Privacy Policy

2.1 Personal data means any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR). This includes both direct identifiers (such as name, email address) and indirect identifiers (such as account ID, IP address, cookie identifiers).

2.2 We collect personal data in the following ways:

Directly from you: When registering, filling out forms, communicating with us, subscribing, or using the Services.
Automatically: Through your use of our Services, technical data such as IP address, access times, device information, browser type, and usage data are automatically captured.
From third parties: From AI third-party providers (e.g., OpenAI, Anthropic), integration partners (e.g., Jira, Slack, Microsoft 365), or payment service providers (e.g., Stripe).
From public sources: To the extent permitted by law, we may also process data from publicly available sources.

2.3 We only process personal data that is necessary for the stated purposes (data minimization, Art. 5(1)(c) GDPR).

3. Purposes and Legal Bases for Processing

3.1 We process your personal data for the following purposes and on the basis of the stated legal grounds:

a) Contract performance and services (Art. 6(1)(b) GDPR)

Provision and operation of the Storsko platform
Account management and authentication
Processing of payments and invoicing
Provision of customer support
Communication in the context of contract performance
Provision of AI agents and intelligence services

b) Legitimate interests (Art. 6(1)(f) GDPR)

Improvement and development of our Services
Operational security and abuse prevention
Advertising for our own similar products (right to object under Art. 21 GDPR)
Conducting statistics and analyses
Enforcement of legal claims

c) Consent (Art. 6(1)(a) GDPR)

Newsletter marketing and product updates
Personalized content and recommendations
Tracking and analytics cookies (with your consent)
Certain AI features requiring special consent

d) Legal obligations (Art. 6(1)(c) GDPR)

Tax and accounting retention obligations
Anti-money laundering (GWG)
Disclosure and cooperation obligations towards authorities
IT security and data protection impact assessment

3.2 Where we process special categories of personal data (Art. 9 GDPR), this is done on the basis of Art. 9(2)(a), (b), (c), (d), (f), and (g) GDPR, to the extent required for the provision of our services.

4. Categories of Processed Data

a) Account and identification data

First and last name
Email address
Password hash (never in plaintext)
Phone number (optional)
Company name and business affiliation
Position/job title
Profile picture (optional)

b) Billing and payment data

Billing address
Payment type and information (processed by Stripe, PCI-DSS compliant)
Bank details (SEPA direct debit)
VAT ID and company identification
Payment history and outstanding invoices

c) Workspace and usage data

Workspace name, slug, and configuration
Memberships and roles (Owner, Admin, Member)
AI agent configurations and workflows
Decision logs and audit trails
API usage data and limits
Integration settings

d) Technical access data

IP address
User agent and browser information
Device information (operating system, device type)
Access times and session duration
Login history and security events
Cookies and session tokens

e) Communication data

Email correspondence with support
Chat and message history
Feedback and survey responses
Newsletter interaction data (openings, clicks)

f) AI processing data (particularly sensitive)

Inputs to AI agents (prompts, files, instructions)
Outputs and results from AI agents
Context and conversation data
Any personal data contained in prompts

Note: This data is stored only as long as necessary for providing the respective AI service (see Section 8).

5. Cookies and Tracking Technologies

5.1 We use cookies and similar tracking technologies to provide our Services, improve user experience, and conduct marketing activities.

5.2 Cookie categories:

Necessary cookies (essential)

These cookies are essential for the basic functions of the website and Services. They enable authentication, session management, and security features, for example. Rejecting these cookies may result in the Services not functioning.

Legal basis: Art. 6(1)(b) and (f) GDPR

Functional cookies

These cookies store preferences such as language settings, theme selection, and timezone. They enable improved and personalized features.

Legal basis: Art. 6(1)(a) GDPR (consent)

Analytics and performance cookies

These cookies help us understand how visitors interact with our Services by collecting and reporting information anonymously. They help us improve our Services.

Legal basis: Art. 6(1)(a) GDPR (consent)

Marketing cookies

These cookies are used to personalize advertising messages and measure the effectiveness of marketing campaigns. They track browsing activities across websites.

Legal basis: Art. 6(1)(a) GDPR (consent)

5.3 You can change your cookie settings at any time in your browser or via our cookie consent banner. Please note that disabling cookies may limit the functionality of our Services.

5.4 Detailed information about the cookies used can be found in our Cookie Directory.

6. Disclosure of Data to Third Parties

6.1 We only disclose your personal data to third parties in the following cases:

a) Processors (Art. 28 GDPR)

We work with carefully selected processors who process personal data on our behalf and under our instructions:

Cloud infrastructure: Hetzner Online (hosting), Vercel Inc. (edge network)
Payment processing: Stripe Technology Europe Ltd. (payment services)
Email delivery: Amazon Web Services (SES), Postmark
AI services: OpenAI, Anthropic, Google (in the context of service provision)
Analytics: Vercel Analytics, Plausible Analytics
Support: Intercom, Zendesk
CRM and accounting: Internal CRM, accounting system

Data processing agreements (DPAs) pursuant to Art. 28 GDPR have been concluded with all processors, ensuring the protection of your data.

b) Independent controllers

Authorities and institutions: As required by law (e.g., tax authorities, courts, law enforcement)
Lawyers and debt collection: For the enforcement or defense of legal claims
Auditors: In the context of annual audits (if applicable)

c) Workspace members

Within a workspace, certain personal data (name, email, role) will be visible to all workspace members. This is required for team collaboration.

6.2 We do not sell your personal data to third parties and do not disclose it to third parties for advertising purposes.

6.3 A complete list of all sub-processors pursuant to Art. 28(2) GDPR can be requested by sending an email to privacy@storsko.com.

7. International Data Transfers

7.1 If personal data is transferred to countries outside the EU/EEA (third-country transfer), this occurs only under the conditions provided for in Chapter V GDPR.

7.2 The following third-country transfers take place:

USA (OpenAI, Anthropic, Google, Vercel, Stripe): Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR, supplemented by technical and organizational measures.
USA (other US companies): Where no adequacy decision exists, on the basis of Standard Contractual Clauses.

7.3For transfers to the USA, we rely on the EU Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) in its current version. We additionally implement technical protective measures (encryption, pseudonymization) and ensure that recipients provide adequate data protection guarantees.

7.4 A copy of the applicable Standard Contractual Clauses can be requested from us at: privacy@storsko.com

8. Retention Periods and Data Deletion

8.1 We store personal data only as long as necessary to achieve the processing purposes or as required by legal retention obligations.

8.2 Specific retention periods:

Account and profile data: For the duration of the contractual relationship and thereafter until deletion is complete (max. 90 days after contract end, unless legal retention obligations apply).
Payment data and invoices: 10 years pursuant to § 147 AO, § 257 HGB.
Communication data: 3 years after end of communication (statute of limitations).
Audit logs: 5 years for compliance and documentation purposes.
AI inputs and outputs: 30 days by default, faster deletion can be activated upon request.
Marketing data: Until consent is withdrawn or objection is made.
Session cookies: For the duration of the session (max. 24 hours).
Persistent cookies: Maximum 12 months or until consent is withdrawn.

8.3 After the retention periods expire, data is routinely and lawfully deleted or blocked. Data that remains necessary for other purposes (e.g., due to legal hold) remains stored in blocked form.

8.4 Further information on account deletion can be found in our Terms of Service, Section 12.

9. Your Rights (Data Subject Rights)

9.1 As a data subject, you have the following rights:

a) Right of access (Art. 15 GDPR)

You have the right to obtain confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have the right to access this data and additional information (processing purposes, categories, recipients, retention period, etc.).

b) Right to rectification (Art. 16 GDPR)

You have the right to obtain the rectification of inaccurate or incomplete personal data concerning you without undue delay.

c) Right to erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data, provided no legal retention obligations or other legal grounds oppose deletion. Please note the restrictions in Section 8 and the Terms of Service Section 12.

d) Restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of processing where the conditions of Art. 18(1) GDPR are met.

e) Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit this data to another controller. Further information can be found in the Terms of Service Section 13.

f) Right to object (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your data. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests.

In particular, for processing for marketing purposes, you have an unrestricted right to object at any time (Art. 21(3) GDPR).

g) Withdrawal of consent (Art. 7(3) GDPR)

You may withdraw your consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

9.2 To exercise your rights, please send an email to privacy@storsko.com or a letter to our postal address. We will respond to your request within 30 days.

9.3 In case of reasonable doubts about your identity, we may request a copy of your identification document.

10. Automated Decision-Making and Profiling

10.1 We do not use automated decision-making that produces legal effects or similarly significantly affects you (Art. 22(1) GDPR).

10.2 Profiling (Art. 4 No. 4 GDPR) is used in the following areas:

Fraud and abuse detection: Automatic analysis of usage patterns to detect suspicious activities. This serves the security of our platform and the protection of all users.
Payment risk assessment: Assessment of payment default risk when selecting payment methods (especially SEPA direct debit).
Personalization: Adaptation of content and recommendations based on your preferences and use of the Services.

10.3 In all cases of profiling, you have the right to human intervention, to express your point of view, and to contest the decision (Art. 22(3) GDPR). Please contact privacy@storsko.com.

11. Children and Adolescents

11.1 The Storsko platform is exclusively aimed at persons who have reached the age of 18 and have full legal capacity.

11.2 We do not knowingly collect personal data from persons under 18. If we become aware that data from minors has been inadvertently collected, we will delete it without undue delay.

11.3 If you are a parent or guardian and become aware that your child has provided us with personal data without your consent, please contact us immediately at privacy@storsko.com.

12. Data Security

12.1 We implement appropriate technical and organizational measures (TOMs) pursuant to Art. 32 GDPR to ensure a level of security appropriate to the risk for personal data.

12.2 The implemented security measures include, but are not limited to:

Encryption: TLS 1.3 for all data transmissions; at-rest encryption for stored data (AES-256).
Access control: Role-based access control (RBAC), principle of least privilege, regular access reviews.
Network security: Firewall, DDoS protection, network segmentation, VPN for administrative access.
IT security measures: Regular penetration tests, vulnerability scans, security updates and patch management.
Backup strategy: Regular encrypted backups with tested restoration procedures.
Employee awareness: Regular data protection and security training for all employees.
Incident Response: Documented procedure for responding to data protection breaches (Art. 33, 34 GDPR).

12.3 Despite all security measures, no 100% guarantee can be given for the absolute security of data transmissions over the internet. We cannot fully guarantee the security of data you transmit to us electronically.

13. Data Protection for AI Services

13.1 The Storsko platform uses AI language models from third-party providers (particularly OpenAI, Anthropic, Google). The processing of your data by these providers occurs under their responsibility as independent controllers.

13.2 When using AI services, the following data is processed:

Your inputs (prompts, instructions, context information)
Outputs generated by the AI models
Metadata for billing and quality assurance

13.3 We have entered into contractual agreements with AI providers to ensure that:

Your data is not used for training purposes (except with explicit consent)
Adequate security measures are implemented
Applicable data protection laws are complied with

13.4 Important: You should not include personal data or confidential information in AI inputs that you are not willing to share with the respective AI provider. While we endeavor to protect this data, the ultimate responsibility for the content you send to AI systems lies with you.

13.5 Further information on data processing by AI providers can be found in their respective privacy policies:

OpenAI: https://openai.com/privacy
Anthropic: https://www.anthropic.com/privacy
Google: https://policies.google.com/privacy

13.6 You have the option to configure in your account settings that your AI inputs and outputs are not used for improving AI models. This setting can be changed at any time.

14. Third-Party Integrations

14.1 The Storsko platform enables integration with third-party services (e.g., Jira, Slack, Microsoft 365, n8n). When using these integrations, the data protection provisions of the respective providers also apply.

14.2 The following integrations are subject to separate terms:

OAuth authorization: When connecting with OAuth-enabled services, you will be asked to grant Storsko access to certain data. The data we access is limited to the minimum required for the integration.
API keys: API keys you provide for third-party providers are stored encrypted and used only for the specified integration.
Webhook data: When using webhooks, data is transmitted to the endpoints you specify. Please ensure that your endpoints are secure.

14.3 We assume no responsibility for the data protection practices of integrated third-party providers. We recommend that you read the privacy policies of the respective services.

15. Privacy Notices for Specific Processing Activities

a) Newsletter and marketing emails

We send newsletters and marketing emails only with your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time. The withdrawal can be done by clicking the unsubscribe link in any email or by contacting us.

Data collected during newsletter delivery (openings, clicks) is stored for a maximum of 3 years after your last interaction.

b) Customer support

For support requests, we process the information you provide to handle your request. Support communication is stored for 3 years after the case is resolved.

c) Payment processing

Payments are processed via Stripe Technology Europe Ltd. Storsko only receives encrypted payment references. Complete payment data remains with Stripe. More information: Stripe Privacy Policy

d) Decision logging (Audit Trail)

The Storsko platform logs AI-powered decisions and actions as part of the Decision Log. These logs contain timestamps, triggering events, agent identification, and results. Storage is for 5 years according to Section 8.2 to fulfill compliance requirements.

16. Changes to this Privacy Policy

16.1 We reserve the right to update this Privacy Policy from time to time. Significant changes will be communicated to you by email at least 30 days before they take effect.

16.2 The current version is available at /privacy.

16.3 If changes may materially affect the processing of your data, we will additionally inform you of the most important changes and give you the opportunity to object or close your account.

17. Contact and Complaints

17.1 For questions about data protection or to exercise your data subject rights, please contact:

Email: privacy@storsko.com

Data Protection Officer: dsb@storsko.com

Postal address: Storsko, Privacy Team, Alstertor 14, 20095 Hamburg

17.2 You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The supervisory authority responsible for us is:

The Hamburg Commissioner for Data Protection and Freedom of Information

Klosterwall 6 (Block C)

20095 Hamburg

Phone: +49 (0) 40 42854 4040

Email: mailbox@datenschutz.hamburg.de

Website: www.datenschutz.hamburg.de

17.3 You may also contact the supervisory authority of your country of residence or any supervisory authority in the EU.

Last updated: April 2026

This Privacy Policy was prepared with the utmost care. It serves informational purposes and does not constitute legal advice.

Privacy Policy

Table of Contents

1. Controller and Data Protection Officer

2. Collection and Processing of Personal Data

3. Purposes and Legal Bases for Processing

4. Categories of Processed Data

5. Cookies and Tracking Technologies

6. Disclosure of Data to Third Parties

7. International Data Transfers

8. Retention Periods and Data Deletion

9. Your Rights (Data Subject Rights)

10. Automated Decision-Making and Profiling

11. Children and Adolescents

12. Data Security

13. Data Protection for AI Services

14. Third-Party Integrations

15. Privacy Notices for Specific Processing Activities

16. Changes to this Privacy Policy

17. Contact and Complaints