Skip to main contentSkip to navigation

Privacy policy

Scope: elisabit.de, agentbit.de and the agentbit web app
Last updated: 26 October 2026 · version v2.3-2026-10-26

1. Introduction

Thank you for your interest in ElisaBit UG (haftungsbeschränkt) and our AI-powered SaaS platform agentbit. Data protection is our highest priority. Personal data is always processed in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Telecommunications Digital Services Data Protection Act (TDDDG) and the EU AI Regulation (Regulation (EU) 2024/1689, "EU AI Act").

2. Controller

ElisaBit UG (haftungsbeschränkt)
Fuchsversteck 15
22457 Hamburg, Germany

Email: hey@elisabit.de
Data protection: datenschutz@elisabit.de
Managing director: Stefan Mahendiran
Commercial register: HRB 197025, Hamburg local court
VAT ID: DE460362093

3. External data protection officer

Jan Hansen, Gervinusstraße 46, 64287 Darmstadt
Email: datenschutz@elisabit.de (forwarded internally)

4. Hosting

These web pages and the agentbit web app are hosted with a cloud infrastructure provider whose data centres are in Germany — no third-country transfer in the hosting stack. A data processing agreement under Art. 28 GDPR is in place with the hosting provider.

5. Server log files

When you visit, we record technically necessary connection data: IP address (truncated after 7 days), browser type and version, operating system, referrer as well as date and time. Deleted after 14 days. Legal basis: Art. 6 (1) (f) GDPR.

6. Cookies and consent

We use cookies. Before your first visit a TDDDG-compliant consent banner appears with the default setting "all non-essential rejected". You can change or withdraw your choice at any time via the "Cookie settings" link in the footer. Legal basis: § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR.

7. Google Analytics 4

On this website we use Google Analytics 4 (provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) — only with your consent via the consent banner (“Analytics” category). Without consent no connection to Google servers is established and no analytics script is loaded. We use Google Consent Mode v2; Google Analytics 4 neither logs nor stores IP addresses. Standard contractual clauses (EU) 2021/914 and a certification under the EU-US Data Privacy Framework are in place for any transfers to the US parent Google LLC. Legal basis: Art. 6 (1) (a) GDPR; you can withdraw consent at any time via “Cookie settings” in the footer.

8. Contact form and email

If you contact us via the contact form or by email, we process your details (name, email address, company, message) to handle your enquiry (Art. 6(1)(b) or (f) GDPR). The enquiry is forwarded by email to our mailbox. For sending, we use the service Lettermint B.V., Willemsvaart 16 B, 8019 AB Zwolle, the Netherlands, as a processor (Art. 28 GDPR). Processing takes place in the European Union; no transfer to third countries takes place. More information: Lettermint privacy policy. Retention: 24 months after the last interaction, unless statutory retention obligations apply.

8.1 Spam protection with Cloudflare Turnstile

To protect our forms (contact, registration, appointment and order forms as well as the PHP check) against spam and automated access, we use Cloudflare Turnstile. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile is only loaded once you use a form, for example by clicking into an input field. If you only read our pages, no connection to Cloudflare is established. When it is used, technical data is transmitted to Cloudflare, in particular your IP address, browser and device information (e.g. user agent, language setting, screen properties) and signals about your interaction with the page. Cloudflare uses this to check whether the input comes from a human and only returns the result of this check to us. Turnstile does not set cookies for advertising or analytics purposes, and the data is not used for advertising or for building a cross-site usage profile. The legal basis is our legitimate interest in protecting our website and your enquiries against spam and abuse (Art. 6(1)(f) GDPR); the access to your device required for this is strictly necessary (Section 25(2) No. 2 TDDDG). A transfer to the USA is possible; Cloudflare is certified under the EU-US Data Privacy Framework, and standard contractual clauses (EU) 2021/914 apply in addition. More information: cloudflare.com/turnstile-privacy-policy

8.2 PHP check on /php-soforthilfe

On our page /php-soforthilfe you can check whether a website is affected by the PHP security vulnerability PHP2Shell. For this we process the domain you enter, your answers in the form (hosting provider, system, update status) and the result of the check. Our server retrieves the home page of the domain once, just like a browser. We do not store your IP address; to limit abuse we keep a non-reversible hash of the IP address for ten minutes. We store the domain, answers and result for a maximum of 90 days to evaluate and improve the service. We do not use them to approach you or the operators of the domain for advertising purposes. If you order the paid instant check, we additionally store your confirmations (role, backup, consent to retrieval, terms) with a timestamp as evidence for carrying out the order. The legal basis is our legitimate interest in providing and securing the check (Art. 6(1)(f) GDPR) and, for orders, the performance of the contract (Art. 6(1)(b) GDPR).

8.3 Payment processing via Stripe

For paid services such as the PHP2Shell instant check we process payments via Stripe. The provider for customers in the European Economic Area is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. During payment Stripe processes your payment data (e.g. card or PayPal details), name, email address, billing address, where applicable phone number and VAT ID, as well as the domain and role you entered. If you choose PayPal, the data required for this is also transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Stripe passes on to us the information we need for the order and the invoice; we do not receive full card details. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and compliance with statutory retention obligations (Art. 6(1)(c) GDPR). Stripe may also process data in the USA; Stripe is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition. More information: stripe.com/privacy

9. agentbit web app

For trial and contract accounts we process name, email, company as well as usage and configuration data. The data is stored exclusively in data centres in Germany.

9.1 AI processing

For every request we detect personal data (PII detection via our "Data Guard" component) and route accordingly: where PII is detected, processing takes place locally on an open-source model on a server in Germany — no third-country transfer. Non-sensitive requests are processed via cloud LLMs in the EU with pseudonymisation (see section 10).

9.2 Connector links (third-party integrations)

When you connect an external connector in the platform (e.g. Google Ads, ClickUp, Lexoffice), we show you a data protection notice under Art. 13 GDPR before the connection is established, stating the provider's registered office, the categories of data transferred, the legal basis for any third-country transfer (DPF/SCC), the retention period, a reference to its sub-processor list and a note about your right of withdrawal under Art. 7 (3) GDPR. The connection is only established after your active consent; the consent is logged with a timestamp and version ID. You can withdraw the connection at any time under Settings → Connections.

10. Processors / sub-processors

We use processors from the following categories:

  • Cloud infrastructure & hosting (data centres in Germany)
  • AI / language model providers (EU data residency)
  • Email delivery & technical support services (EU; US providers with SCC + DPF)
  • Payment provider (EU)
  • Accounting software (EU)
  • Third-party services connected by the customer (only while connected)

Data processing agreements (DPAs) under Art. 28 GDPR are in place with all processors. We provide customers with the named list of processors on request or as part of the DPA.

For US providers we apply cumulatively: standard contractual clauses (EU) 2021/914, the US parent's EU-US Data Privacy Framework certification, EU region pinning, customer-managed keys for data at rest, PII pseudonymisation before every cloud LLM call, and encryption in transit (TLS 1.3) and at rest (AES-256-GCM).

11. Retention period

  • Server log files: 14 days
  • Contact form: 24 months
  • Trial account: 90 days after the trial ends
  • Customer data in the platform: as per the DPA (usually contract term + 30 days)
  • Accounting: 10 years (§ 147 AO)
  • Audit logs: 90 days live, 7 years archived
  • Consent logs (connector links): contract term + 3 years (proof obligation, Art. 7 GDPR)

12. Your rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7 (3) GDPR). Please send requests to: datenschutz@elisabit.de

Right to lodge a complaint (Art. 77 GDPR): Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Straße 22, 7th floor, 20459 Hamburg, https://datenschutz-hamburg.de

13. AI notice (Art. 50 EU AI Act)

agentbit uses AI systems (large language models, memory layers, autonomous agents). AI output is labelled in the application. The AI systems make no autonomous decisions with legal effect on individuals (Art. 22 GDPR); critical decisions are subject to human review (human in the loop).

14. Changes to this privacy policy

The current version is always available on this website. Existing customers are actively informed of material changes.