Privacy policy
Last updated: 2026-09-15 · Framework: GDPR / BDSG / TTDSG
1. Controller
Mignuti Media — Eduard Ditler, Pfarrer-Mengesstr. 5, 56112 Lahnstein, Germany — see Imprint. Contact: media@mignuti.com or via the contact form.
Two roles that must not be confused. For this website and for our own account and billing business we are the controller (Art. 4(7) GDPR). For the chatbots our customers run on their own sites we are a processor (Art. 28 GDPR): there the customer decides on purposes and means, and their privacy policy applies, not this one.
2. What we process, and why
| Purpose | Data | Legal basis | Duration |
|---|---|---|---|
| Account and contract | Email, name, company, business declaration, accepted contract versions | Art. 6(1)(b) | Term of contract + retention periods |
| Billing | Invoice data via Stripe; payment data never reaches our servers | Art. 6(1)(b), (c) | 10 years (§ 147 AO) |
| Chatbot on this website | Your input, the answer, time, language, page, session ID | Art. 6(1)(a) for browser storage, (f) for the answer | 90 days, then anonymised |
| Contact form | Name, email, message | Art. 6(1)(b), (f) | Email in our inbox only, no database |
| Waitlist | Email, optional website and number of client sites | Art. 6(1)(a), double opt-in | Until withdrawal; unconfirmed 7 days |
| Cancellation without login | Email, optional reason, hashed confirmation token, hashed IP | Art. 6(1)(b), (c) | Unconfirmed 24 hours, as evidence 12 months |
| Abuse prevention | Hashed IP address, counters per time window | Art. 6(1)(f) | Hours to days |
| Audit log of security-relevant events | User ID, action, timestamp | Art. 6(1)(f), (c) | 2 years; 7 years where compliance-related |
3. The chatbot on this website
This is the same widget our customers embed — but on this page we run it on our own responsibility.
- What is processed: the text you type, the bot's answer, time, detected language and the page you were on. A random session ID sits in your browser's localStorage so the conversation survives a page change. No cookie, no cross-domain transfer.
- Legal basis: storing the session ID happens only with your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG) via the "Functional" category. Without consent the chat does not start. Answering your question itself rests on our legitimate interest in product information (Art. 6(1)(f) GDPR).
- Recipients: our server in Germany and Anthropic for the answer (section 10). Before the text goes to the language model, recognisable personal data is replaced by rule-based redaction — what exactly is detected is listed in the DPA, Annex 2.
- No training: we do not train models on your chat content, and our providers are contractually barred from doing so.
- Delete it yourself: via "Delete conversation" in the widget menu — no account, no request to us.
The bot advises on our product; it is not individual advice. Please do not enter health data, credentials or other sensitive information. The widget discloses that you are talking to an AI under Art. 50 EU AI Act; that notice cannot be switched off.
4. Forms on this website
- Contact form. Name, email and message are sent to our inbox as an email. We do not store them in a database; they live as long as the correspondence does. Delivery via Resend (section 8).
- Waitlist and agency application. A signup only becomes valid once you click the link in our confirmation email (double opt-in). Unconfirmed entries are deleted after seven days. Withdraw any time by email.
- Email request in the live demo. We use the address only to send you the embed code and set up your project — no newsletter. Double opt-in applies here too.
- Cancellation without login. At Cancel your contract here we send a confirmation link to the address on the contract. Of the token we store only a hash; the IP address is hashed as well. Unconfirmed requests expire after 24 hours.
5. WhatsApp channel
Customers can additionally run their bot over WhatsApp. We then process the end user's phone number and the message text in order to deliver the answer. The message travels via the WhatsApp Business Platform of Meta Platforms Ireland Ltd.; Meta also processes outside the EU. For customer bots we are a processor — the controller is the customer who sets up the channel, and their privacy policy applies towards their end users.
6. Hand-off to our customers' systems
When a customer's bot captures an enquiry (name, email, request), we forward it to wherever the customer configured: their email address, a Slack channel, or a webhook on their own server. We act on their instruction; what happens afterwards is their responsibility. On this website there is no such hand-off.
6a. Cloud storage (Dropbox, Google Drive)
When a customer connects a cloud storage, we store an access key (refresh token) and the email address of the connected account in order to import the files the customer has shared into their knowledge base. We only read; nothing in the storage itself is changed. The files then live on our server in Germany like uploaded documents. Data from Google accounts is used solely for this purpose and is not passed on. When the customer disconnects or deletes their account, we revoke the key with Dropbox or Google and delete it. Dropbox and Google act as services of the customer, not as our sub-processors. Legal basis: Art. 6(1)(b) GDPR.
6b. Weekly report
Customers receive a weekly summary of their bot at the account owner's address. It contains key figures, the most frequent unanswered questions and an excerpt of the conversation with the strongest buying signal — visitor text in it is masked beforehand (section 3). The report is a service email about the customer's own usage (Art. 6(1)(b) GDPR) and can be switched off in the account's notification settings or via the link in every email. We delete the contents of notifications 30 days after delivery.
7. Protection against automated requests
The forms on this website use Cloudflare Turnstile (Cloudflare Germany GmbH / Cloudflare, Inc.). It checks without puzzles whether an entry comes from a human and processes technical browser characteristics and the IP address for that. The legal basis is our legitimate interest in preventing automated abuse (Art. 6(1)(f) GDPR).
The script is only loaded once you interact with the form — a visitor who merely reads the page never contacts Cloudflare.
8. Email delivery
Transactional emails (signup links, confirmations, notifications) are sent via Resend, which processes recipient address, subject and content. Legal basis: performance of the contract and our legitimate interest in reliable delivery (Art. 6(1)(b) and (f) GDPR).
9. Error diagnostics, analytics, backups
- Analytics: Plausible (EU, no cookies, no cross-device recognition). The script is loaded only after consent to the "Analytics" category.
- Error diagnostics: the Sentry integration is prepared in the code but currently not activated — no access key is configured and no data is sent there. Should we switch it on, we will update this policy first.
- Backups: we create an encrypted backup of the database daily and store it at Cloudflare R2 in the EU. It contains the same data as the live system and is rotated.
10. Transfers to third countries
Platform data (database, files, authentication) is processed exclusively in Germany (our own server, netcup GmbH). For AI answers, chat messages go to Anthropic PBC (USA) and, for semantic search, to OpenAI (USA) — covered by the EU Standard Contractual Clauses 2021/914 (Art. 46(2)(c) GDPR). Personal data is rule-based masked beforehand. An EU-only mode can be enabled per bot (language model via Azure OpenAI in the EU); no transfer to Anthropic takes place then.
11. Sub-processors
Full list with purpose, location and transfer basis: /en/legal/subprocessors. Changes are announced 30 days in advance (opt-in).
12. Storage in your browser
- Necessary: your choice in the cookie banner itself. It has to be stored, otherwise we would have to ask again on every visit.
- Functional (consent): the chat widget's session ID in localStorage; a cookie
mc_refrecording how you found us; a cookiemignuti_chatbot_partnerfor commission attribution if you arrived via an agency partner link. Both cookies are set only after your consent, for 30 days. - Analytics (consent): Plausible works without cookies; the consent decides whether the script is loaded at all.
- We use no ad networks, no social plugins and no cross-device tracking.
You can change your choice at any time via , with effect for the future (Art. 7(3) GDPR).
13. No automated decision-making
There is no automated decision-making producing legal effects or similarly significant effects within the meaning of Art. 22 GDPR. The chatbot generates answers from stored content; it decides nothing about contracts, prices, creditworthiness or claims. Automatic blocks concern technical use only (rate limits, for instance) and can be reviewed at any time via the contact route.
14. Your rights (Art. 15–22 GDPR)
Access, rectification, erasure, restriction, objection, data portability and withdrawal of consent. Informally to media@mignuti.com or via the contact form. End users of a customer bot can delete their conversation themselves via "Delete conversation" in the widget — no account, no request to us.
15. Retention
- Chat content: 90 days, then anonymised (content deleted, aggregate metrics kept).
- Invoices and accounting records: 10 years (§ 147 AO).
- Audit log: 2 years, 7 years where compliance-related — deleted afterwards.
- Unconfirmed waitlist signups: 7 days.
- Unconfirmed cancellation requests: 24 hours; confirmed ones kept as evidence for 12 months.
- Abuse-prevention counters: hours to days.
16. Right to lodge a complaint
Competent supervisory authority: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI RLP), Hintere Bleiche 34, 55116 Mainz, Germany — www.datenschutz.rlp.de. You may also complain to any other data protection supervisory authority.
17. Minors (Art. 8 GDPR)
Mignuti Chatbot is offered to businesses and is not directed at children. The chatbot is not intended to address persons under 16. As a processor we operate the widget on customer sites on their instruction; customers warrant in the data processing agreement that they will not target it at minors under 16 and will obtain the consent required under Art. 8 GDPR. If we learn of children's data without that consent, we delete it without delay.