Privacy policy

1. Controller

Controller

ainulo UG (haftungsbeschränkt), Sesenheimer Str. 1, 10627 Berlin, Germany, represented by the managing director Francis Osuji

Privacy requests

datenschutz@ainulo.com

General contact

contact@ainulo.com

We have not appointed a data protection officer because the legal requirements for doing so are not met. The management is the contact for all privacy questions.

2. Overview

This website works without cookies, without audience measurement and without advertising networks. We do not load fonts, maps, videos or scripts from third parties. We process personal data only in these cases:

• when you open the website (sections 3 and 4),
• when you write to us through the form or by email (section 6),
• when you book an appointment through the linked calendar (section 7),
• when you apply to work with us (section 8).

3. Hosting and server logs

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, Vercel processes the technical connection data that is necessary: IP address, date and time, requested address, data volume, status code, and browser and operating system details. Without this data the page cannot be delivered or protected against abuse.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a stable, secure and efficient operation of the website. We do not use these logs for profiling. They are deleted after the short period that Vercel applies to log data.

We have a data processing agreement with Vercel (Art. 28 GDPR). Because Vercel is a US company, data may be transferred to the USA. The transfer relies on the EU Commission's standard contractual clauses and, where Vercel is certified, on the adequacy decision for the EU-US Data Privacy Framework (Arts. 45 and 46 GDPR).

4. Domain and DNS

Our domain is resolved through Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. We use it for DNS resolution only. Page content does not pass through Cloudflare. In doing so Cloudflare processes technical connection data of the requesting DNS servers. The legal basis is Art. 6(1)(f) GDPR (keeping the website reachable). A data processing agreement is in place. Transfers to the USA rely on the standard contractual clauses and, where certified, the EU-US Data Privacy Framework.

5. Cookies, fonts and browser storage

Cookies: We set no cookies. Fonts: All fonts are served from our own server, with no connection to Google or other providers. Audience measurement: We use no analytics or tracking services, so no consent banner is needed. If we introduce a measurement tool, we will change this policy first.

Draft storage: While you fill in the form, your browser keeps your entries in session storage so that they survive a page reload. The data stays in your browser only, is not sent to us and disappears when you close the tab. It happens only in response to your input and is needed for the function you asked for (§ 25(2) no. 2 TDDDG).

6. Contact form and email

Data: area, case description, details about systems and starting point, name, company, email address and, if you give it, phone number, plus the language of the page and your consent. Name, company and email address are required. Without them we cannot reply.

Purpose: We handle your enquiry and reply. Right after you send it you receive an automatic confirmation with the link to book an appointment. To fend off automated requests we use a hidden field and measure how long filling in the form took. Both serve only that purpose.

Legal basis: Art. 6(1)(b) GDPR where your enquiry aims at a contract or its preparation. Otherwise Art. 6(1)(a) GDPR based on your consent in the form. Spam protection rests on Art. 6(1)(f) GDPR. You can withdraw consent at any time with effect for the future, informally to datenschutz@ainulo.com. If you write to us by email directly, the basis is Art. 6(1)(b) or (f) GDPR.

Recipients: The enquiry goes through a function on our hosting to our mailbox. We use Resend (Resend, Inc., USA) to send it and Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA) for the mailbox. Data processing agreements are in place with both. Transfers to the USA rely on the standard contractual clauses, and for Google also the EU-US Data Privacy Framework. We do not pass your data on for advertising and do not add you to a mailing list.

Retention: We delete your enquiry once it is finally handled and no retention duty applies, after 24 months at the latest. If a contract is concluded, we keep business correspondence for as long as commercial and tax law require, usually six to ten years (Art. 6(1)(c) GDPR).

7. Appointment booking

For booking we link to Google Calendar appointment scheduling (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Clicking “Pick a time” opens a page run by Google. Only there does your browser pass data to Google, for example your IP address and, if you book, your name and email address. We have no influence on this processing. Google's privacy policy applies (policies.google.com/privacy). We receive the booking in our calendar. The legal basis is Art. 6(1)(b) GDPR because the booking prepares a contract. Booking is voluntary. You can also propose a time to us by email or phone.

8. Applications

We accept applications by email at work@ainulo.com. We process the data you send us, meaning contact details, CV and details about your work, to decide on working together. The legal basis is Art. 6(1)(b) GDPR in connection with § 26 BDSG. We pass applications only to the people who decide on working together. We explicitly ask for no photo and no special categories of personal data (for example health or religion). If you send them anyway, we process them only on the basis of your consent given by sending them.

Retention: After a rejection we delete your documents after six months. If we should keep you in mind for longer, we do so only with your explicit consent. If we start working together, the data is handled under the rules for the contract.

9. Recipients and transfers to third countries

The only recipients of your data are the service providers named in this policy that work on our behalf: Vercel (hosting), Cloudflare (DNS), Resend (email sending) and Google (mailbox, appointment booking). Transfers to third countries, above all the USA, rely on standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework. You can get a copy of the safeguards on request at datenschutz@ainulo.com. We pass data on beyond that only if a law requires it.

No automated decision-making, including profiling under Art. 22 GDPR, takes place.

10. Security

The connection between your browser and this website is encrypted with TLS. We limit access to enquiries and applications to the people who need to handle them.

11. Your rights

You have these rights towards us: access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw a consent at any time (Art. 7(3)). Processing until the withdrawal stays lawful.

Right to object: Where processing rests on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Write to datenschutz@ainulo.com for any of this. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.

12. Changes

If our processing or the law changes, we adapt this policy. The version published at the time of your visit applies. Status: 15 October 2026.