Privacy policy

Thank you for your interest in ElisaBit UG (haftungsbeschränkt) and our AI-powered SaaS platform agentbit. Data protection is our highest priority. Personal data is always processed in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Telecommunications and Telemedia Data Protection Act (TTDSG) and the EU AI Regulation (Regulation (EU) 2024/1689, "EU AI Act").

Jan Hansen, Gervinusstraße 46, 64287 Darmstadt
Email: datenschutz@elisabit.de (forwarded internally)

These web pages and the agentbit web app are hosted with a cloud infrastructure provider whose data centres are in Germany — no third-country transfer in the hosting stack. A data processing agreement under Art. 28 GDPR is in place with the hosting provider.

When you visit, we record technically necessary connection data: IP address (truncated after 7 days), browser type and version, operating system, referrer as well as date and time. Deleted after 14 days. Legal basis: Art. 6 (1) (f) GDPR.

We use cookies. Before your first visit a TTDSG-compliant consent banner appears with the default setting "all non-essential rejected". You can change or withdraw your choice at any time via the "Cookie settings" link in the footer. Legal basis: § 25 (1) TTDSG in conjunction with Art. 6 (1) (a) GDPR.

Submissions from the contact form reach our mailbox via an email delivery service. Where processing is carried out by a provider with a US connection, this is based on standard contractual clauses 2021/914 (SCC) and the EU-US Data Privacy Framework (DPF). Retention: 24 months after the last interaction.

For trial and contract accounts we process name, email, company as well as usage and configuration data. The data is stored exclusively in data centres in Germany.

For every request we detect personal data (PII detection via our "Data Guard" component) and route accordingly: where PII is detected, processing takes place locally on an open-source model on a server in Germany — no third-country transfer. Non-sensitive requests are processed via cloud LLMs in the EU with pseudonymisation (see section 10).

When you connect an external connector in the platform (e.g. Google Ads, ClickUp, Lexoffice), we show you a data protection notice under Art. 13 GDPR before the connection is established, stating the provider's registered office, the categories of data transferred, the legal basis for any third-country transfer (DPF/SCC), the retention period, a reference to its sub-processor list and a note about your right of withdrawal under Art. 7 (3) GDPR. The connection is only established after your active consent; the consent is logged with a timestamp and version ID. You can withdraw the connection at any time under Settings → Connections.

We use processors from the following categories:

Data processing agreements (DPAs) under Art. 28 GDPR are in place with all processors. We provide customers with the named list of processors on request or as part of the DPA.

For US providers we apply cumulatively: standard contractual clauses (EU) 2021/914, the US parent's EU-US Data Privacy Framework certification, EU region pinning, customer-managed keys for data at rest, PII pseudonymisation before every cloud LLM call, and encryption in transit (TLS 1.3) and at rest (AES-256-GCM).

Right to lodge a complaint (Art. 77 GDPR): Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Straße 22, 7th floor, 20459 Hamburg, https://datenschutz-hamburg.de

agentbit uses AI systems (large language models, memory layers, autonomous agents). AI output is labelled in the application. The AI systems make no autonomous decisions with legal effect on individuals (Art. 22 GDPR); critical decisions are subject to human review (human in the loop).

The current version is always available on this website. Existing customers are actively informed of material changes.