Privacy Policy

Version: October 4, 2026 · Published in English

1. Responsibility and scope

Invertix GmbH, Connollystraße 3, 80809 München, Germany (Amtsgericht München, HRB 311292), is responsible for personal data processed for operating this website and managing its own business relationships. Contact Simon Karan at simon.karan@invertix.ai for privacy questions and requests.

This notice covers visitors to invertix.ai, prospective customers, customer representatives and application users, support contacts and job applicants. Personal data means information relating to an identified or identifiable person. Equipment readings and operational records are personal data when they identify or can be linked to a person.

For customer services, the Invertix entity identified in your customer agreement is the service provider. Our affiliated Italian entity is Invertix S.r.l., Via Zara 54, 01100 Viterbo (VT), Italy, VAT 02491390569. Your agreement identifies the entity providing your deployment and its responsibilities. The same privacy contact can help identify the responsible entity for your request.

2. Customer-controlled information

When a customer determines why personal data in connected systems, documents, messages or workflows is processed, Invertix processes it on that customer's documented instructions as processor, or subprocessor if the customer itself is a processor. The customer provides the relevant privacy notice and establishes a lawful basis. The customer agreement and Data Processing Agreement (DPA) govern Invertix's processing on its behalf.

This differs from information we process for our own enquiries, business administration and security purposes as controller. Roles depend on the actual activity, not simply where information is stored. For requests concerning customer-controlled information, we coordinate with the responsible customer and assist under the DPA. A public request does not authorize erasure of an organization's entire account or unrelated records.

3. Information and its sources

We receive information directly through forms, emails, calls, account use, support and job applications. Customers may provide user details and information from systems they authorize us to connect. Technical records are generated when you access the website or application.

• Website enquiries: name, company, email, optional phone number, message and enquiry context. Privacy requests include your contact details, request scope and follow-up correspondence.
• Application accounts: identifiers, name, work email, authentication/session information, organization membership, roles, permissions and preferences, depending on the deployment.
• Customer workflows: asset records, uploaded files and metadata, reports, tasks, approvals, conversations, prompts and AI outputs. Enabled voice or desktop workflows can process audio, transcripts or screen content. These records may contain personal data supplied by the customer.
• Technical records: IP address, browser/device information, request times, errors, access and audit records, and performance information. Optional website analytics records page views and interactions after consent.
• Business and recruitment: customer contacts, agreements, billing and support correspondence, CVs, application details and interview correspondence. Do not submit passwords, identity documents or unrelated sensitive records through public forms.

4. Purposes and lawful bases

For our controller activities, the purposes and Article 6 GDPR bases are listed below. For processing on a customer's behalf, the customer determines the lawful basis and instructions.

• Enquiries, demonstrations and business relationships: legitimate interests in responding to business contacts and providing services (Article 6(1)(f)); necessary contractual or requested pre-contractual steps where the individual is a contracting party (Article 6(1)(b)).
• Account administration, support and service security: legitimate interests in reliable operations, access management, preventing misuse and resolving errors (Article 6(1)(f)); contractual necessity where the individual is a contracting party (Article 6(1)(b)).
• Optional website analytics and consent-based communications: consent (Article 6(1)(a)). You can decline or withdraw analytics consent and withdraw communication consent or object to direct marketing at any time.
• Recruitment: requested steps before a potential employment or collaboration contract (Article 6(1)(b)) and legitimate interests in managing recruitment (Article 6(1)(f)).
• Privacy requests and applicable legal, accounting or regulatory duties: legal obligation (Article 6(1)(c)). Establishing, exercising or defending legal claims: legitimate interests (Article 6(1)(f)).

5. Cookies, preferences and analytics

The website stores your analytics choice in local storage under cookie-consent. Browser preferences and application session storage may remember settings or maintain access. These functions are separate from optional analytics.

After analytics consent, the website loads Google Analytics, Vercel Web Analytics and Vercel Speed Insights. They process usage or performance information such as visited pages, browser/device information and interactions. Google Analytics may set _ga and _ga_* cookies. Website enquiry conversion events exclude names, email addresses and message contents. Vercel event URLs are stripped of query strings and fragments before collection.

Use the analytics-preferences control on this page to accept or decline optional analytics. Withdrawing an earlier acceptance reloads the page so optional telemetry is no longer loaded. Your choice remains until changed or browser storage is cleared. Your browser can also delete cookies or site storage.

Tally hosts job-application forms, which load when you open an application. External services and social networks have their own privacy notices. The hosted launch film is served as website media; following a YouTube link takes you to YouTube.

6. Recipients and AI services

Authorized Invertix staff and service providers receive information needed for their responsibilities. The website uses Vercel for hosting and optional analytics, Google for optional analytics, Resend for form delivery and Tally for job applications. The responsible team's email service also processes enquiries and privacy requests.

Application recipients depend on the deployment and enabled workflows: cloud hosting, authentication/database and storage services, error monitoring, authorized integrations and AI services for inference, extraction, embeddings or retrieval. The platform supports Google Cloud, Supabase, AWS, OpenAI, Anthropic, Mistral, Cohere, Sentry and Langfuse. This does not mean every provider is enabled or receives every customer's data. Authorized subprocessors, locations and model boundaries must be identified in customer deployment documentation.

Personal data in prompts, documents and workflow inputs may be processed by the configured AI service to perform the requested task. Tools and approval requirements depend on the deployment. Review AI outputs before decisions or actions affecting people. A controller using solely automated decisions with legal or similarly significant effects must provide the relevant information and safeguards.

Necessary information may also be disclosed to professional advisers or authorities where required by law or necessary for legal claims. Sharing of customer-controlled records follows customer instructions and the DPA.

7. International transfers

Providers or authorized personnel may process information outside the European Economic Area. Locations depend on the service and agreed deployment. Transfers requiring safeguards must use an applicable adequacy decision or another valid GDPR mechanism, such as the European Commission's Standard Contractual Clauses, with additional measures where required.

An EU hosting region does not itself establish that all access or processing stays in the EU. Contact simon.karan@invertix.ai for applicable recipients, locations and safeguards, and to request copies of safeguards subject to appropriate redactions.

8. Retention and deletion

Retention depends on the purpose and record. We use these criteria rather than one period for all information. Contact us for retention applicable to a particular record or deployment.

• Enquiries and business correspondence: while needed to answer and follow up or maintain the relationship; afterward only as necessary for applicable obligations or legal claims.
• Account, support and access records: while needed for access, support, security investigations or applicable obligations. Disabling an account does not automatically erase organization records or legally required information.
• Customer documents, conversations and operational records: documented customer instructions, agreed settings and the DPA, including return/deletion on termination and necessary legal retention.
• Technical logs and analytics: the operational, security or measurement purpose and the service's configured retention. Investigation records may be kept for the investigation.
• Recruitment: the selection process and applicable obligations or claims. Retention for future opportunities requires a separate appropriate basis.
• Privacy-request correspondence: the minimum needed to handle the request and demonstrate the response, restricted to responsible staff. Legally required business records follow applicable statutory periods.
• Backups: deletion may complete through the backup lifecycle. Retained backups remain protected; restoring them requires reapplying required deletions before active use.

9. Rights and requests

Depending on the circumstances, you may request access, correction, erasure, restriction or portability, or object to processing based on legitimate interests. Consent can be withdrawn without affecting earlier lawful processing. You can object to direct marketing at any time. GDPR also provides safeguards for solely automated decisions with legal or similarly significant effects.

Email simon.karan@invertix.ai to request deletion, access, correction or other privacy rights. No form or legal terminology is required.

We respond without undue delay and normally within one calendar month of receipt. An extension of up to two further months may be justified by complexity or number of requests; we will explain it within the first month. Where we have reasonable doubts about identity, we may request proportionate additional information. Requests are normally free, subject to GDPR exceptions for manifestly unfounded or excessive requests.

Erasure has applicable exceptions, including legal obligations and legal claims. If we cannot comply fully, we will explain the reasons and available complaint or judicial remedies. Requests about customer-controlled information are coordinated with the responsible customer.

You can complain to a supervisory authority, including where you habitually reside, work or where the alleged infringement occurred. The Bavarian State Office for Data Protection Supervision (BayLDA) is at https://www.lda.bayern.de. For Italian matters, the Garante is at https://www.garanteprivacy.it.

10. Required information, security and updates

Required fields are needed to handle that form or provide access; optional information is voluntary. Without a contact address we may be unable to respond. Customers determine information required for their workflows.

We use measures appropriate to the processing, including access restrictions, authentication, protected transport and operational monitoring. Deployment-specific security commitments are in customer agreements and the DPA. Use agreed secure channels for confidential records.

Services are intended for professional use and are not directed at children. Contact us if you believe a child has provided personal data. We update this notice when practices change and communicate material changes as appropriate. The version date appears above.

Contact and requests

Privacy contact: simon.karan@invertix.ai. For data deletion, use /data-deletion or email the privacy contact.