body, in one size-limited 10 MB log file; older entries are overwritten when that file rotates. Cloudflare retains request and security analytics according to the service, the Free Website plan, security needs, and legal obligations. Its current analytics documentation states that Free-plan request and security datasets are retained for at least 31 days. See Cloudflare’s retention information and privacy policy.

Do not enter contact details, credentials, confidential information, or personal information about other people. To contact a person, use the separate contact or qualification form.

5. Google Analytics

This website uses Google Analytics 4 only after your explicit consent to the Analytics category through the Klaro consent manager.

Purpose: Traffic measurement, usage analysis, and website improvement.

Legal basis: Art. 6(1)(a) GDPR (consent).

Activation: No Google Analytics scripts are loaded before consent. You can change your selection at any time through the consent settings.

6. HubSpot

HubSpot tracking on this website loads only after your explicit consent to the Marketing category.

Purpose: Marketing and CRM-related website analytics.

Legal basis: Art. 6(1)(a) GDPR (consent).

Activation: The HubSpot tracking script is not loaded before consent. Contact inquiries continue to be handled through Formspree, email, and manual review.

7. Stripe (Payments)

Stripe is not currently active on any live payment path on this website.

If website payments via Stripe are introduced in the future, we will update this privacy policy accordingly before activation.

8. Google Fonts

This website uses Google Fonts (IBM Plex Sans, IBM Plex Mono) loaded from Google's servers.

Purpose: Consistent typography and user experience.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website presentation).

Transfers: Your IP address is processed by Google servers when fonts are loaded.

9. Cookies

This website uses the open-source consent manager Klaro. It lets you manage the categories Necessary, Analytics, and Marketing.

Google Analytics loads only after analytics consent. HubSpot loads only after marketing consent. Stripe is still not active on any public website payment path.

Your consent choice is stored in a necessary consent cookie so we can respect your preference on future visits.

10. Data Transfers

When we use external service providers named in this privacy policy (for example Formspree, Tally, Cloudflare, OpenAI, or Google Workspace), personal data may be processed outside the EU/EEA, including in the USA.

For Cloudflare transfers to the USA, the EU–US Data Privacy Framework and its adequacy decision apply where available. Where that framework does not apply, Cloudflare’s Data Processing Addendum incorporates the EU Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914. You can obtain the safeguards in Cloudflare’s Data Processing Addendum.

For OpenAI processing of EEA data, the contracting processor is OpenAI Ireland Ltd. OpenAI’s Data Processing Addendum states that transfers by OpenAI Ireland to affiliates or third parties outside the EEA or Switzerland use the EU Standard Contractual Clauses or an applicable adequacy decision. See OpenAI’s Data Processing Addendum.

11. Your Rights

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Request limited processing
• Portability: Receive your data in a structured format
• Object: Object to processing based on legitimate interest

To exercise any of these rights, contact: [email protected]

12. Right to Complain

If you believe we have processed your data unlawfully, you have the right to complain to:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
https://datenschutz.hessen.de/

13. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit and access controls.

14. Changes to This Policy

We may update this privacy policy periodically. The current version is always available on this page.

Last updated: October 2026