Privacy notice

1. Scope of this notice

This privacy notice explains how Auditi GmbH processes personal data when you visit this marketing website, use its language and display controls, submit a demo or trial request or contact us. It does not govern the separate Auditi application, which has its own privacy information.

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

3. Data protection officer

You can contact our data protection officer directly at:

4. Principles and legal bases

We process personal data only where this is necessary for a stated purpose and a legal basis applies. Depending on the situation, we rely on steps requested before entering into a contract (Article 6(1)(b) GDPR), legal obligations (Article 6(1)(c) GDPR) or our legitimate interests (Article 6(1)(f) GDPR). For the optional measurement and advertising described below, we rely on your consent (Article 6(1)(a) GDPR). You may withdraw it at any time through Cookie settings.

5. Hosting and server logs

We host this website with Vercel.

When you access the website, the hosting infrastructure processes technical request data needed to deliver and protect the site. This may include:

• IP address and country or region derived from it
• Date and time of the request
• Requested address, request method and response status
• Referrer address, browser, operating system and device information
• Technical request, deployment and security identifiers

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient delivery of the website, error analysis and protection against misuse.

We do not maintain a separate archive of server logs. Runtime logs available to us through Vercel are retained according to the selected service plan for no more than 30 days. Relevant data may be retained longer where this is necessary to investigate a security incident, establish or defend legal claims or comply with a legal obligation.

Country-based edition suggestion

On the global homepage, Vercel may provide us with the ISO country code derived from the request IP address. We use it once to suggest a more relevant country edition. We do not receive a precise location and do not create a permanent location profile. If you dismiss the suggestion, a preference cookie prevents it from appearing repeatedly.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to present a relevant language and market edition without automatically redirecting visitors.

6. Privacy-focused web analytics

With your Performance consent, we measure aggregated website use with Vercel Web Analytics.

The service records information such as page and path, referring page, browser, device type, operating system, country, time and campaign parameters. It does not set analytics cookies. A daily changing hash derived from request data is used to count visits and cannot be used by us to recognize a visitor across different days or websites. We do not use this information to build user profiles.

The legal basis is your consent under Article 6(1)(a) GDPR. We use this information to understand aggregated use of the website and improve its content and navigation. You can withdraw Performance consent at any time through Cookie settings.

Performance measurement

With your Performance consent, we measure technical website performance with Vercel Speed Insights.

The service processes route or path, browser, device type, operating system, network speed, country, web performance values, related page elements, SDK information and event time. According to Vercel, the data points are anonymous, are not tied to a visitor or IP address and cannot reconstruct a browsing session.

The legal basis is your consent under Article 6(1)(a) GDPR. We use this information to identify technical performance problems and improve the website. You can withdraw Performance consent at any time through Cookie settings.

7. Cookies, browser storage and your choices

We use necessary cookies and browser storage to remember your privacy choices and requested display preferences. Optional Performance measurement and Advertising tracking are enabled only with your consent. You can accept or reject optional categories, choose them individually and change your choice later through Cookie settings. You can use the website and submit an enquiry without agreeing to optional tracking.

The necessary preference cookies listed below are stored under section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Any related processing of personal data is based on Article 6(1)(f) GDPR and our legitimate interest in retaining the preference you requested.

CookieFirst consent management

We use CookieFirst, provided by Digital Data Solutions B.V., Netherlands, to display our cookie choices, remember your selections and document consent. It processes your consent choices, a consent identifier, the time of your choice, the page address and technical browser information. CookieFirst states that it processes an anonymised IP address for this service.

CookieFirst uses both cookies and local storage in your browser. The cookiefirst-consent cookie remembers your choice for approximately six months. Local-storage entries named cookiefirst-consent, cookiefirst-id and cf-user-lang support consent management and language preferences. Local storage does not have the same browser-enforced expiry as a cookie and may remain until it is cleared by the service or through your browser settings.

Necessary storage and access for managing your choices are based on section 25(2)(2) TDDDG. Processing needed to document and demonstrate consent is based on Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR. Related processing needed to operate the consent controls is based on Article 6(1)(f) GDPR and our legitimate interest in reliably applying your privacy choices. More information: CookieFirst privacy policy.

Advertising campaign history

With your Advertising consent, we store dated campaign information and advertising click references in the first-party auditi_attribution cookie. This may include the campaign source, medium, name, term and content (the five UTM parameters), campaign, ad-group and ad IDs, Google's click reference (GCLID) and OpenAI's click reference (oppref). This helps us understand which advertising and campaign links brought you to our website and led to an enquiry.

The cookie can contain several attributed visits, rather than only the last one. Each dated entry is retained for up to 90 days. Entries may be removed earlier if you withdraw consent, clear browser data or the cookie reaches its size limit. This campaign history is stored in a cookie, not in local storage.

The same consent-based capture can record campaign information from other tagged links, including links on G2. A campaign label identifies the source or campaign; it is not itself a unique identifier for you.

Optional storage and access are based on your consent under section 25(1) TDDDG. The associated processing of personal data is based on Article 6(1)(a) GDPR.

Google Ads measurement and personalised advertising

With your Advertising consent, we use Google Ads to measure successful enquiry-form submissions, qualified enquiries and completed sales. Website submissions are reported by a Google tag managed through Google Tag Manager. The later qualification and sale events are reported from our CRM through Zapier, as described in section 8.

Google's advertising tag can process page and referrer information, event times, IP address, browser and device information, cookies and advertising identifiers. These identifiers can allow Google to recognise your browser and associate activity with an advertising interaction. Our conversion reporting does not include the name, email address, phone number or message you enter in the enquiry form.

Advertising consent also covers the use of Google tags to build audiences of website visitors for personalised advertising, including showing relevant Auditi ads after a visit. Our configured website-visitor audience has a 30-day membership duration. This is separate from the retention of browser campaign history and CRM records.

The legal basis is your consent under Article 6(1)(a) GDPR and, for optional storage or access on your device, section 25(1) TDDDG. More information about Google's processing: Google partner-site information and Google advertising information.

8. Demo and trial requests

When you submit the demo or trial request form, we process the information you enter and technical context sent with the submission.

The submission contains:

• Name, work email address and firm or company
• Product interest (trial requests)
• Optional message and your answer about how you found us
• Country edition, locale, page path and page address
• Referring-page information and, with Advertising consent, the dated campaign history and advertising click references described in section 7
• Submission time

We use the data to handle demo and trial requests, send trial confirmation and access emails, manually set up trial workspaces, take requested pre-contractual steps and prevent misuse.

The legal basis is Article 6(1)(b) GDPR where you request steps before entering into a contract. For inquiries made on behalf of a firm and abuse prevention, the legal basis is Article 6(1)(f) GDPR. Our legitimate interests are handling business inquiries and securing the form. The optional advertising attribution and conversion reporting described below are separately based on your Advertising consent under Article 6(1)(a) GDPR.

Name, work email, firm or company, and an answer to “How did you find us?” are required. Your answer to that question is separate from automatically captured advertising information. Trial requests also require your product interest. The demo message field is optional. Advertising consent is optional and is not required to submit an enquiry.

The form is sent from our server to our processor Zapier, Inc. Zapier creates the enquiry in our Pipedrive customer relationship management system (CRM) and forwards it to the responsible Auditi team. More information: Zapier.

We retain the submission for as long as needed to handle the inquiry and any resulting pre-contractual or contractual relationship. If no relationship results, we delete the data when the inquiry has been conclusively dealt with unless you have asked us to remain in contact or legal retention or claim periods require longer storage.

Linking enquiries to advertising

When you submit an enquiry form with Advertising consent, relevant campaign history and click references are transferred through Zapier and saved with your enquiry in Pipedrive. They remain associated with the enquiry if our sales team converts the lead into a deal. We use this information to measure which advertising leads to enquiries and sales.

Where the relevant Advertising consent remains valid, we report successful form submissions and qualified enquiries to Google and OpenAI. An enquiry is treated as qualified when our sales team converts its lead into a deal in an eligible sales pipeline. We also report completed sales to Google, including the sale value and currency.

Google receives the website-submission event through its website tag and later qualification and sale events through Zapier. OpenAI receives submission and qualification events through Zapier using the OpenAI click reference. These reports include the relevant event type, time and identifiers used to match the event and avoid duplicate reporting. Our conversion reporting to Google and OpenAI does not include your name, email address, phone number or enquiry message.

We retain CRM attribution data for as long as needed to attribute enquiries and sales and evaluate campaign performance. We delete or anonymise it when it is no longer needed. Withdrawal of Advertising consent is handled as described below. The 90-day browser-cookie period is not a separate 90-day retention limit for your CRM enquiry.

Withdrawing consent

You can withdraw Performance or Advertising consent at any time through Cookie settings. Withdrawal stops the corresponding optional measurement or advertising tracking on this website. Withdrawing Advertising consent also clears the advertising campaign-history cookie from that browser.

If that browser still holds advertising click references previously submitted with an enquiry, our website sends a withdrawal request through Zapier. We use those references to find matching Pipedrive leads and deals, remove their stored UTM tracking history and Google/OpenAI click-reference fields, and prevent further conversion reporting that depends on those removed references. This does not delete the business enquiry, the person or deal, or the source answer you supplied yourself.

Automatic CRM matching currently depends on a previously submitted Google or OpenAI click reference. It may therefore not find an enquiry that contains only UTM campaign information, or one whose browser references have been cleared or expired. To request removal of attribution information that cannot be matched automatically, contact us at support@auditi.com.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Clearing the CRM tracking fields does not automatically recall events already sent to Google or OpenAI or erase copies in notification messages and automation history. You can contact us to exercise your rights concerning those records. We may continue to retain the underlying business enquiry where a separate legal basis applies, as explained above.

9. Contact by email, telephone or fax

If you contact us by email, telephone or fax, we process your contact details, the content of the inquiry and related communication data to respond and manage the matter.

The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual communication and Article 6(1)(f) GDPR for other business inquiries. Our legitimate interest is the effective handling and documentation of communications addressed to us.

We delete contact data when the matter has been conclusively dealt with unless a contractual relationship, statutory retention duty, consent to further contact or the establishment, exercise or defence of legal claims requires longer storage.

10. Recipients and processors

Access is limited to authorized Auditi staff who need the data for the relevant purpose. We use Vercel for hosting and consent-based analytics and performance measurement; CookieFirst (Digital Data Solutions B.V.) for consent management; Zapier for enquiry delivery, withdrawal processing and conversion reporting and Pipedrive for CRM records. These service providers process data for us under applicable data protection agreements and may use subprocessors. Google and OpenAI receive the advertising information described in sections 7 and 8 and process it under the terms applicable to their advertising services. Information about Pipedrive's handling of CRM data is available in its data processing addendum. We disclose data to public bodies where legally required.

11. Processing outside the EEA

Our service providers and advertising recipients may process personal data outside the European Economic Area, including in the United States. This can include hosting, automation, CRM, internal communications and advertising processing by the providers described above. Where personal data is transferred outside the European Economic Area, the transfer is based on an applicable adequacy decision, including the EU-U.S. Data Privacy Framework where available, or the European Commission’s standard contractual clauses together with supplementary safeguards where required.

12. Security

This website uses TLS encryption. We and our processors use technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration and disclosure. No transmission or storage method can provide absolute security.

13. General retention rule

Unless a more specific period is stated above, we retain personal data only for as long as the relevant purpose and legal basis continue to apply. We then delete or anonymize the data unless statutory retention periods or the establishment, exercise or defence of legal claims require continued storage.

14. Your rights

Subject to the statutory requirements, you have the right to:

• Request access to your personal data and a copy of it (Article 15 GDPR)
• Request correction of inaccurate or completion of incomplete data (Article 16 GDPR)
• Request erasure of your personal data (Article 17 GDPR)
• Request restriction of processing (Article 18 GDPR)
• Receive data you provided in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller (Article 20 GDPR)
• Withdraw consent at any time with effect for the future where processing is based on consent (Article 7(3) GDPR)

Right to object

Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is needed to establish, exercise or defend legal claims. You may object to processing for direct marketing at any time without giving reasons.

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular in the EEA country of your habitual residence, place of work or the alleged infringement. The supervisory authority responsible for our German establishment is:

15. Automated decisions

We do not use the processing described in this notice for decisions based solely on automated processing that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR. With Advertising consent, website activity and advertising identifiers may be used to associate enquiries and sales with campaigns and to build Google advertising audiences, as described in sections 7 and 8. This does not involve a decision by Auditi about you with the effects described in Article 22 GDPR.

16. Changes to this notice

We update this notice when our website, providers or legal obligations change. The effective date and version shown at the top identify the current text.