Privacy Policy

1. Controller

Tarik Ermis / n3tz
Kaiserstr. 27, 66333 Völklingen, Germany
Email: mail@n3tz.ai
Phone: +49 6898 4989977

2. Overview of Processing Activities

We process personal data only to the extent necessary to provide our website and services. Processing is based on the GDPR, in particular:

• Art. 6(1)(b) GDPR – performance of a contract
• Art. 6(1)(f) GDPR – legitimate interest
• Art. 6(1)(a) GDPR – consent

3. Hosting and Content Delivery

The public marketing and information website n3tz.ai is provided as a static website through Cloudflare Pages by Cloudflare, Inc. When it is accessed, Cloudflare processes the technical access data required for delivery, security and error analysis (in particular IP address, timestamp, requested resource and browser/device information). The Empfang and Zentrale SaaS and backend services, including their application-data storage, run on servers of Hetzner Online GmbH in Nuremberg; Cloudflare protects and proxies their public endpoints as a DNS, CDN, DDoS-protection and TLS service. The legal basis for providing the website and security logging is Art. 6(1)(f) GDPR. Further details about providers and processing locations are set out in the DPA (German).

4. SaaS Services (Empfang, Zentrale)

When using our SaaS products, we process:

• Customer data: name, email, company, payment data (performance of a contract, Art. 6(1)(b))
• Usage data: login times, feature usage (legitimate interest, Art. 6(1)(f))

Insofar as we process personal data of the customer's end users on the customer's behalf (e.g. chat messages via Empfang), we act as a processor pursuant to Art. 28 GDPR. The published DPA (German) documents the data flows and safeguards and forms part of the main contract under section 7 of the Terms.

For AI telephony, the caller number transmitted by the telephony provider — unless withheld — may be processed in full and stored with the call record. It is used for the requested interaction, matching a returning caller, appointment bookings and callback handling requested by the caller; where such records are created, it may also appear in the associated appointment, lead or callback data. The current technical implementation does not automatically truncate or pseudonymize the number to its last four digits. The customer, as controller, determines the specific purpose and legal basis (typically Art. 6(1)(b) or (f) GDPR) and may use the feature only where a lawful processing purpose exists. The AI notice provides transparency; continuing the interaction is not treated as consent.

5. Payment Processing

Payments are processed via Stripe (Stripe Payments Europe, Ltd., Ireland). Stripe processes payment data as an independent controller in its own right. Further information: Stripe Privacy Policy.

6. AI Processing

To provide our AI features, we use language models (LLMs) from Google. For text processing — the live chat (Empfang) as well as server-side conversation summaries, lead extraction and website analysis (Zentrale) — text inference and data residency are configured on Google Vertex AI in the EU region. Contractual support, security and sub-processor access may still involve a third country and is governed by Google's DPA and the agreed transfer mechanisms. The AI live phone call (Gemini Live speech model) and the greeting voice output run on Google's Gemini models, which for real-time speech processing are currently available only in the USA.

The resulting transfer to the USA (limited to the AI live phone call and the greeting voice output) is based on the EU-US Data Privacy Framework (Art. 45 GDPR; Google LLC is DPF-certified) as well as supplementary Standard Contractual Clauses. The provisions and full list of sub-processors are documented in the DPA (German).

n3tz makes and stores no audio recording of its own. The production configuration does not request Gemini Live session resumption and therefore does not request the optional retention of conversation state for up to 24 hours. Google may nevertheless retain submitted prompts, contextual information and paid-service output for abuse monitoring and required disclosures for up to 55 days; because the provider documentation does not expressly exclude raw live-call audio, n3tz does not promise that exclusion. Google does not use paid-service prompts or responses to improve its products.

Gemini-based features are provided only for adult-facing administrative communication, reception and appointment processes. Tenants directed at or likely to be accessed by people under 18, as well as clinical practice, medical advice, diagnosis or treatment, require prior written confirmation from n3tz of a valid provider clearance or a suitable alternative processor.

7. Contacting Us

When you contact us by email or contact form, the submitted data (name, email, message) is stored in order to process your inquiry. Legal basis: Art. 6(1)(b) or (f) GDPR. Data is deleted once the inquiry has been resolved, unless statutory retention obligations apply.

8. Cookies and Traffic Measurement

A first ordinary visit to n3tz.ai does not set cookies or store an identifier. The browser language is evaluated locally to select an available German, English or French language URL automatically. Only if a visitor selects a language in the language menu is that functional preference stored as n3tz_locale in local storage for no more than twelve months; it is not used for analytics or profiling. Only after a visitor explicitly opens the Empfang chat does our own Empfang tenant additionally store a pseudonymous session identifier and the displayed chat timeline in that browser tab's session storage. Both chat entries end with the tab session. The language preference and chat entries are necessary for the respective function expressly requested by the visitor (section 25(2)(2) TDDDG).

The optional Google Tag and conversion-tracking function is technically disabled for our own Empfang tenant used on n3tz.ai. We therefore do not use tracking or marketing cookies, external traffic measurement or profiling on n3tz.ai. The exact storage inventory is available in our German Cookie Policy.

9. Your Rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)

To exercise your rights, please contact us at mail@n3tz.ai.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. Competent authority:
Unabhängiges Datenschutzzentrum Saarland (Independent Data Protection Authority of Saarland)
Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany

11. Retention Periods

Personal data is deleted as soon as the purpose of processing no longer applies and no statutory retention obligations (e.g. 6 years under the German Commercial Code (HGB), 10 years under the German Fiscal Code (AO)) prevent deletion.

12. Sub-processors

A current list of the sub-processors we engage can be found in the DPA (German).