Last updated: 12 October 2026
The controller for personal data processed on this website is Aivana GmbH, Paulusstr. 45a – Hinterhaus – LOFT45, 33602 Bielefeld, Germany. Contact us at info@aivana-gmbh.ai or by telephone at +49 521 92278996.
This notice explains processing when you visit the website, submit a contact request, register for the newsletter, use AI features or place an order. The relevant forms indicate the information needed for the requested function. Without that information we cannot process the request or order.
Cloudflare delivers the website and its API. Cloudflare Workers processes requests; Cloudflare D1 stores submitted contact, trial, newsletter, chat and order data. Website requests involve your IP address, requested address and technical browser and connection information, which are processed to deliver and protect the service.
To prevent abuse, the API limits requests using an IP address and a time window. These technical counters are separate from the content of your request. Where Cloudflare Turnstile protection is enabled, a form loads its verification script. Cloudflare receives technical verification and connection data; our API checks the result together with the IP address.
The purposes are reliable operation and protection against automated or abusive requests. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is website security and availability. Administrator sign-in uses Cloudflare Access and processes authorised administrators’ identities for access control.
For trial registrations, we store your name, company, email address, selected product, language, and the timestamp and version of the acknowledged privacy notice. We first send a confirmation email with a link valid for 48 hours. Only after your explicit confirmation is the available package queued as an email attachment with setup instructions. We store the email confirmation timestamp and assigned package version. Registration does not subscribe you to the newsletter.
When you use the contact form, we process your first and last name, email address, message and the telephone, company and interest details you provide. We store the request for handling and create an email notification for Aivana.
For a request about a contract or a service you wish to obtain, the legal basis is Article 6(1)(b) GDPR. Other requests are handled under Article 6(1)(f) GDPR; our legitimate interest is responding to your message.
Email notifications and confirmations are stored in a server-side delivery queue. Depending on the enabled delivery connection, the recipient address, subject and message are sent through Cloudflare Email, Resend or Microsoft Graph. A request remains stored even when its notification has not yet been sent.
Newsletter registration is optional and requires you to explicitly select the consent checkbox. Registration stores your email address, selected language, website section, the server-recorded consent timestamp, the consent-text version and the purpose “AI trends, case studies and practical tips”. We use these details to manage your registration and document consent. You first receive a confirmation email. Your subscription is activated only after you explicitly confirm using the linked form (double opt-in). The confirmation link expires after 48 hours; we store the confirmation timestamp and protected link tokens.
The legal basis for the newsletter communication you request is consent under Article 6(1)(a) GDPR. You may withdraw it at any time with future effect, using the unsubscribe link in each newsletter email and confirming the linked form, or by emailing info@aivana-gmbh.ai with “Unsubscribe from newsletter”. Withdrawal does not affect the lawfulness of processing before withdrawal.
When you use the chat, we store your messages, the responses, timestamps and a random session association in Cloudflare D1. Your input is sent to the configured AI service to generate an answer. AI demonstrations and content or SEO tools also process the text you submit for their respective functions.
AI processing uses Cloudflare Workers AI or OpenAI where that connection is configured. Features using internet context send a search query derived from your input through Cloudflare AI Gateway to the search provider Ceramic, and use the results to generate a response. The website chat itself does not request internet context.
The purpose is to provide the AI feature you requested. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is responding to your input and providing interactive tools. Article 6(1)(b) GDPR applies where your input concerns a specific pre-contractual request. Submit only information needed for your request and remove confidential information or other people’s personal data before submission.
Online ordering is exclusively for business customers. If enabled and you use it, we process your company name and business-customer confirmation. We send your email address, selected product, monthly net price and order association to Stripe to create a Checkout session for a monthly subscription. You enter payment information on Stripe’s Checkout page. Where that page requests a billing address or tax identifiers, Stripe processes these for billing.
Aivana stores your name, company and email address, business-customer confirmation, product, amount, currency, order and subscription identifiers, payment and subscription status, details of the latest invoice and the timestamp of your acceptance of the twelve-month minimum term. Stripe sends the corresponding payment and subscription events to our API. Article 6(1)(b) GDPR is the basis for order and contract processing; legally required retention is based on Article 6(1)(c) GDPR.
Local browser storage saves your selected language under “language” and your choice in the storage notice under “cookie-consent”. These entries remain in your browser until you clear them through browser settings or make a new selection.
The API sets the “aivana_chat” cookie only when a chat session is created. It contains a random identifier to associate and protect your chat session, cannot be read by page scripts, and is valid for 24 hours. Expiring or clearing the cookie does not delete messages already stored on the server.
Storage access strictly necessary to provide a feature you expressly requested is covered by section 25(2)(2) of Germany’s TDDDG. Other non-essential storage access requires consent under section 25(1) TDDDG. Your choice in the storage notice is not consent to newsletter communication or to processing your form or chat inputs.
To assess the website, we count public page views and website entries by day, language-specific path and source category, such as Google, Bing, GitHub or direct visits. This measurement uses no cookies, local storage, visitor identifiers or fingerprinting. The statistics do not store IP addresses, browser identifiers, full referring addresses, URL parameters or form inputs. Technical processing necessary for hosting remains separate.
Counters are aggregated in Cloudflare D1 and deleted after 180 days. Do Not Track and Global Privacy Control are respected. An entry is the first recorded public page view after the website loads; reloading can produce another entry. We do not identify unique people or cross-device visits. Browser restrictions may hide referral information, and automated traffic cannot be completely excluded.
The protected dashboard also shows actual trial request counts and the number of confirmed email addresses among those requests, grouped by product. This aggregates existing registration records; personal details do not appear in these statistics.
Static website images and icons load from the website’s own files. Font declarations use system or locally available fonts; the website does not embed a Google Fonts API. Editorial posts may use an externally hosted image address. Loading such an image sends technically necessary connection data, including your IP address, to the image provider.
Links to partner websites and plugin offers lead to an external website when you follow them. The respective provider’s privacy notice then applies.
Contact, trial, newsletter, chat and order data are stored on the server. Storage duration depends on the purpose of handling the request or contract, withdrawal or a deletion request, and any applicable statutory retention requirements. A browser cookie’s expiry is not a deletion deadline for these records. Contact us at the address above for information about the data held about you.
Recipients are Aivana and the hosting, AI, search, email and payment providers used for the feature you access. These providers operate internationally; depending on the service, processing may take place outside the European Economic Area. Contact Aivana for information about the recipients used for your request and any applicable transfer safeguards. Provider information is linked below.
Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent with future effect. You may object to processing based on legitimate interests on grounds relating to your particular situation; you may object to direct marketing at any time.
To exercise your rights, contact info@aivana-gmbh.ai. You may also lodge a complaint with a data protection supervisory authority, particularly in the Member State of your residence, workplace or an alleged infringement. The authority for North Rhine-Westphalia is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.