Privacy policy

This English translation is provided for convenience. Only the German version is legally binding.

This privacy policy explains which personal data we process when you visit our website, chat with our AI assistant Bretzi or write to us, why we do so and what rights you have. It is based on the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications and Digital Services Data Protection Act (TDDDG).

1. Controller

The controller responsible for data processing on this website is:

Luciana Yurrebaso Consoli
Business name: Bretzel Brand Lab
Meisterhofstrasse 12
88250 Weingarten
Germany
Email: hallo@bretzelbrand.com
Phone: +49 151 72155822

We are not required to appoint a data protection officer. If you have any questions about data protection, just write to us at the address above.

2. Overview

  • Visiting the website: our hosting provider processes the connection data that is technically necessary (section 3).
  • No cookies, no tracking: our website uses no cookies, no analytics or advertising services and no embedded third-party content. Fonts are hosted on our own server.
  • AI chat (applies only from Bretzi's launch): when you open the chat with Bretzi and write, we process your messages on our own platform in the EU. To generate replies, the conversation text is sent to Anthropic, including to the USA (section 7). Nothing is transmitted before your first message.
  • Contact: when you contact us by email, phone or WhatsApp, we process your details to answer your enquiry (section 6).

You are not obliged to give us any personal data. Without your message, however, we cannot answer your enquiry.

3. Website hosting and server log files

Our website is hosted by Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus ("Hostinger"). The server is located in Germany.

Each time our website is accessed, the server automatically processes data that your browser sends: your IP address, the date and time of access, the page or file requested, the page you came from (referrer), browser type and version, operating system, and the amount of data transferred and status code. This data is needed to deliver the website and keep it stable and secure. The log files are deleted after 7 days.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is providing the website securely and without errors.

Hostinger processes the data as our processor. We have a data processing agreement with Hostinger under Art. 28 GDPR. Hostinger uses its own sub-processors. Where data reaches countries outside the European Economic Area in this context, it is protected by the EU standard contractual clauses (Art. 46 (2) (c) GDPR).

4. The Bretzi platform (our own server)

This section applies only from Bretzi's launch (see section 7). The AI chat runs on Bretzi, our own platform at bretzi.bretzelbrand.com. It runs on a virtual server that Hostinger operates for us in a data centre in Germany. The data processing agreement with Hostinger also covers this server.

  • No access logs: the Bretzi server keeps no access logs with IP addresses. It only writes technical error messages, without conversation content. These logs are limited in size and are overwritten continuously.
  • Protection against abuse: to limit the number of messages per sender, we use a secret key to turn your IP address (for IPv6, its network part) into a shortened hash value. We do not store the IP address itself. The hash value is stored with the conversation and deleted with it. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protecting the platform against abuse and unnecessary costs.
  • Backups: Hostinger automatically makes weekly backups of the whole server; each backup is overwritten by the next one. Deleted conversations may therefore remain in a backup until it is overwritten. There is no other off-site copy.

5. Fonts

All fonts are hosted on our own server. When you visit our website, no connection is made to servers of Google or other font providers.

6. Contact by email, phone and WhatsApp; links to Instagram and LinkedIn

Email and phone: when you email or call us, we process your details (for example your name, email address, phone number and message) to answer your enquiry. Our mailbox is operated by Hostinger on servers in the EU under the data processing agreement. The legal basis is Art. 6 (1) (b) GDPR if your enquiry relates to a contract, and otherwise Art. 6 (1) (f) GDPR (our legitimate interest in answering enquiries).

Links to WhatsApp, Instagram and LinkedIn: our website contains plain links to WhatsApp (wa.me), Instagram and LinkedIn. No plugins or scripts of these providers are embedded. Until you click a link, no data is sent to these providers. After the click, each provider processes your data under its own privacy policy and as its own controller: WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Instagram: Meta Platforms Ireland Limited, Ireland; LinkedIn: LinkedIn Ireland Unlimited Company, Ireland. These providers also transfer data to the USA, among other things on the basis of the EU-U.S. Data Privacy Framework.

Messages on WhatsApp: when you write to us on WhatsApp, we process your phone number, your name and your message to answer your enquiry (Art. 6 (1) (b) or (f) GDPR). WhatsApp Ireland Limited also processes data in this context, in particular your phone number and connection data, including in the USA (EU-U.S. Data Privacy Framework). Message content is end-to-end encrypted. For confidential information, we recommend email.

We delete enquiries that do not lead to an offer or a project at the latest 12 months after the last contact (section 8). If an enquiry leads to an offer or a project, we keep the correspondence as a business letter (section 8).

7. Bretzi, our AI chat assistant

Bretzi is not active yet. Until launch, no data is processed through the Bretzi icon. This section applies from the launch of the chat.

AI notice

On our website you can chat with Bretzi, an AI assistant that answers general questions about our services, prices and process. Bretzi is an AI system within the meaning of the AI Act, Regulation (EU) 2024/1689. In line with Art. 50 of the AI Act, Bretzi is clearly marked as an AI before your first message, and if you ask whether you are talking to a person, Bretzi answers truthfully. Replies are generated with Claude, a language model by Anthropic. Replies from our team show a name and photo, and the chat shows when a team member joins and when Bretzi is answering again.

Only when you use the chat

The chat window is part of our website and does not connect to our chat server or to any third party by itself. As long as you do not open the chat, nothing is stored on your device. Data is only transmitted when you send your first message, and then only to our own server. After that, while the browser tab stays open, the chat window also connects to our server on other pages of our website, so that you receive replies from our team.

What data we process

  • your messages and anything you include in them (for example your name, business or email address, if you mention them);
  • the language, the page you chat from and the time of each message;
  • a random conversation ID created by your browser;
  • the hash value of your IP address described in section 4, to prevent abuse;
  • your reaction to ideas that Bretzi shows as short pop-ups (opened, closed or faded), so that Bretzi can take them into account later in the conversation;
  • whether you clicked WhatsApp, Email or "Talk to a person" in the chat, so that our team knows you would like personal contact;
  • the replies from Bretzi and from our team;
  • a short internal summary that Bretzi writes for our team (the project you want, a fitting service package, what you said about budget, open questions, prices mentioned), and internal notes from our team (for example the status of the enquiry and who is in charge);
  • draft replies held back by our automatic price check; these are not shown to you but are stored for review.

We do not need an address or other personal details to give you an estimate. Please do not share sensitive data in the chat, such as health or bank details.

Purposes and legal bases

We process this data to answer your questions, prepare your enquiry and help you in person where needed. The legal basis is Art. 6 (1) (b) GDPR insofar as your enquiry relates to a contract, and otherwise Art. 6 (1) (f) GDPR. Our legitimate interest is answering questions about our services quickly and in your language, and protecting our platform against abuse.

Anthropic as processor

For each reply, our server sends the following data to Anthropic: the conversation so far (your messages, Bretzi's replies and our team's messages), the language, the page, your reactions to ideas shown and our instructions to Bretzi. Occasionally a draft reply from Bretzi is checked in a second request, which contains only the draft text. Bretzi generates the internal summary and the draft replies with the help of Anthropic as part of each reply; we do not send the summary or held-back drafts to Anthropic again afterwards. We do not send your IP address or its hash value, your conversation ID, browser data or our team's internal notes. Your data only reaches Anthropic through our server, never directly from your browser.

Our contracting partner is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. Processing takes place in the USA by Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA, and its sub-processors. Anthropic processes the data as our processor under a data processing agreement pursuant to Art. 28 GDPR (Data Processing Addendum), which is part of Anthropic's commercial terms. Anthropic may not use the content to train its models.

Transfer to a third country: in the data processing agreement, Anthropic Ireland, Limited has undertaken to safeguard transfers to the USA with the EU standard contractual clauses (Implementing Decision (EU) 2021/914, Modules 2 and 3) (Art. 46 (2) (c) GDPR). You can request a copy from us.

Retention at Anthropic: Anthropic normally deletes inputs and outputs within 30 days. Content that violates Anthropic's usage policy may be kept for up to 2 years, and classification results from its safety review for up to 7 years. Longer retention is also possible where the law requires it.

Access by our team

Our team can read all conversations, join the chat and give Bretzi instructions. When a team member takes over, you see their first name and photo. Our team can also see whether your chat window is currently connected to our server. When Bretzi passes a question to the team, or when you ask for a person or choose WhatsApp or email in the chat, we receive an email with the reason, the language and a link to the conversation, but without its content.

No automated decisions

Bretzi makes no decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Whether we make an offer, and on what terms, is always decided by our team.

Non-binding information

All information in the chat, including prices and timelines, is non-binding. We make binding offers only after a personal conversation.

Storage on your device

The chat sets no cookies. When you open the chat, it stores in your browser's session storage, under "bretzi_state", the random conversation ID, whether the window is open, the conversation as shown (including the names and photos of team members who joined) and your reactions to the ideas shown. This lets you continue the conversation on other pages of our website. Only our website reads this data, and your browser deletes it when you close the tab.

This is strictly necessary for the service you explicitly requested and is therefore permitted without consent under § 25 (2) no. 2 TDDDG. There is no tracking.

Retention

Conversations are deleted automatically 180 days after the last activity, together with all related data. This also applies if a conversation leads to an offer or a project: we then only transfer the details needed for it (for example name, business and project) to our offer and project documents and keep these documents for the statutory periods (section 8). You can ask us at any time to delete a conversation immediately. For storage in backups, see section 4.

8. Retention at a glance

We keep personal data only as long as needed for the purpose concerned or as required by statutory retention duties. The periods for the chat and the Bretzi platform apply only from Bretzi's launch (see section 7).

  • Chat conversations on the Bretzi platform: deleted automatically 180 days after the last activity.
  • Email alerts to our team about chat conversations in our mailbox: deleted after 180 days.
  • Emails, phone notes and WhatsApp messages that do not lead to an offer or a project: deleted at the latest 12 months after the last contact.
  • Internal logs of team actions on the platform (for example taking over a conversation or instructions to Bretzi): deleted after 180 days.
  • Platform backups: 14 days.
  • At Anthropic: normally 30 days (exceptions in section 7).
  • Website server log files: see section 3.
  • Business letters (our offers, and the emails and WhatsApp messages that lead to an offer or a project): 6 years (§ 147 AO).
  • Accounting vouchers such as invoices: 8 years; books and records: 10 years (§ 147 AO).

Statutory periods start at the end of the calendar year in which the document was created. During that time we restrict processing to storage.

9. Recipients

We do not sell your data or pass it on for advertising. The only recipients are:

  • Hostinger International Ltd. (Cyprus), as processor for the website, the Bretzi server (only from Bretzi's launch) and email;
  • Anthropic Ireland, Limited, with processing by Anthropic, PBC in the USA, as processor for the replies in the AI chat (applies only from Bretzi's launch, see section 7);
  • WhatsApp Ireland Limited, if you write to us on WhatsApp (section 6);
  • our tax advisers and public authorities, where we are legally obliged.

10. SSL/TLS encryption

Our website and the Bretzi platform (only from Bretzi's launch) transmit all data encrypted over HTTPS (TLS).

11. Your rights

You have the right at any time to:

  • access the data we hold about you (Art. 15 GDPR);
  • have inaccurate data corrected (Art. 16 GDPR);
  • erasure (Art. 17 GDPR);
  • restriction of processing (Art. 18 GDPR);
  • data portability (Art. 20 GDPR);
  • withdraw consent with effect for the future (Art. 7 (3) GDPR), where we process data on the basis of consent.

Just write to us at hallo@bretzelbrand.com. For a specific chat, it helps if you roughly describe when it took place and what it was about, because chats are stored without an account and only contain your name if you gave it yourself.

12. Right to object under Art. 21 GDPR

Where we process your data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. An informal objection to hallo@bretzelbrand.com is enough.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)
Heilbronner Straße 35, 70191 Stuttgart, Germany
Postal address: Postfach 10 29 32, 70025 Stuttgart, Germany
Phone: +49 711 61 55 41-0
Email: poststelle@lfdi.bwl.de
www.baden-wuerttemberg.datenschutz.de

14. Changes to this privacy policy

We update this privacy policy when our website, our services or the law change. The version published here applies.

Last updated: November 2026