Skip to content

Legal

Privacy Policy

The German version is the legally binding version. This English translation is provided for convenience.

As of: May 28, 2026

Introduction

RelationFlow Ltd. (“we” or “us”) operates the Corporate LLM platform and processes personal data in doing so. The legal bases for this arise in particular from the General Data Protection Regulation (GDPR), the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (German Telecommunications Digital Services Data Protection Act, TDDDG) and the Bundesdatenschutzgesetz (German Federal Data Protection Act, BDSG).

This Privacy Policy informs you, in accordance with Art. 12 to Art. 14 GDPR, about which data we collect, for which purposes we use it and on which legal basis the processing takes place. It covers in particular:

  • Technical provision of the website (Section 2.1)
  • Cookies and tracking technologies (Section 2.2)
  • Contact form (Section 2.3)
  • Newsletter (Section 2.4)
  • Social media (Section 2.5)
  • Contract processing and customer relationships (Section 2.6)
  • Use of the platform (Section 2.7)
  • Pay-as-you-go (PAYG) (Section 2.8)
  • Voicely bundle and cross-account linking (Section 2.9)

In addition, this Privacy Policy contains information about recipients of your data (Section 3), transfers to third countries (Section 4), the storage period (Section 5), your rights (Sections 6 and 7), the provision of data (Section 8) and automated decision-making (Section 9).

1. Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

RelationFlow Ltd.
Anthypolochagou Georgiou M. Savva 26
Office 1-2
8201 Paphos, Cyprus (CY)

E-mail: support@corporatellm.de
Represented by: Leonard Schmedding (Director)

2. Data Processing in Detail

2.1 Technical Provision of the Website

When you visit our website, technical information transmitted by your browser to our server is automatically collected. This access data is required for the technical provision of the website and includes in particular:

  • IP address of the requesting device
  • Date and time of access
  • Browser type and version
  • Operating system used
  • Referrer URL (previously visited page)

This data is stored in server log files and serves exclusively the technical provision and security of the website. It is not combined with other data sources or evaluated for marketing purposes.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technical provision and security of the website).

Storage period: The server logs are stored for a maximum of 7 days and then automatically deleted.

Hosting provider: Our website is hosted by Vercel Inc.

2.2 Cookies and Tracking Technologies

Our website and platform use cookies and similar technologies. Cookies are small text files stored on your device.

a) Technically necessary cookies

These cookies are required for the operation of the website and platform. They enable basic functions such as login and session management. Without these cookies, the platform cannot function properly.

  • Session cookie (Supabase): Authentication and login, storage period: session
  • Consent cookie (Corporate LLM): First-party cookie storing your cookie settings, storage period: 12 months

Legal basis: Art. 6(1)(f) GDPR (legitimate interest) and § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act).

b) Analytics cookies

With your consent, we use analytics tools to understand and improve the use of our website and platform.

  • PostHog (PostHog, Inc., EU hosting): Product analytics and usage behavior; data processed on EU servers

Legal basis: Art. 6(1)(a) GDPR (consent).

c) Marketing cookies

With your consent, we use marketing tools to show you relevant advertising and to measure the effectiveness of our campaigns.

  • Rewardful: Affiliate and referral tracking to correctly attribute referrals and commissions

Legal basis: Art. 6(1)(a) GDPR (consent).

d) Managing your settings

When you first visit our website, a cookie banner asks you which cookies you wish to allow. You can change your settings or withdraw your consent at any time via the “Cookie settings” link in the footer of the website.

2.3 Contact Form

On our website we offer a contact form through which you can get in touch with us. When you use the contact form, the following data is collected:

  • First name and surname
  • E-mail address (business)
  • Telephone number
  • Company name
  • Company size
  • How you heard about us
  • Your message

In addition, your IP address as well as the date and time are recorded when the form is submitted.

We use this data exclusively to process and respond to your inquiry and for any follow-up questions. The data is not passed on to third parties unless this is necessary to process your inquiry.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures), insofar as your inquiry is aimed at concluding a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

Storage period: The data is deleted as soon as it is no longer required for processing your inquiry, unless statutory retention obligations prevent this.

2.4 Newsletter

We offer the option of subscribing to a newsletter through which we inform you about news, product updates and relevant content.

a) Sign-up

We use the double opt-in procedure for newsletter sign-ups. This means: after signing up, you receive an e-mail with a confirmation link. Your sign-up is only completed once you click this link. Without confirmation, your data is automatically deleted.

When you sign up, we store:

  • E-mail address
  • Time of sign-up and confirmation
  • IP address

b) Newsletter to existing customers

If you have purchased a product or booked a service from us, we may use your e-mail address to inform you about similar offers, provided you have not objected to this.

Legal basis: § 7(3) UWG (German Act Against Unfair Competition) in conjunction with Art. 6(1)(f) GDPR (legitimate interest).

c) Content and analysis

The newsletter may contain information about our products, services and relevant industry topics. We reserve the right to measure the open and click rates of the newsletter in order to improve our content.

d) Unsubscribing

You can unsubscribe from the newsletter at any time. You will find an unsubscribe link at the end of every newsletter. Alternatively, you can send us an e-mail to support@corporatellm.de. After unsubscribing, your data will be deleted unless statutory retention obligations apply.

Legal basis (for sign-up): Art. 6(1)(a) GDPR (consent).

2.5 Social Media

We maintain company pages on various social networks in order to provide information about our products and services and to get in touch with you. We link to these presences on our website.

a) Which networks we use

  • LinkedIn (LinkedIn Ireland Unlimited Company)
  • Instagram (Meta Platforms Ireland Ltd.)
  • Facebook (Meta Platforms Ireland Ltd.)
  • X / Twitter (X Corp.)
  • TikTok (TikTok Technology Limited)
  • YouTube (Google Ireland Ltd.)

b) Data processing when you visit our company pages

When you visit our company pages, personal data is processed by the respective platform operator. This may include: IP address, profile information, interactions with our content and information about your usage behavior.

The platforms provide us with anonymized statistics on the use of our company pages (e.g. reach, interactions). We have no access to the underlying personal data.

c) Joint controllership

For certain processing operations (in particular the creation of page statistics), we are jointly responsible with the platform operators within the meaning of Art. 26 GDPR. The platform operators have provided corresponding agreements for this purpose:

You can assert your data subject rights both against us and against the respective platform operators.

d) Privacy information of the platforms

Further information on data processing by the platform operators can be found in their privacy policies:

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in communicating with prospects and customers and in analyzing and optimizing our online presence).

2.6 Contract Processing and Customer Relationships

In the course of registration, ordering and use of our services, we process personal data of our customers.

a) Which data we collect

During registration and ordering, we collect:

  • First and last name
  • E-mail address
  • Telephone number
  • Company name (for business customers)
  • Position in the company (for business customers)
  • Company size (for business customers)
  • Delivery and billing address
  • VAT ID (for business customers)
  • Payment data (processed directly by Stripe)

b) Purposes of processing

We process this data for:

  • Creating and managing your customer account
  • Performing and processing the contract
  • Billing and payment processing
  • Communication regarding your order and our services
  • Customer service and support

c) Payment processing

Payment processing is handled via our payment service provider Stripe (Stripe Payments Europe Ltd.). Your payment data is collected and processed directly by Stripe. We have no access to complete credit card data. Further information can be found in Stripe’s privacy policy:stripe.com/de/privacy

Legal basis: Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures).

Storage period: We store your data for the duration of the contractual relationship and beyond that in accordance with statutory retention obligations (up to 10 years under commercial and tax law).

2.7 Use of the Platform

When you use our Corporate LLM platform, personal data is processed.

a) Which data arises during use

When you use the platform, we process:

  • Chat histories and prompts (your inputs)
  • Uploaded files and documents
  • Generated responses and outputs
  • Usage statistics (e.g. number of requests, models used)

b) Transfer to AI providers

To process your requests, your inputs (prompts) are transmitted to the respective AI providers:

  • OpenAI (via Microsoft Azure, EU)
  • Anthropic (via Amazon Bedrock and Google Cloud, EU)
  • Google (via Google Cloud, EU)

Processing takes place exclusively on European servers. According to the terms of use of the cloud providers, your data is not used to train AI models.

c) Storage period

  • Chat data: Stored permanently until you delete it or close your account
  • Usage statistics: Stored permanently, anonymized after 180 days
  • Invitations (for Enterprise): Permanently viewable, anonymized after 30 days

After the end of the contract, your data is deleted within 30 days.

d) Distinction by customer type

Private customers (single user): If you use the platform as a private individual, we are the controller for the processing of your data.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Business customers (Enterprise): If you use the platform as an employee of a company that has provided you with access, that company is the controller for the processing of your data. In that case, we act as a processor within the meaning of Art. 28 GDPR.

In this case, please contact your employer with any questions about data processing and to exercise your data subject rights.

2.8 Pay-as-you-go (PAYG)

If the owner of a paid account area (Starter, Pro, Max or Enterprise) activates the pay-as-you-go model and tops up a prepaid balance, we process the following data for this purpose, in addition to the data of general contract processing (Section 2.6):

a) Which data we process

  • Account/team ID of the owner (internal identifier)
  • Current PAYG credit balance and activation status
  • Stripe customer ID of the account area as well as Stripe payment intent IDs and charge IDs of the individual top-up transactions
  • Append-only ledger of all top-up, consumption and refund transactions (amount in micro-EUR, transaction type, timestamp)
  • Marking of individual usage events as to whether they were billed against the plan-tier budget or against the PAYG credit

b) Purposes of processing

  • Provision of the pay-as-you-go model in accordance with Clause 8.10 of the Terms of Service (AGB)
  • Correct offsetting of plan-tier budget and PAYG credit as well as complete traceability towards the customer and towards financial and tax authorities
  • Idempotent processing of Stripe refunds to avoid duplicate bookings
  • Detection and prevention of fraud or abusive use

c) Recipients

Top-up payments are processed via our payment service provider Stripe (Stripe Payments Europe Ltd.). Only the data necessary for the payment transaction is transmitted to Stripe. We have no access to complete payment data.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (compliance with obligations under tax and commercial law).

Storage period: PAYG ledger entries are stored for the duration of the contractual relationship and beyond that for the fulfillment of retention obligations under commercial and tax law (up to 10 years). The current credit balance is maintained until it is fully consumed or until the contract ends.

2.9 Voicely Bundle and Cross-Account Linking

Selected plan tiers and launch offers of the Corporate LLM platform include the Voicely bundle described in Clause 8.11 of the Terms of Service (AGB). The Corporate LLM and Voicely platforms are both operated by the same controller, RelationFlow Ltd. No transfer of your data to an external third party takes place for bundle activation.

a) Which data we process

  • Account/team ID of the account area as well as the number of credited and redeemed stamps
  • Status, activation and expiry time of the individual stamps as well as any assigned Voicely subscription IDs
  • The customer’s e-mail address stored with the payment service provider Stripe, which is used for matching against any Voicely customer already existing in the same Stripe account (hybrid flow: promo code for new customers)
  • For existing Voicely customers: the ID of the existing Voicely subscription and the expiry date extended by the bundle
  • For new customers: the generated promo code ID and the redemption status for the purpose of sending reminder and activation messages

b) Purposes of processing

  • Provisioning and management of the Voicely bundle in accordance with Clause 8.11 of the Terms of Service (AGB)
  • Avoidance of double charges for customers who already have a paying Voicely contract
  • Sending of activation, reminder and expiry e-mails by the provider
  • Rollback of a not-yet-redeemed Voicely bundle in the event of a refund or revocation of the underlying Corporate LLM contract

c) Responsibility within RelationFlow Ltd.

Since Corporate LLM and Voicely are both operated under the responsibility of RelationFlow Ltd., the cross-account linking does not constitute a transfer to a third party but rather processing within the same controller. The privacy notices applicable on both platforms are to be read consistently in this respect.

d) Data flow to Stripe

All stamp redemptions and any automatically renewed Voicely plans (Clause 8.11 lit. d of the Terms of Service) are processed via the payment service provider Stripe (Stripe Payments Europe Ltd.). For this purpose, Stripe processes the data necessary for payment processing in accordance with its own privacy policy.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in clean cross-platform provisioning and in avoiding double charges).

Storage period: Stamp records are retained for the duration of the contractual relationship with Corporate LLM and deleted after the expiry of any retention obligations under commercial and tax law. The Voicely subscription ID assigned to a bundle activation is stored for as long as it is needed for the contract processing of both platforms.

2.10 Legal Obligations

We process your personal data to the extent necessary to fulfill legal obligations. These include in particular retention obligations under commercial and tax law (e.g. for invoices and contract documents).

Legal basis: Art. 6(1)(c) GDPR (compliance with a legal obligation).

Storage period: Up to 10 years pursuant to §§ 238, 257 HGB (German Commercial Code) and § 147 AO (German Fiscal Code).

2.11 Legal Enforcement

We process your personal data to the extent necessary to establish, exercise or defend legal claims. This also includes the defense against or prosecution of criminal offenses.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in enforcing and defending our rights).

Storage period: Until the expiry of the statutory limitation periods (as a rule 3 years, in exceptional cases up to 30 years).

2.12 In-App Support & Screenshots

Within the app, you can send a support request via “Help & Feedback”. In doing so, we process your message as well as technical diagnostic data (browser, operating system, current page, app version, recent error messages, account ID and role). This diagnostic data is cleansed of sensitive content on the client side before being sent.

Screenshots:You can optionally attach screenshots. These are stored in private storage (Supabase Storage, bucket “support-attachments”), are accessible exclusively to our support team via time-limited, signed links (max. 3 files, max. 5 MB each, formats PNG/JPG/WebP) and are automatically deleted after 90 days. Please do not make passwords or personal data of third parties visible in screenshots.

Legal basis: Art. 6(1)(b) GDPR (processing of your support request) and Art. 6(1)(f) GDPR (legitimate interest in efficient technical troubleshooting).

Recipients: Supabase Inc. (storage of the screenshots, see Section 3) and Resend Inc. (sending of the support e-mail to our team with time-limited, signed links — the image data itself is not transmitted to Resend, see Section 3). Technical diagnostic data (without image content) may additionally be transmitted to Sentry (see Section 3).

Storage period: Screenshots are automatically deleted after 90 days. We retain the content of your request for as long as is necessary for processing.

3. Recipients of Your Data

To provide our services, we work with external service providers who may have access to personal data to varying degrees.

a) Processors

These service providers process data exclusively in accordance with our instructions:

Hosting & infrastructure:

  • Vercel Inc. – website and app hosting
  • Supabase Inc. – database and authentication
  • Upstash Inc. – caching

AI services:

  • Microsoft Azure (Microsoft Corporation) – hosting of OpenAI models
  • Amazon Web Services (Amazon.com Inc.) – hosting of Anthropic models
  • Google Cloud (Google Ireland Ltd.) – hosting of Google and Anthropic models

E-mail:

  • Resend Inc. – sending of transactional e-mails

Analytics & monitoring:

  • Sentry (Functional Software Inc.) – error monitoring
  • PostHog (PostHog, Inc., EU hosting) – product analytics (only with consent)

Cookie management:

  • Corporate LLM (own first-party consent management) – cookie banner and consent management

b) Independent recipients

These service providers decide independently on the processing of the data:

Payment:

  • Stripe (Stripe Payments Europe Ltd.) – payment processing

Marketing (only with consent):

  • Rewardful – affiliate and referral tracking (only with consent)

c) Other recipients

In individual cases, we may also transmit data to the following recipients:

  • Authorities and public bodies, to the extent that a legal obligation exists
  • Lawyers and tax advisors, to the extent necessary to assert our rights

4. Data Transfers to Third Countries

We endeavor to process your data exclusively within the European Union (EU) or the European Economic Area (EEA). Our infrastructure, including databases and AI services, is operated on European servers.

Insofar as we use service providers based outside the EU/EEA (in particular in the USA), we ensure that an adequate level of data protection is guaranteed. This is done through:

  • Adequacy decision: For transfers to the USA, we use service providers certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
  • Standard contractual clauses: Where no adequacy decision exists, we use the standard contractual clauses approved by the EU Commission (Art. 46(2)(c) GDPR).

5. Storage Period and Deletion

We process your personal data only for as long as is necessary for the respective processing purposes. The duration of storage is determined by the following criteria:

a) Performance of a contract

Insofar as the processing takes place for the performance of a contract, we store your data for the duration of the contractual relationship, including its initiation and winding-up (Art. 6(1)(b) GDPR).

b) Legitimate interests

Insofar as the processing takes place to safeguard legitimate interests, we store your data until the respective processing purpose has been achieved or until you object to the processing (Art. 6(1)(f) GDPR, Art. 21 GDPR).

c) Consent

Insofar as the processing is based on your consent, we store your data until you withdraw your consent (Art. 6(1)(a) GDPR, Art. 7(3) GDPR).

d) Statutory retention obligations

Even after the original processing purpose has been achieved, further storage may be necessary in order to fulfill statutory retention obligations. This concerns in particular:

  • Retention obligations under commercial law pursuant to §§ 238, 257 HGB (German Commercial Code): up to 10 years for commercial books, inventories, balance sheets and accounting records
  • Retention obligations under tax law pursuant to § 147 AO (German Fiscal Code): up to 10 years for documents relevant for tax purposes

e) Legal enforcement

To establish, exercise or defend legal claims, we may store data until the expiry of the statutory limitation periods. The standard limitation period pursuant to §§ 195, 199 BGB (German Civil Code) is three years, in exceptional cases up to 30 years (§ 197 BGB).

f) Specific storage periods

For the specific storage periods of the individual processing activities, please refer to the respective sections of this Privacy Policy:

  • Website visit (Section 2.1)
  • Contact form (Section 2.3)
  • Newsletter (Section 2.4)
  • Contract processing (Section 2.6)
  • Platform use (Section 2.7)
  • Pay-as-you-go (Section 2.8)
  • Voicely bundle (Section 2.9)
  • Statutory retention obligations (Section 2.10)
  • Legal enforcement (Section 2.11)
  • In-app support & screenshots (Section 2.12)

After expiry of the respective storage period, your data will be deleted or anonymized, unless further retention obligations exist.

6. Your Rights

As a data subject, you have the following rights, which you can assert at any time using the contact details given in Section 1:

a) Right of access (Art. 15 GDPR)

You have the right to request confirmation as to whether we process personal data concerning you. If this is the case, you are entitled to information about this data as well as further information such as the processing purposes, the categories of data, recipients and the planned storage period.

b) Right to rectification (Art. 16 GDPR)

You have the right to request the immediate rectification of inaccurate data and the completion of incomplete data.

c) Right to erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data, provided one of the statutory grounds applies, e.g. if the data is no longer necessary for the purposes for which it was collected or if you have withdrawn your consent.

d) Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of the processing of your data, e.g. if you contest the accuracy of the data or if the processing is unlawful but you do not want erasure.

e) Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. You may transmit this data to another controller or request that we do so, insofar as this is technically feasible.

f) Right to withdraw consent (Art. 7(3) GDPR)

If you have given us consent to data processing, you may withdraw it at any time with effect for the future. The lawfulness of the processing carried out up to the withdrawal remains unaffected.

g) Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR.

7. Right to Object

a) Objection on grounds relating to your particular situation (Art. 21(1) GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, insofar as it is based on Art. 6(1)(f) GDPR (legitimate interest). We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests.

b) Objection to direct marketing (Art. 21(2) GDPR)

Insofar as we process your data for direct marketing, you have the right to object at any time without stating reasons. We will then no longer use your data for marketing purposes.

c) Exercising the right to object

Please address your objection to:support@corporatellm.de

8. Provision of Data

There is no statutory or contractual obligation to provide us with your personal data. However, if you choose not to provide certain data, this may mean that we are unable to provide our services, or unable to provide them in full – in particular registration, use of the platform or processing of your inquiries.

Voluntary information is marked accordingly in our forms.

9. Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR that produces legal effects concerning you or similarly significantly affects you.

This Privacy Policy is dated May 28, 2026. Due to the further development of our website, products and services or due to changed statutory or regulatory requirements, it may become necessary to amend this Privacy Policy. You can find the current version on our website at any time.

Start today with your team

Start now — no credit card, no risk.

Get started for free