Privacy Policy

As of: 21 October 2026 · Pursuant to Art. 13, 14 and 21 GDPR and § 25 TDDDG

Preamble

Protecting your personal data matters to us. In this privacy policy we explain, in line with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG), which personal data we process when you visit our websites www.cogswell.de and www.cogswell.at and use our services, for what purposes, on what legal basis, and what rights you have.

Personal data means any information relating to an identified or identifiable natural person (Art. 4 (1) GDPR), for example name, address, email address, IP address, device identifiers or your usage behaviour on our website.

1. Controller, Contact and Scope

The controller within the meaning of the GDPR and other data protection laws is:

Cogswell IT
Owner: Joshua Cogswell
Georg-Moller-Weg 29
64625 Bensheim
Germany

Phone: +49 6251 9743999
Email: office@cogswell.de
Web: www.cogswell.de

Data protection officer: Given the size and activities of our business, there is no legal obligation under § 38 BDSG to appoint a data protection officer. Please send data protection requests to the contact details above.

Scope: This privacy policy applies to our websites www.cogswell.de and www.cogswell.at and to the services described here (forms, booking, chatbot, phone system, customer platform, remote support). Supplementary notices apply to individual services and are referenced where relevant: the customer platform at cxhub.cogswell.net/datenschutz, the chatbot at chat.cogswell.app/datenschutz.html and the Cogswell Eat product website at eat.cogswell.app/datenschutz.

2. Definitions

We follow the definitions of Art. 4 GDPR. The most important ones briefly explained:

• Personal data (Art. 4 No. 1 GDPR): All information relating to an identified or identifiable natural person.
• Processing (Art. 4 No. 2 GDPR): Any operation performed on personal data with or without automated means.
• Restriction of processing (Art. 4 No. 3 GDPR): Marking stored data with the aim of limiting its future processing.
• Profiling (Art. 4 No. 4 GDPR): Automated processing of personal data to evaluate personal aspects.
• Pseudonymization (Art. 4 No. 5 GDPR): Processing in such a way that the data can no longer be attributed to a specific person without additional information.
• Controller (Art. 4 No. 7 GDPR): The entity that decides on purposes and means of processing.
• Processor (Art. 4 No. 8 GDPR): A natural or legal person who processes personal data on behalf of the controller.
• Recipient (Art. 4 No. 9 GDPR): Any natural or legal person to whom data is disclosed.
• Consent (Art. 4 No. 11 GDPR): Any freely given, specific, informed and unambiguous declaration of intent.
• Third country: A state outside the EU or the European Economic Area (EEA).

3. General Information on Data Processing

3.1 Scope and Purpose

We only process personal data where this is necessary to provide a functioning website and our content and services, or where you have consented. We follow the principles of data minimisation and purpose limitation (Art. 5 GDPR).

3.2 Legal Bases (Art. 6 (1) GDPR)

• (a) your consent,
• (b) performance of a contract or pre-contractual measures at your request,
• (c) compliance with a legal obligation, such as commercial and tax retention duties,
• (f) our legitimate interests, unless your interests override them. We name the specific interest for each processing operation.

Where information is stored on or read from your device, § 25 TDDDG also applies: strictly necessary access takes place without consent (§ 25 (2) no. 2 TDDDG), everything else only with your consent (§ 25 (1) TDDDG). For visitors from Austria, § 165 (3) TKG 2021 applies accordingly.

3.3 Deletion and Retention

Personal data is deleted or anonymised as soon as the purpose of storage no longer applies. We only keep it longer where statutory retention obligations apply (in particular § 257 HGB and § 147 AO: 6, 8 or 10 years) or where the data is needed to establish, exercise or defend legal claims (regular limitation period under § 195 BGB: 3 years). An overview is provided in Section 21.

3.4 Obligation to Provide Data

You are under no statutory or contractual obligation to provide us with personal data. Without the details marked as required, however, we cannot process an enquiry, booking or order. The details required to conclude and perform a contract are necessary for that contract.

4. Your Rights as a Data Subject

4.1 Right of Access (Art. 15 GDPR)

You have the right to know whether and which personal data we process about you, including processing purposes, data categories, recipients, planned storage duration, origin, automated decision-making and (for third-country transfers) Art. 46 GDPR safeguards.

4.2 Right to Rectification (Art. 16 GDPR)

You have the right to immediately demand the correction of incorrect data or the completion of incomplete data.

4.3 Right to Erasure ("Right to be Forgotten", Art. 17 GDPR)

You may request deletion of your data unless processing is necessary for the right to freedom of expression and information, compliance with a legal obligation, public interest, or for the assertion, exercise or defense of legal claims.

For a structured deletion request, please use our form: Submit a data deletion request →

4.4 Right to Restriction of Processing (Art. 18 GDPR)

You may request restriction of processing if you contest the accuracy of the data, the processing is unlawful, or we no longer need the data but you need it to assert, exercise or defend legal claims.

4.5 Right to Data Portability (Art. 20 GDPR)

You have the right to receive the data you have provided in a structured, common and machine-readable format, or to demand its direct transmission to another controller, where technically feasible.

4.6 Right to Object (Art. 21 GDPR)

Where we process your data on the basis of legitimate interests (Art. 6 (1)(f) GDPR), you have the right to object to such processing at any time for reasons arising from your particular situation. You may object to processing of your data for direct marketing purposes at any time without giving reasons (Art. 21 (2) GDPR).

4.7 Right of Withdrawal (Art. 7 (3) GDPR)

Once given (e.g. for cookies, analytics, advertising), you may revoke consent at any time with effect for the future. The legality of processing carried out until withdrawal remains unaffected. You can exercise withdrawal for cookie consents at any time via the cookie settings symbol (bottom left of the website).

4.8 Right to Complain (Art. 77 GDPR)

You may complain to any EU data protection supervisory authority. Responsible for us:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit Postfach 3163, 65021 Wiesbaden, Germany Phone: +49 611 1408 - 0 Email: poststelle@datenschutz.hessen.de Web: datenschutz.hessen.de

If you live in Austria, you can also contact the Austrian Data Protection Authority (Österreichische Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, phone +43 1 52 152-0, email dsb@dsb.gv.at, web dsb.gv.at.

4.9 Exercising Your Rights

A simple email to office@cogswell.de is sufficient. We respond within the period of Art. 12 (3) GDPR (usually one month, extendable by two further months). We may request appropriate evidence to verify identity.

5. Hosting, Server Log Files and Form Log

5.1 Hosting Provider

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Our websites, the form interface, the phone system and the remote support server run on a server in the Nuremberg data centre, Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner. No transfer to third countries takes place as part of hosting.

5.2 Server Log Files

Each time you access our websites, the web server automatically stores:

• the shortened IP address (IPv4 without the last block, IPv6 only the first 48 bits), so that it cannot be traced back to your connection,
• date and time of access,
• request method and requested address without parameters, protocol version,
• HTTP status code and amount of data transferred,
• referrer URL (the previously visited page) and the browser identifier (user agent).

Web server error logs may contain the full IP address in the event of technical errors.

Purposes: stability, security, defence against attacks and error diagnosis. Legal basis: Art. 6 (1)(f) GDPR; our legitimate interest is the secure and stable operation of the websites. Retention: access and error logs are deleted automatically after 7 days. We only keep them longer in the event of a specific security incident until it has been resolved.

5.3 Form Interface Log

When you submit a form, our form interface logs the time, the shortened IP address, the function called (e.g. contact request), the technical result and the browser identifier. This serves abuse detection and error analysis (Art. 6 (1)(f) GDPR). Entries are deleted automatically after 30 days.

To limit mass requests (rate limiting), we briefly store a non-reversible hash of your IP address together with a counter. These entries expire after one hour at the latest and are deleted regularly. To prevent automatic confirmation emails from being sent in bulk to other people's addresses, we also store a non-reversible hash of the email address you enter for 10 minutes; within that time, the same address receives at most one confirmation.

6. Cookies, Browser Storage and Consent

6.1 Principle

We deliberately use as little as possible: no tracking cookies, no web analytics and no advertising networks. What we store in your browser serves the operation of the website or your own settings. The full list of all entries is available in our cookie policy (German).

6.2 Entries Used

In addition, there are technically necessary entries from Cloudflare Turnstile (Section 9), from Stripe on its payment page (Section 8) and, once you open the chat, from the chatbot (Section 10).

Legal basis: § 25 (2) no. 2 TDDDG or § 165 (3) TKG 2021, as the entries are strictly necessary for a service you have expressly requested, together with Art. 6 (1)(f) GDPR (legitimate interest in a functional, user-friendly website).

6.3 Cookie Banner and Withdrawal

Our cookie banner offers the category “AI features” for the AI solution suggestion in the search (Section 10.4) as well as the categories “Statistics” and “Marketing”. Statistics and Marketing are currently not active: even if you agree, only your choice is stored and no analytics or advertising services are loaded (see Section 12). Should we use such services in future, we will update this policy and ask for your consent again beforehand (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG).

You can change or withdraw your choice at any time via the “Cookie settings” link in the footer of every page or in the cookie policy. You can also delete cookies and browser storage in your browser settings; individual functions such as form protection may then be restricted.

7. Contact, Forms, Booking and Orders

7.1 Contact Forms and Enquiries

When you write to us via a form, we process the details you enter to handle your enquiry. This applies in particular to:

• the contact form (name, email, phone, topic, message),
• the workshop request (name, company, email, phone, team size, timeframe, format, message),
• the component request on the tools page (requested component, email, message),
• the “free IT check” notice, which may be shown once (name, email and the page you are on),
• callback and contact forms on the English pages.

Data is transmitted to our server encrypted via TLS. We create enquiries as cases in our CXHUB customer platform (Section 11). We also receive an email notification with the content of the enquiry, the shortened IP address and the page you sent it from; for some forms you receive an acknowledgement. For sending emails we use Resend, Inc. (San Francisco, USA) as a processor; the emails are then stored in our mailbox at Microsoft (Section 11d). Transfers to the USA are based on EU standard contractual clauses (Art. 46 (2)(c) GDPR).

Legal basis: Art. 6 (1)(b) GDPR where your enquiry aims at a contract, otherwise Art. 6 (1)(f) GDPR (legitimate interest in answering enquiries). Retention: we delete enquiries that do not lead to a contract no later than 12 months after the last contact; if the enquiry leads to a contract, the periods in Section 11.6 apply.

7.2 Online Booking

For appointment booking we use our own booking system in CXHUB. When you book, we process your name, email address, phone number if provided, your topic and the selected slot in order to arrange and hold the appointment. The booking flow is embedded as a frame from cxhub.cogswell.net; on the “Book an appointment” page it loads with the page, on all other pages only when you click a booking button. This technically transfers your IP address and browser information to our system. We send confirmation and reminder emails via Resend. Using the link in the confirmation, you can view, reschedule or cancel the appointment. We hold video appointments via Microsoft Teams (Section 11d).

Legal basis: Art. 6 (1)(b) GDPR. Retention: as for enquiries in Section 7.1.

7.3 Support Tickets and Email Verification

In the support form we process name, email, phone, subject, description and priority. Before a ticket is created, you confirm your email address with a six-digit one-time code, which we send via Resend. The code is not stored but verified cryptographically. To prevent unlimited code requests, we store a hash of your email address for 60 seconds. The ticket is handled in CXHUB (Section 11).

Legal basis: Art. 6 (1)(b) GDPR (support under a contract or at your request) and Art. 6 (1)(f) GDPR (protection against abuse). Retention: as for CRM data (Section 11.6).

7.4 Cancellation and Deletion Requests

Through the cancellation form we process company, contract number, name, email, the service concerned, requested date, reason and comments in order to process and confirm your cancellation (Art. 6 (1)(b) and (c) GDPR). Through the data deletion request form we process your contact details, the scope of the request and your confirmations in order to fulfil your rights under Section 4 and verify your identity (Art. 6 (1)(c) GDPR). We keep cancellations as contract records (Section 21); we document deletion requests for 3 years as evidence that they were handled.

7.5 Website Check (Google PageSpeed Insights)

On the web design page you can voluntarily enter your website address and start a technical check. The address is then sent directly from your browser to the PageSpeed Insights API of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); Google also receives your IP address. The check only starts when you actively trigger it. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in providing the analysis you requested). Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

7a. Applications and Talent Pool

Using the form on our careers page, you can join our talent pool. We process your name, your details on role and preferred timing, links (e.g. GitHub or portfolio), email, optionally phone and an optional note (e.g. internship). CVs or other files are not uploaded via the form.

Purpose and legal basis: We store your details in order to contact you about suitable positions. The legal basis is your consent under Art. 6 (1)(a) GDPR, which you give when submitting the form and can withdraw at any time with effect for the future. If you apply for a specific position, we process your data to carry out the application process under Art. 6 (1)(b) GDPR.

Retention: In the talent pool for no more than 24 months or until you withdraw your consent. After an application process ends, we delete the documents no later than 6 months later so that we can defend ourselves against any claims under the German General Equal Treatment Act, unless you consent to longer storage or an employment relationship is established. The acknowledgement is sent via Resend (Section 7.1). Data is not passed on to third parties.

7b. Referral Programme

If you recommend someone to us via the referral form, we process your name, your email address, your chosen reward, your message and the name and contact details of the person recommended.

• We use your data to run the programme and grant the reward (Art. 6 (1)(b) GDPR).
• We do not receive the recommended person’s data from that person directly. You confirm in the form that they agree to be contacted. We contact them once, inform them about the source of their data and this privacy policy (Art. 14 GDPR) and ask whether they are interested. The legal basis is Art. 6 (1)(f) GDPR; our legitimate interest is initiating a business relationship through a recommendation.

Retention: If there is no interest or we cannot reach the person, we delete their data no later than 30 days after contacting them. We keep reward-related data in line with tax rules (Section 21). The form data is sent to us by email via Resend (Section 7.1).

7c. Orders, Web Hosting and SEPA Direct Debit

7c.1 Maintenance Contracts, Microsoft 365 and Web Projects

For orders via our order forms, we process the details requested there, such as company, contact person, address, email, phone, VAT ID, selected package, start date, systems to be supported and comments. We create the order in CXHUB (Section 11) and receive an email confirmation with the shortened IP address. If you pay via Stripe, we pass the order details to Stripe so the payment can be matched to the order (Section 8). Legal basis: Art. 6 (1)(b) GDPR, and Art. 6 (1)(c) GDPR for retention. Retention: for the term of the contract, then in line with statutory retention periods (Section 21).

7c.2 Web Hosting Order and SEPA Direct Debit Mandate

For web hosting orders, in addition to your contact and address details and the desired domain, we process the account holder, IBAN and BIC for the SEPA direct debit mandate as well as the place and date the mandate was given. These details are transmitted to our server encrypted via TLS and sent to us by email (sent via Resend, Section 7.1; stored in our mailbox at Microsoft, Section 11d). We do not store bank details in CXHUB.

To provide your hosting, we pass the order, with your consent, to the hosting provider ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, and forward the direct debit mandate to them.

Legal basis: Art. 6 (1)(b) GDPR (performance of the contract and payment processing) and additionally your consent for the transfer to ALL-INKL.COM (Art. 6 (1)(a) GDPR). Retention: We keep the mandate until 14 months after the last direct debit (SEPA rulebook requirements), and accounting records in line with statutory periods (Section 21).

8. Payments via Stripe

To process paid orders by SEPA direct debit or card, we use Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When you start a payment, you are redirected to Stripe’s payment page. You enter payment details such as IBAN or card number directly with Stripe; we only receive confirmation of the payment, a transaction ID and the order details we passed to Stripe for matching (Section 7c.1). We do not embed any Stripe script on our own pages.

Stripe processes payment data as an independent controller, in particular for payment processing, fraud prevention and regulatory obligations; where Stripe processes data on our behalf, this is based on a data processing agreement. Transfers to Stripe, Inc. in the USA are possible; Stripe, Inc. is certified under the EU-US Data Privacy Framework, and EU standard contractual clauses also apply.

Legal bases: Art. 6 (1)(b) GDPR (payment processing), Art. 6 (1)(c) GDPR (statutory retention) and Art. 6 (1)(f) GDPR (fraud prevention). Stripe’s privacy policy: stripe.com/privacy.

9. Bot Protection (Cloudflare Turnstile)

To protect our forms against spam and automated attacks, we use Cloudflare Turnstile from Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Because forms such as booking and contact can be opened on any page, Turnstile is loaded on all pages. Turnstile uses technical characteristics of your browser and connection to check whether a request comes from a human; in particular your IP address and browser information are transmitted to Cloudflare, and Cloudflare may set technically necessary entries in your browser. Our server checks the result with Cloudflare and also transmits your IP address.

After a successful check we set our own cookie for 15 minutes (cw_ts_pass, only for our form interface, not readable by JavaScript) and a session storage entry for 12 minutes, so you are not checked again for every form.

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in protection against spam and abuse) and § 25 (2) no. 2 TDDDG or § 165 (3) TKG 2021. Cloudflare is certified under the EU-US Data Privacy Framework; EU standard contractual clauses also apply. Privacy policy: cloudflare.com/privacypolicy.

10. AI Chatbot with Anthropic Claude

Our chatbot answers questions about our services, takes callback, ticket and appointment requests on request and can give existing customers information about their own cases after confirmation by email code. The chatbot privacy policy also applies.

10.1 Loading the Chatbot

On every page a small script is loaded that displays the “Help” button. It is delivered via Google Firebase Hosting of Google Ireland Limited; Google receives technical connection data such as your IP address, browser type and time. The actual chat window is only loaded when you click “Help”. When opened, the chat window loads the Inter font from Google Fonts; this also transmits your IP address to Google. Legal basis for loading the script: Art. 6 (1)(f) GDPR (legitimate interest in an easily accessible support channel).

10.2 Using the Chat

We ask for your consent before your first chat. We process your messages and the conversation history, contact details you provide voluntarily, images or files you upload voluntarily, technical data and a random visitor and conversation ID. Voice input is converted to text locally in your browser. Conversations are stored in Google Firebase (database and server functions in the Frankfurt am Main region). To generate answers we send messages and conversation history to the language model Claude by Anthropic (Anthropic, PBC, San Francisco, USA, or Anthropic Ireland, Limited). According to Anthropic, this content is not used to train its models and is kept for up to 30 days for security purposes. Data processing agreements are in place with Google and Anthropic.

In your browser, the chatbot stores on its own domain a visitor and conversation ID, your consent status and, where applicable, your name and email to continue the conversation. Please do not enter special categories of personal data (Art. 9 GDPR), bank details or passwords in the chat. The chat window also offers a link to WhatsApp; WhatsApp’s terms only apply once you click it.

Legal bases: Art. 6 (1)(a) GDPR (consent to using the chat and to AI processing) and § 25 (1) TDDDG for browser entries that are not strictly necessary; for specific requests Art. 6 (1)(b) GDPR. Retention: conversations are deleted automatically 7 days after the last activity. If a conversation results in a ticket, callback or appointment, we transfer the necessary data to CXHUB (Section 11).

10.3 Note on AI

Before your first input, the chatbot points out that you are talking to an AI system. Its answers are for information only; binding decisions, for example on concluding a contract, are made by us personally.

10.4 Search and AI Solution Suggestion

You can search our website using the magnifying glass in the menu and on the home page. The results that appear as you type are calculated by your browser itself from a directory of our pages loaded from our server. Your input is neither transmitted nor stored in your browser; only the usual server logs apply (Section 5).

The AI solution suggestion is only available with your consent to the category “AI features”. You can give it in the cookie banner or directly in the search the first time you click “Suggest a solution”. Only then do we send your description (at most 300 characters) and the language of the page to our server and from there to the language model Claude by Anthropic (Anthropic, PBC, San Francisco, USA, or Anthropic Ireland, Limited). Claude then suggests suitable services of ours. According to Anthropic, this content is not used to train its models and is stored for up to 30 days for security purposes; we have a data processing agreement with Anthropic. The transfer to the USA is based on EU Standard Contractual Clauses (Section 19).

We do not store your description and do not write it to any log; it is only processed to produce the answer. To protect against abuse, we count requests per device using a hash value of the IP address (Section 5, at most one hour). We store your consent decision together with your cookie choice in your browser’s local storage (cogswell_consent_v1, Section 6). Please do not enter personal data into the search. The suggestion is not binding; we clarify what really fits in person.

Legal bases: Art. 6 (1)(a) GDPR (consent to the AI processing and the transfer to Anthropic) and Art. 6 (1)(f) GDPR (protection against abuse); for storing your choice § 25 (2) no. 2 TDDDG. Withdrawal: at any time with effect for the future via “Cookie settings” in the footer by switching off “AI features”. Without consent the search still works, just without the AI suggestion.

11. CXHUB Customer Platform (CRM, Customer Portal & Cogswell-Hub App)

11.1 System Description

For maintaining and managing customer and prospect relationships we use our self-developed customer platform CXHUB. It comprises three access points: our internal CRM, the customer portal at cxhub.cogswell.net and the iOS app "Cogswell-Hub". The platform runs on infrastructure provided by Supabase (Supabase, Inc.) acting as our processor; data is stored in the Supabase region EU (Frankfurt am Main). CXHUB uses no advertising or tracking SDKs and passes no data to ad networks or data brokers.

A separate privacy policy applies to the CXHUB platform in addition to this one; it covers account, contract, support, document and log data as well as push notifications in detail: cxhub.cogswell.net/datenschutz (language selectable on the page).

The transfer of data from the AI chatbot or from forms to the CRM takes place via an internally secured, encrypted API.

11.2 Categories of Data Processed

In the CRM the following are particularly processed:

• Master data: First and last name, optionally company, function, address,
• Communication data: Email address, phone number, possibly other channels,
• Process data: Content of your inquiry, course of correspondence, chat log (if taken over from the AI chatbot), internal notes, tasks and reminders,
• Contract data: Contract status, scope of services, terms, tickets,
• Metadata: Time of contact, source (chatbot, form, email, phone), processing status, assigned contact person,
• Access credentials for customer systems: server, hosting and website access you provide to us for support (see 11.8).

11.3 Purpose Limitation

Processing serves exclusively:

• The proper handling of your inquiries,
• Initiation, performance and execution of contracts,
• Internal documentation and traceability,
• Compliance with commercial and tax retention obligations,
• Possibly assertion, exercise or defense of legal claims.

Use of your CRM data for profiling, scoring, automated decisions or sale to third parties expressly does not occur.

11.4 Legal Bases

• Art. 6 (1)(b) GDPR: pre-contractual measures and performance of contracts,
• Art. 6 (1)(c) GDPR: fulfilment of legal obligations (in particular HGB/AO retention),
• Art. 6 (1)(f) GDPR: legitimate interest in orderly customer communication and case management.

11.5 Recipients and Third-Country Transfer

Access to the CRM is granted exclusively to authorized persons at Cogswell IT, who are obliged to confidentiality. The data is stored in the EU (Frankfurt am Main); because Supabase, Inc. is a US company, we additionally safeguard any access from the USA with EU standard contractual clauses. As processors we use Supabase (platform infrastructure) and Resend (email dispatch, see Section 7.1), in each case on the basis of data processing agreements (Art. 28 GDPR) and EU standard contractual clauses (Art. 46 (2)(c) GDPR). Data is never sold or passed to advertising networks.

11.6 Retention Period

• Inquiries without business conclusion: Deletion at the latest 12 months after last contact.
• Active customer relationships: For the duration of the business relationship.
• Access credentials for customer systems: for the duration of our support; after the contract ends, deletion as soon as you request it (see 11.8).
• Terminated customer relationships: 3 years after end of business relationship (limitation period § 195 BGB), then deletion, unless longer commercial/tax retention obligations apply (up to 10 years under § 257 HGB, § 147 AO).

11.7 Further Information

Details on data processing within the platform, such as support tickets including ticket links, appointment bookings, file uploads, technical logs and app push notifications, can be found in the platform's own privacy policy at cxhub.cogswell.net/datenschutz.

11.8 Access Credentials for Customer Systems

As part of IT service, maintenance contracts, web hosting and web projects, we store the access credentials you provide to us for looking after your systems, for example access to servers, hosting accounts, websites, content management systems, databases and administrator accounts. They are kept in CXHUB with the respective customer or project (for the infrastructure, see 11.1 and 11.5).

• Purpose: exclusively to provide the agreed services, such as maintenance, updates, troubleshooting, backups and support,
• Protection: the credentials are stored encrypted, access to CXHUB is only possible with two-factor authentication, and every retrieval of a password is logged,
• Legal basis: Art. 6 (1)(b) GDPR (performance of the contract). Where we access personal data in your systems through these credentials, we process it on your behalf and according to your instructions (Art. 28 GDPR),
• Retention: for the duration of our support. After the end of our cooperation, we delete the credentials as soon as you request it. We also recommend that you change the passwords once the contract has ended.

11a. Phone System & AI Phone Assistants (CUSCOS)

11a.1 Description

Our phone number +49 6251 9743999 is operated through our self-developed phone system CUSCOS (Customer Service Contact Software). It comprises a voice menu, a hold queue, business-hours logic, a mailbox, and optional AI phone assistants that take over calls when nobody is available, when you call outside business hours, or when you choose them in the menu. At the beginning of a conversation with an assistant you are informed that you are talking to a digital assistant. The system's management interface runs at phonesystem.cogswell.net on our own Hetzner server in Germany.

11a.2 Data Processed

• Connection data: your phone number, time and duration of the call, selected menu options and the technical connection status,
• Conversation content with AI assistants: your speech is converted to text in real time and answered by an AI model; the content you state (e.g. your request, name, callback wish) is processed,
• Outcome data: a summary of the conversation with structured details (category, outcome, follow-up task such as a callback wish),
• Mailbox messages, if you leave one.

No call recording: calls with our AI assistants are not recorded as audio. What is stored are the summary and the structured details mentioned above.

11a.3 Account Information Only After Verification

The assistant provides information about a customer account (e.g. invoices, appointments or tickets from our CXHUB customer platform, see Section 11) only after verification: a six-digit one-time code is sent to the email address stored in the customer account (dispatched via Resend, see Section 7.1). The code is valid for ten minutes, the address is only stated to you in masked form, and the verification applies exclusively to the ongoing call. Without verification, no account data is disclosed.

11a.4 Service Providers Used

We use the following processors to operate the system: Twilio Inc. (USA; telephony infrastructure: call handling, voice menu, hold queue, call setup), Vapi Inc. (USA; orchestration of the AI conversation), ElevenLabs Inc. (USA; generation of the voice output) and Deepgram Inc. or Soniox Inc. (USA; speech-to-text conversion). Transfers to the USA are based on EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR), see Section 19. Please do not state any special categories of personal data (Art. 9 GDPR) in conversations with the assistants; for sensitive matters you can reach us personally during business hours as well as by email and contact form.

11a.5 Legal Bases and Retention

Legal bases: Art. 6 (1)(b) GDPR (handling your request, contract or pre-contractual measures) and Art. 6 (1)(f) GDPR (legitimate interest in reliable availability by phone, including outside staffed hours). The verification check is additionally based on our legitimate interest in preventing unauthorized account disclosures.

Retention: we process conversation summaries and callback wishes until the matter is resolved; if they become part of a business transaction, the periods in Section 21 apply. One-time codes are not stored permanently but verified cryptographically and expire after ten minutes.

11a.6 “CUSCOS” App for iPhone

The phone system comes with the iPhone app CUSCOS. It is intended for users with an account in the phone system; there is no public sign-up. You sign in with the same account as in the management interface (password, plus a code if two-factor sign-in is enabled, or alternatively a passkey). The app shows the same data as the management interface, such as calls, callback requests, voicemail messages and, after entering the postal code, the respective customer profile.

• Data processed: user identifier (login name), phone numbers as part of the call functions, and voice data transmitted in real time to establish the connection when you call through the app (via Twilio, see 11a.4),
• Notifications: for alerts about missed calls, voicemail messages or callback requests and for incoming calls we use the Apple Push Notification service of Apple Inc. (USA); a device-specific push identifier is processed. You can turn notifications off at any time in the iOS settings,
• Face ID: the optional app lock is checked by iOS locally on your device only; we do not receive any biometric data,
• No tracking: the app contains no advertising, no analytics tools and no cross-device tracking.

Legal bases and deletion: Art. 6 (1)(b) GDPR (providing the agreed functions) and Art. 6 (1)(f) GDPR (legitimate interest in availability while on the move). You can delete your account directly in the app; this immediately removes the account, passkeys and login history from the server. Transfers to the USA are covered by the safeguards described in Section 19.

11b. Cogswell Eat Ordering System

11b.1 Description and Allocation of Roles

Cogswell Eat is our ordering system for restaurants and food service. It connects a self-order kiosk, online ordering, QR table ordering, phone ordering, a point of sale, a kitchen display, a pickup display, reservations and a back office. You can find product information at cogswell.de/cogswell-eat and on eat.cogswell.app. Depending on how you come into contact with Cogswell Eat, the roles are allocated differently:

• Product website eat.cogswell.app: we are the controller for this website (see 11b.2).
• Orders and reservations at a restaurant: if you order or make a reservation at a restaurant through Cogswell Eat, that restaurant is the controller within the meaning of Art. 4 (7) GDPR. Its privacy notice applies, which is linked on the ordering and reservation pages. Where we operate or maintain the system for a restaurant, we process the data exclusively on its behalf and according to its instructions on the basis of a data processing agreement (Art. 28 GDPR).
• Initial consultation and demo request: the “Erstgespräch buchen” (book a consultation) and “Demo anfragen” (request a demo) buttons on the German-language product website lead to cogswell.de. Section 7 (contact and online booking) and Section 11 (CXHUB) apply.

11b.2 Product Website eat.cogswell.app

When you visit the website, the web server processes technically necessary data: the requested address, time, amount of data transferred, browser identifier and IP address. In the server logs, the IP address is stored in shortened form (last block removed), and the logs are deleted after seven days. The full IP address is only used briefly in memory to limit requests (abuse protection) and is not stored.

The product website sets no cookies and stores nothing in your browser. There are no analytics or advertising services, no embedded third-party content and no social media plugins; fonts and videos are delivered from our own server. The website is hosted by Hetzner Online GmbH in Germany (see Section 5) on the basis of a data processing agreement; no transfer to third countries takes place for this.

Legal basis: Art. 6 (1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.

11b.3 Data in the Ordering System

Cogswell Eat is built for data minimisation: each channel only asks for what it needs for the order, and the system deletes contact details automatically. In the standard configuration:

• No personal data in links: status, receipt and admin links contain signed or random tokens, never names, phone numbers or email addresses.
• Cookies and browser storage: the system only sets technically necessary cookies for sign-in and the table session; the cart and language choice are stored in the browser. There are no analytics, advertising or third-party services. These storage operations are based on § 25 (2) no. 2 TDDDG; no consent is required.
• No customer accounts: guests need neither an account nor an app. Online ordering, QR table ordering and reservations run in the smartphone’s browser.

11b.4 Payments

Payments are processed through certified terminals and payment providers used by the restaurant. Cogswell Eat neither stores nor processes card data, including for online payments. The system only holds the payment provider’s references and masked details such as the card brand and the last four digits. The payment provider’s own privacy notice applies to the payment processing itself.

11b.5 Phone Ordering via Voice Assistant

For phone orders, a voice assistant takes pickup orders, reads back the order and total, and passes it to the kitchen after you confirm. The conversation is handled by the voice service Vapi Inc. (USA). Recording is switched off in the assistant’s configuration, and no transcripts are stored in Cogswell Eat. The restaurant sets the retention at the voice service in its own account and concludes a data processing agreement with the provider for this, including the safeguards for transfers to the USA (Art. 44 et seq. GDPR). Please do not share special categories of personal data (Art. 9 GDPR) when ordering by phone.

11b.6 Accounts for Restaurant Staff

Restaurant staff sign in to the back office, point of sale, kitchen display and waiter app with their own account. User identifier, role, branch assignment and sign-in and activity data are processed. The restaurant is the controller for this data; we process it as a processor.

• Sign-in: passwords are stored exclusively as scrypt hashes. Sessions use an HttpOnly cookie whose token is only stored as an HMAC hash.
• Permissions: seven roles with permissions per branch; every permission is checked on the server. Devices such as the kiosk and kitchen display authenticate with their own identifier and a rotatable token.
• Audit log: critical actions such as sign-ins, cancellations, refunds, price and catalogue changes, and table and reservation actions are logged with the acting person, time and the state before and after.

11b.7 Your Rights Regarding Orders and Reservations

It is best to exercise your rights under Section 4 regarding orders and reservations directly with the restaurant concerned, as it is the controller. If you contact us, we forward your request to the restaurant and support it in responding (Art. 28 (3)(e) GDPR). For the product website eat.cogswell.app, please contact us directly (Section 1).

11c. Remote Support with support.me

For remote maintenance and support we use support.me, a version of the open-source software RustDesk operated by us. The installation files are downloaded from our own server support.cogswell.net, which also handles connection setup (Hetzner, Nuremberg data centre). A session only takes place if you give us your support.me ID and the one-time password shown; we only set up permanent access at your express request. The connection is end-to-end encrypted, you can see what we do at all times, and you can end the session at any time.

• Connection data: support.me ID, IP address, device name and operating system, start and end of the session,
• Screen content: during the session we see the content of your screen and may become aware of personal data contained in it. We do not record sessions.

Legal basis: Art. 6 (1)(b) GDPR (support under a contract or at your request). Where we access personal data for which your company is responsible, we act on its behalf (Art. 28 GDPR). Retention: we keep connection logs as evidence of services provided for the duration of the business relationship, for no more than 3 years.

11d. Email and Video Conferencing (Microsoft 365)

We run our email mailboxes and video conferences with Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

• Email: When you write to us, we process your email address, the content and any attachments to handle your request. Emails are stored in Exchange Online.
• Microsoft Teams: We use Microsoft Teams for initial consultations and advice by video. We process your name or display name, your email address if applicable, video and audio data during the call, chat messages and technical data such as IP address and time. You can join via the browser without a Microsoft account and switch off camera and microphone at any time. Recordings are only made after prior notice and with your agreement.

Microsoft processes the data as a processor mainly in data centres in the EU (EU Data Boundary). Access from the USA cannot be ruled out; Microsoft Corporation is certified under the EU-US Data Privacy Framework, and EU standard contractual clauses also apply. Legal basis: Art. 6 (1)(b) GDPR where a contract or your enquiry is concerned, otherwise Art. 6 (1)(f) GDPR (legitimate interest in efficient communication). Retention: emails according to the periods for the respective matter (Sections 7 and 11.6), business correspondence according to statutory retention periods.

12. No Web Analytics and No Online Advertising on Our Websites

We currently use no web analytics (such as Google Analytics), no conversion tracking and no remarketing (such as Google Ads or the Meta Pixel) on our websites. No usage profiles are created. Should we use such services in future, this will only happen with prior consent via the cookie banner and after this policy has been updated.

If we run ads on platforms such as Google, we do not process any data about our website visitors for this. Anyone who clicks such an ad reaches our website without us analysing the click there.

13. Our Social Media Profiles

In the footer we link to our profiles on LinkedIn, Facebook and Instagram. These are plain links: you are only redirected to the network when you click them. No data is transferred to the networks beforehand.

When you visit our profiles, the networks process your data under their own responsibility and privacy policies. For the statistics on our pages (page insights) we are jointly responsible with the operator (Art. 26 GDPR):

• Facebook and Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Joint controller agreement: facebook.com/legal/terms/page_controller_addendum; privacy policy: facebook.com/privacy/policy.
• LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Joint controller agreement: legal.linkedin.com/pages-joint-controller-addendum; privacy policy: linkedin.com/legal/privacy-policy.

Under these agreements the operators take on the main obligations, in particular regarding information and fulfilling your rights; you can also exercise your rights against us, and we will forward them. We only receive aggregated, non-personal statistics. If you reply to us via a network, we process your message to answer it. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in information and communication via these channels). The networks may transfer data to the USA; Meta Platforms, Inc. and LinkedIn Corporation are certified under the EU-US Data Privacy Framework.

14. Links to Other Services

Among other things, we link to our listing and reviews on Google Maps, to our apps in Apple’s App Store and on Google Play, and from the chat window to WhatsApp. These services are not embedded in our pages; data is only transferred when you click a link. The respective provider is responsible for processing on the linked pages.

15. Accessibility Widget (AccessKit)

Our own “AccessKit” widget lets you adjust font size, contrast, motion and the read-aloud function. Only when you change a setting there is your choice stored locally in your browser (local storage, key cogswell-a11y-v1). The read-aloud function uses your browser’s speech output. No data is transferred to us or third parties. Legal basis: § 25 (2) no. 2 TDDDG or § 165 (3) TKG 2021 and Art. 6 (1)(f) GDPR (legitimate interest in an accessible website).

16. Locally Hosted Fonts

The fonts used on our websites (Inter, JetBrains Mono and Caveat) are served from our own server. When you visit our pages there is no connection to Google Fonts or other font providers. The exception is the chat window, which is only loaded after clicking “Help” (Section 10.1).

17. Data Security

We take appropriate technical and organisational measures under Art. 32 GDPR to protect your data against unauthorised access, loss, alteration or destruction, in particular:

• encryption of all connections to our websites via TLS (HTTPS),
• encrypted storage of sensitive data, such as the access credentials in CXHUB,
• access protection with roles and permissions, strong passwords and two-factor authentication for administrative access,
• regular security updates for the operating system, web server and applications,
• shortening of IP addresses in logs and short deletion periods,
• protection of internal files and logs against retrieval via the internet.

We continuously adapt these measures to the state of the art.

18. Automated Decision-Making and Profiling

No automated individual decision-making, including profiling, under Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you takes place. The chatbot and phone assistants generate answers using AI language models; they do not make binding decisions about you, for example about concluding a contract or terms. We make such decisions personally.

19. Transfers to Third Countries

For some of the services described, data is transferred to countries outside the EU or EEA, in particular the USA, or may be accessible from there. This only happens on the basis of recognised safeguards:

19.1 Adequacy Decision (Art. 45 GDPR)

The following recipients are certified under the EU-US Data Privacy Framework:

• Google LLC (Firebase, PageSpeed Insights, Google Fonts in the chat window),
• Cloudflare, Inc. (Turnstile),
• Microsoft Corporation (Microsoft 365, Teams),
• Stripe, Inc. (payment processing),
• Meta Platforms, Inc. and LinkedIn Corporation (only when visiting our profiles).

The current list is available at dataprivacyframework.gov/list.

19.2 EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR)

EU standard contractual clauses in the version of Implementing Decision (EU) 2021/914 are in place with the following recipients:

• Anthropic, PBC (AI language model of the chatbot and of the solution suggestion in search),
• Resend, Inc. (email delivery),
• Supabase, Inc. (CXHUB infrastructure; data stored in Frankfurt am Main),
• Twilio Inc., Vapi Inc., ElevenLabs Inc., Deepgram Inc. and Soniox Inc. (phone system, Section 11a),
• additionally the US group companies of the providers listed under 19.1.

19.3 Supplementary Measures and Residual Risk

Where necessary, we use supplementary measures such as encryption, short retention periods and data storage in the EU. Nevertheless, we cannot completely rule out that US authorities access data under their law. If you want to avoid this, please use email, phone during our business hours or the contact form instead of the chatbot and AI phone assistant.

20. Recipients Overview

We use the following service providers. Data processing agreements under Art. 28 GDPR are in place with processors, and agreements under Art. 26 GDPR with joint controllers. Data is only disclosed to authorities where there is a legal obligation.

21. Retention Periods Overview

22. Minors

Our services are aimed at businesses and adults. Persons under 16 should not send us personal data without the consent of their parents or guardians (Art. 8 GDPR). If we find that we have received such data without the required consent, we delete it without delay.

23. Currency and Changes

This privacy policy is dated 21 October 2026. We update it when our websites, services or legal requirements change. The current version is always available on this page. In case of doubt, the German version applies.