Privacy Policy
This is a translation for your convenience. The German version is the legally binding one.
1. Controller
NewEase AG
Bahnhofstrasse 1, 47574 Goch, Germany
info@newease.ag
2. Data Protection Officer
Freyberg Consulting
Felix Freyberg
Mandrellaplatz 3
12555 Berlin, Germany
Email: kontakt@felix-freyberg.de
3. Two roles — and why that matters to you
This policy covers two different things, and our position differs between them:
Our own pages and our contract with you. When you visit claritos.io, fill in a form, place an order or create a user account, we decide what happens to your data. We are the controller within the meaning of the GDPR. Sections 4 to 13 and 17 to 25 cover this.
Our customers' content inside the application. When a business uses claritos for its tasks, documents, bookkeeping, contacts or records, that business decides which data it processes there and why. We merely carry it out on their instructions (Art. 28 GDPR). If you are a customer, patient or business partner of such a business and want to know what happens to your data, that business is your point of contact, not us. Section 14 covers this.
4. Principles
We process personal data only to the extent necessary for the respective purpose. The legal bases are Art. 6(1)(b) GDPR (initiation and performance of a contract), Art. 6(1)(c) GDPR (legal obligations, such as retention for tax purposes), Art. 6(1)(f) GDPR (legitimate interest in secure operation) and, where we ask you expressly, Art. 6(1)(a) GDPR (consent).
5. Visiting our pages
When you visit our pages, we process the data your browser transmits and that is technically necessary for delivery: IP address, date and time, the address requested, the volume of data transferred, the status message, browser type and version, operating system and the referring page, if your browser sends it. This data is recorded in the logs of our hosting provider, serves secure operation (Art. 6(1)(f) GDPR), is not merged with other records and is deleted after a short period.
6. Audience measurement on our pages
We measure the use of our pages with our own count, operated on our own servers. We record page views, clicks, scroll depth and time spent. This data does not leave our infrastructure; we pass it to no one and do not combine it with data from other providers.
So that we do not count returning visits twice and can show you the same page variant, we store a random identifier in your browser. This only happens if you have consented. The identifier is then kept until one year after your last visit. Without your consent we count only the current visit: the identifier for this exists only while the page is open; nothing is stored in your browser for it, and we do not recognise you on a later visit. The legal basis for this count is our legitimate interest in comprehensible usage statistics (Art. 6(1)(f) GDPR).
The legal basis for the stored identifier is your consent (Art. 6(1)(a) GDPR together with § 25(1) TDDDG). You may withdraw it at any time — via the round symbol at the bottom left of every page. Withdrawal takes effect immediately and deletes the stored identifier; the lawfulness of processing up to that point is unaffected.
We record your decision itself because we must be able to prove it (Art. 7(1) GDPR). Stored are: the time, the purposes you chose, the wording shown to you, the page you were on, the language, and a shortened note of browser and operating system. We do not store your IP address. Instead we keep an irreversible check value with which, in a dispute, it can only be verified whether a particular address consented on that day. We delete these records after three years.
7. Cookies and browser storage
Necessary, without consent: cookies for signing in, protected by the server (httpOnly). Sign-in to the application lasts until seven days after you last used it; in the customer portal it ends after 30 minutes without activity, in the partner portal and the other portals after four hours without activity. If someone chooses "Stay signed in on this device" when signing in to the customer portal, the sign-in cookie is kept for 30 days, but only for the learning areas ("My learning", the courses and the library); for all other areas of the portal, such as the record and finances, the portal asks for a new code again after 30 minutes without activity. Without this choice, sign-in ends as usual. At your request, the customer portal remembers the email address you signed in with in your browser's storage, so you do not have to type it in every time: always if you choose "Stay signed in on this device", otherwise only if you tick the box for it. The address applies only to that business's portal, reaches us only when you sign in with it, and stays on the device until you sign in with a code without having it remembered, choose a different email address when signing in, or clear your browser's storage; signing out alone does not remove it. Instead of a code, you can sign in to the customer portal with a passkey if you set one up there. For this we store the public key, an identifier of the passkey, the provider (for example iCloud Keychain or Google Password Manager), a short name of the browser and device, whether it is synced across devices, and when it was created and last used. We receive no biometric data: your face or fingerprint is checked only by the device, and only a signature reaches us. A passkey can be removed in the portal profile; the business can remove all passkeys of a contact. In addition, we remember settings you choose or that the display needs, such as language, form of address, time zone or a collapsed sidebar, as a cookie for up to one year or in your browser's storage until you clear it, and your privacy decision until you change it or clear your browser's storage; without it we would have to ask you again on every visit. The legal basis is § 25(2) no. 2 TDDDG: without this storage the service you requested could not be provided.
Only with your consent: the audience-measurement identifier from section 6; the partner attribution from section 11, where a page offers it; remembering your device if you choose "Stay signed in on this device" in a form, for 90 days; and notices you have closed, so that they do not appear again, for up to one year. Without consent we store nothing for these purposes that goes beyond the current visit.
Apart from the partner attribution, we set no advertising cookies on these pages, and no third-party services are embedded that report your behaviour to themselves. Customers may embed an advertising measurement tool in pages built with claritos; where that happens, it is named explicitly in that page's consent dialog — together with the recipient of the data — and likewise runs only after consent.
8. Forms
When you fill in a form, we process the data you provide in order to handle your enquiry and to contact you (Art. 6(1)(b) GDPR). Mandatory fields are marked as such; everything else is voluntary. A one-time code may be sent to confirm your email address.
9. Ordering and payment
For orders we process your order and invoicing data to perform the contract (Art. 6(1)(b) GDPR) and retain the records to the extent required by law (Art. 6(1)(c) GDPR, sections 147 AO and 257 HGB — as a rule ten years).
Payments are handled by Stripe Payments Europe, Ltd. (Ireland). You enter your payment details — card or account data — directly there; they do not reach our servers. From Stripe we receive only the information whether and how payment was made.
10. Electronic signature
We use an electronic signature for contracts and agreements. For evidentiary purposes we record who signed when and from which IP address, and we send a confirmation code to your email address — at a higher level of assurance additionally by SMS to your mobile number. These details become part of the audit trail of the signed document (Art. 6(1)(b) and (f) GDPR).
The SMS code is generated and sent by Twilio Inc. on our behalf. For signatures with a seal, a certification authority (SSL.com) is additionally involved, which issues the seal; it acts as an independent controller for that purpose.
11. Partner programme
If you apply as a sales partner, we process your application and contract data in order to review and carry out the cooperation (Art. 6(1)(b) GDPR). In the partner area you sign in with a code that we send to your email address. Commission statements are subject to statutory retention periods.
For payouts we transmit the details required — name, address, bank details and the amount — to our payment service providers Qonto (Olinda SAS, France) and Wise Europe SA (Belgium). Which route is used depends on the destination country and the currency.
Purchases via a sales partner: If you come to us via a sales partner's link, the partner's code is in the page address. If you buy during the same visit, we assign the purchase to this partner so that they receive their commission. Something is stored in your browser for this only if you have agreed to "Partner attribution" in the privacy settings: then the partner's code for the duration of the partner campaign (90 to 360 days) and a random identifier for up to 400 days, so that a purchase on a later visit can also be assigned (Art. 6(1)(a) GDPR together with § 25(1) TDDDG). If you have already bought, enquired or registered via the partner, or are assigned to them as a prospect, we assign further purchases with the same email address or the same customer account at the payment provider to this partner for the duration of the campaign; nothing is stored in your browser for this. The partner sees the purchase with your name, your email address, the amount and the payment status; credit notes to other partners sharing in the commission no longer name you; older credit notes remain as they were issued. Clicks and assignments without a purchase are deleted once the campaign's period has expired; with a purchase they remain as proof of the commission. The legal basis for the assignment is our legitimate interest in paying our partners correctly (Art. 6(1)(f) GDPR); you may object at any time.
12. User account and sign-in
To use claritos we create an account. We process your name, email address, a password hash (we do not know the password itself), a second, personal email address to which, once it is confirmed, we additionally send invitations and links to reset the password (entered on request or taken over by us: the address to which an accepted invitation was sent and, when the login address is changed to a mailbox in claritos, the previous address; it can be changed or removed in the profile), optionally a profile picture, your language preference and your membership of one or more organisations including your role there (Art. 6(1)(b) GDPR).
We set a cookie for signing in; Section 7 explains how long it lasts. To protect access, we store when you signed in.
You can delete your account yourself in your profile settings. Section 21 explains what is deleted and what has to remain for legal reasons.
13. Google: sign-in, Gmail mailbox, Calendar and Meet
You can sign in to claritos with your Google account and connect your Gmail mailbox, your Google Calendar and Google Meet to claritos. All of this is voluntary; claritos can be used in full without a Google account.
Signing in with Google. If you sign in with Google, we receive your identifier, your email address, your name and, if stored, your profile picture from Google. We use this information solely to create your user account and to recognise you (Art. 6(1)(b) GDPR).
Sending from your mailbox. If you connect your Gmail mailbox, you can send emails — invoices, quotes or letters, for instance — directly from your own mailbox instead of through a third-party sender address. For this we request the permission to send only. We have no read access to your mailbox: we do not retrieve your messages, do not search them and do not analyse them. The only thing transmitted to Google is the message whose sending you initiate in claritos, together with its attachments.
Google Calendar. If you connect a Google Calendar, we enter the appointments booked in claritos there, change and delete them, with a Google Meet link if you wish. In calendars you choose as blockers we set a busy entry with a short label. From the calendars you select we read the busy times so that we do not offer free slots there; of these we store only start and end, no titles, descriptions, attendees or locations. We show your own entries only to you in the claritos calendar and do not store them. We change or delete only entries we created ourselves. From the list of your calendars we store the identifier, title, time zone and whether Google Meet is allowed there.
Google Meet. If you expressly allow it for a Google account, after every finished meeting with Google Meet that was scheduled through claritos we create a document of the meeting: with start and end, the names of the participants, including external guests (for dial-in by phone, a phone number partially masked by Google), and the times at which each person joined and left. If Google created a transcript for the meeting, we add it with speaker names and times. We retrieve a recording only if you select it yourself in Google's file picker; we then receive access to that file alone, not to the rest of your Google Drive. The document and any retrieved recording are kept with the business in our storage in the EU; they may be viewed by the business's administrators and the host. We use this information to document the meeting, not to evaluate staff. Transcription and summary are produced by machine (section 15).
What we store. For each connection we store the access credentials issued by Google in encrypted form, along with the address of the connected account. If you disconnect, we delete these credentials.
How to end the connection. You can disconnect at any time in the claritos settings. Independently of that, you can withdraw access at any time in the security settings of your Google account (google.com/account → Security → Third-party apps with account access).
Limited use of Google user data. claritos' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In detail: we use this information solely for the features you visibly use in claritos. We do not pass it on to third parties, except where necessary for the feature you requested, for security reasons — such as investigating abuse — or to comply with a legal obligation. We do not use it for advertising and we do not sell it. We do not allow humans to read it, unless you have expressly consented, it is necessary for security or to comply with a legal obligation, or the data is aggregated and anonymised.
14. Our customers' content — processing on their behalf
Inside claritos, our customers process their own data: tasks, projects, times, contacts, documents, bookkeeping entries, invoices, reminders, correspondence, forms, contracts and — depending on the business — client or patient records containing health data.
Video rooms: For meetings and lessons, claritos provides its own video rooms. Participants' video, audio and shared screens, their name in the room, chat messages, raised hands and reactions are transmitted via LiveKit for this. LiveKit does not store video and audio. For every session we create a document for the business containing the chat history and, unless the business has switched this off, a full transcript and a summary. The document also states who took part from when to when, with the name in the room, the role and, for an invitation via a personal link, linked to the contact, as well as measurements of the quality of audio, video and connection for each participation, such as packet loss, delay, resolution and frame rate, and how often the microphone or sound did not work, for example because access to the microphone was not granted, and whether the noise filter or voice isolation was switched on; these measurements are taken in the browser and go directly to claritos. We do not record an IP address or a location in doing so. If someone in the room switches on the noise filter or voice isolation for their microphone, their own browser cleans up the audio before it is sent. For voice isolation, the browser computes a voice print from the person's own voice and turns other voices at the microphone down; the voice print stays in the device's memory, is neither transmitted nor stored, and is gone once the person leaves the room. The business can use this, for example, to document attendance in a lesson. For this, the audio is recorded from the moment the host arrives until the session ends, transcribed and summarised by machine (section 15); we then delete the audio file. If participants are split into breakout rooms and the summary is selected for them, the audio in each breakout room is recorded from opening to closing, even if the host is not in it at the time; each breakout room gets its own document. If the business records a session, the recording is also kept as a document. Files that participants share in the chat are stored with the document of the session; everyone in the room can download them, and whoever shared a file can remove it again, as can the host. Only a notice without the file and without its name goes via LiveKit. Before entering and before any recording, we ask every participant and keep a record of their consent with time and name; anyone who does not agree does not enter or leaves the room. The documents are kept with the business in our storage in the EU; they may be viewed by the business's administrators and the host.
Calendar access: The business can retrieve and edit the appointments of its staff, rooms and equipment in its own calendar programs, for example on iPhone, Mac or in Thunderbird (CalDAV), signed in with a password per device. Our service at Railway answers the requests of these devices directly (section 19); in doing so we process the device's IP address. The appointments themselves continue to be stored only in our database in the EU.
Mailbox in your mail app: Anyone at the business who has a name on its own sender domain can also read the mail to that address in their own mail programs and send from there, for example on iPhone, Mac or in Thunderbird (IMAP and SMTP), signed in with a password per device. Our service at Railway accepts the connections of these devices directly (section 19); in doing so Railway processes the device's IP address, which we do not store. The emails remain in our database and our file storage in the EU; whatever is deleted in the mail program only disappears there. Emails sent from the mail program are sent like any other personal email via SendGrid (section 19) and recorded in the outbox.
Bank connection: The business can connect its bank accounts through finAPI GmbH in Munich, an account information and payment initiation service licensed by BaFin. Signing in to the bank takes place in finAPI's form; we do not see the bank access data. When connected via FinTS, finAPI keeps them for this purpose. finAPI retrieves balances and transactions, including name, IBAN and payment reference of the counterparty, and transmits them to claritos. At the business's request, finAPI also checks whether a name matches the holder of an IBAN (name, IBAN and, where applicable, BIC of a payer are transmitted) and submits direct debits to the business's bank (name, IBAN, where applicable BIC, amount, payment reference and mandate of the payers and the business's creditor identifier are transmitted). finAPI processes this data in Germany.
Certificates and attestations: If a business issues a person a document from one of its templates, such as a certificate of attendance, we insert the details from the contact that the template provides for, plus, depending on the template, a running number, the date of issue, the end of validity and a verification code, and store the document with the contact. In the customer portal the person sees their valid and cancelled documents. With the verification code, anyone can check on a public page whether a document is genuine and still valid; the page shows the name of the template, the number, the date of issue, the name of the person and the business, but not the reason for a cancellation. A file someone selects there for comparison is checked by their own browser; it does not reach us. If the business offers courses, it can have such a certificate issued automatically when a course is completed, with the title of the course.
Learning platform: If the business offers training or courses, claritos provides its participants with a library of videos, audio, PDF files and recordings of lessons in the portal. For this we process which access a person has and where it comes from (purchase, class or assignment by the business), what was released to them and when, changes to their personal schedule (such as a pause) with the reason the business gives for them, how far they have watched a content item, what they have saved and what they search for in the library. In courses we also record when the person first opened a course and, for each lesson, when they last opened it, how far they got and when it was completed, and for a quiz every attempt with the questions asked, the answers, including typed ones, and the result. A lesson that is an appointment in a video room counts as attended if the person's participation is recorded there (see "Video rooms"); otherwise it stays open. For courses with such appointments the business keeps an attendance list: for each person and appointment, how many minutes they were in the video room and what share of the appointment's duration that is, and from this their attendance rate over past appointments. It can add for each person and appointment that they were present on site or excused, with a reason; we record who did so and when, and the measurement remains visible alongside. If the course has a minimum attendance, we notify the teacher, or the business's administration if there is no teacher, as soon as a person can reach it only by attending all remaining appointments or can no longer reach it at all. If the business finalises the list for a period, for the whole course, a class or individual persons, it can no longer be changed for these persons and this period; the business receives it as a PDF file with a verification code and as a CSV file, including the additions and the reason for an excused absence, for example to present it to a body that pays for or funds the participation. Whether and to whom it passes the list on is up to the business. With the verification code anyone can check on the public page (see "Certificates and attestations") whether the list is genuine; the page shows the course, the period, the class or the number of persons, the date of finalisation and the business, but no names. In the portal, the person sees for such a course how many appointments they have attended and, if there is a minimum attendance, how many are required. For a lesson, participants can hand in a submission in the portal, as text or as files, including video. We store the files as documents with the contact in protected storage without a public address; the members of the business see them like other documents with the contact, and we evaluate them by machine like any uploaded document, with a summary and, for audio and video, a transcript (section 15). The business replies with feedback, optionally with a grade, also over several rounds; if it accepts the submission, the lesson is completed. We notify the person of feedback in the bell in the portal and on their device, otherwise by email; the text of the feedback is only in the portal. The business sees who has which access, what was released to whom and whether and when the person opened it. In courses it also sees, for each person, how many lessons they have completed, when they were last active and whether they have completed the course, and for each lesson the status as the person sees it, with date and reason if it is still locked. It can mark a lesson as completed by hand, giving a reason; we record this and every change to the personal schedule with the reason, who made it and when. The evaluation per lesson shows only numbers, not persons. For each quiz it sees how many attempts the person needed and their latest result; it can reset their attempts, which then remain stored but no longer count. If a quiz has a time limit, we record when an attempt began until it is submitted, and note whether it was submitted late. Participants can ask the teacher a question about a lesson in the portal. We store the question and the answers as messages in the business's portal, together with the course and the lesson it was asked about; it goes to the person at the business whom it has chosen as the teacher of the course, without that choice to its administrators, and appears among its conversations. If the lesson is deleted, the question remains stored without this reference. If someone opens or downloads a PDF file for which the business provides this, that person's name and email address and the date appear at the bottom of every page. If the business releases the recording of a lesson, the participants it is released to see it, with the machine transcript (section 15); anyone who could be seen or heard in the lesson can be seen or heard in it. If a lesson is intended for this, the question before the recording says so, and we record the consent to it with time and name. If the business adds such a recording as content itself although not all participants of the lesson consented to its release, it must confirm this expressly; we record when and by whom, and how many of how many had consented. So that the search also finds spoken words and the text of PDF files, we build a search index from transcripts and PDF files. When an access takes effect, we send the person an email with the name of the access, its collections, the end date if there is one and the link to the portal; this does not happen if they already had the access, cannot sign in to the portal themselves or the business has switched this email off for the access. On the assignment we record when the email was sent or why not. We notify participants of new items as they choose in their settings: in the bell in the portal, by email, by SMS or as a notification on their device (section 19); if no device can be reached for this, by email. Anyone who makes no choice receives what the business has preset, otherwise a weekly overview by email of new items in the library. Every such email contains a link to unsubscribe from this kind of message. All content and data remain with the business in our storage in the EU.
For this content the respective customer is the controller. We process it solely on their behalf and on their instructions (Art. 28 GDPR), on the basis of a separate data processing agreement that we conclude individually with every customer.
We do not analyse this content for our own purposes, in particular not for advertising, and we do not pass it on to third parties unless a legal obligation applies or the customer requests it.
If you are a customer, patient or business partner of a business that uses claritos, please address requests for access, rectification or erasure to that business. If your request reaches us directly, we forward it to them and inform you accordingly; we are not permitted to decide on it.
15. Machine processing
Some features work by machine: text and document recognition, the summary of uploaded documents, suggestions for assigning bookkeeping entries, translations, drafting assistance, the reading of laboratory reports, the completion of contact details from public sources, the analysis of a contact's website for conversation starters, the transcription of audio and video recordings, the summary of meetings (in video rooms, from Zoom or Google Meet), the rating of incoming emails as positive, neutral or negative (except spam and bulk mail), the analysis of form responses where the business switches it on for a form (the questions, the counted results and the free-text answers verbatim; we leave out the fields for name, postal address, date of birth, email address and telephone number insofar as we recognise them as such), and the review of email campaigns before sending for sensational or misleading statements (only the subject and text of the campaign, without any details about the recipients). For this, the content concerned is transmitted to a language-model service and processed there.
We use the Vercel AI Gateway for this, through which requests go to Anthropic PBC (USA) and Google. The transmitted content is not used there to train models.
Web search: When a business completes contact details from public sources, we search the internet via Staan, a European search index with data kept in the EU, for the contacts it selects for this. The search queries contain the name of the company or person and details such as the location. The public pages found are evaluated by the language-model service; the VAT identification number is checked with the EU VAT Information Exchange System (VIES). Official details from VIES are entered into empty fields; everything else only once the business confirms it. When the writing assistance for letters researches on the internet, this also goes through Staan. These search queries contain only factual questions, no names of private individuals and no health information.
Website analysis: When a business triggers it for a contact, we read up to 30 public pages of the website stored for that contact, only that website and only as far as its robots.txt allows; we do not search the internet for this. The text of these pages is analysed by the language-model service on a topic set by the business. The result is kept on the contact and can be edited there; we do not store the texts of the pages.
What is generated by machine are suggestions. They are reviewed by a human before being adopted; no automated decision within the meaning of Art. 22 GDPR takes place.
For converting Office files to PDF we use CloudConvert (EU region).
16. Services you connect yourself
claritos can be connected to further services. The customer establishes these connections themselves by granting the respective access — usually under their own contract with the provider. Only then is data transmitted there, and only the data the respective feature requires:
Google — sign-in, sending from your own mailbox, Google Calendar and Google Meet (section 13).
Zoom Video Communications — If a business connects its Zoom account, after the end of every Zoom meeting scheduled through claritos as an appointment or instant meeting we create a document of the meeting: with title, start and end, the names of the participants from Zoom's participant report and the times at which each person joined and left. We use the email addresses from the report only to match participants to a contact of the appointment; they are not stored, nor are Zoom's participant identifiers, IP addresses or locations. If the business has switched it on for an appointment type, we also retrieve the recording from Zoom's cloud; it is transcribed and summarised by machine (section 15). The document and the recording are kept with the business in our storage in the EU; they may be viewed by the business's administrators and the host. For manual import we also show the host the finished meetings of their Zoom account with topic, time, duration, number of participants and up to 50 participant names; an imported meeting becomes a task with the list of participants and, where Zoom created one, Zoom's summary.
Pingen AG (Switzerland) and LetterXpress (Germany) — sending physical letters and registered mail. The recipient's address and the content of the letter are transmitted, because that is precisely what is printed and delivered.
MailCheap (Cyberlabs, Inc., Delaware, USA — data held in Germany) — mailboxes in the partner area. The emails are transmitted together with sender, recipient and content, because the service delivers and stores them.
Twilio SendGrid (Twilio Inc., USA) — sending campaign emails from the customer's own SendGrid account and from the customer's own sender domain. The recipient's address, name and the content of the email are transmitted; delivery, bounces, complaints and unsubscribes come back, so that no one keeps receiving mail who no longer wants it. We keep these reports for each email for twelve months so that the customer can see in the campaign report whether and why an email did not arrive: for bounces with the error code, category and the response of the receiving server, in which we make every email address unrecognisable; after that only the last status remains. If the reason is missing for older campaigns, the customer can have it retrieved from the suppression lists of their SendGrid account; only what belongs to an email of the campaign is taken over. We count clicks on links in campaign emails via claritos' own redirect, without SendGrid: per link, and per recipient only if the customer switches this on for their organization. We measure opens only if the customer switches this on for a campaign, via our own invisible image in the email. To recognise security filters and prefetches, we check the time, IP address and browser identifier of the request; we store only the time and whether it was probably such a request, never the IP address or browser identifier. We keep clicks and opens for twelve months. Whether the data is processed there in the USA or in the EU is determined by the customer through their account; according to SendGrid, the delivery feedback passes through the USA in any case. If the customer has also set up their SendGrid account for personal emails, their staff write from the CRM through it under their own name; these emails then also pass through their account with the recipient's address and content. SendGrid receives replies to them for the customer, on the domain itself or on a separate address below it, and forwards them with sender, recipient, content and attachments to claritos, where they arrive in the customer's inbox; if the customer receives on the domain itself, this applies to all emails to addresses there, for example to their staff or to shared mailboxes such as info@. SendGrid does not state where it processes these replies; they may also pass through the USA. If the customer sets up a domain for appointment accounts in their SendGrid account (it may also be the one for personal emails), their staff, rooms and equipment get their own addresses there. SendGrid receives emails to these addresses for the customer and forwards them with sender, recipient, content and attachments to claritos. claritos itself answers invitations to a room or a piece of equipment with an acceptance or a refusal, depending on whether it is free at that time; the answer goes with the title and time of the appointment through the customer's SendGrid account to the person who sent the invitation. All other emails to these addresses arrive in the customer's inbox and are rated there like replies (section 15). For these emails, too, SendGrid does not state where it processes them; they may also pass through the USA. claritos also sends the appointment mail of the resources through these addresses, for example confirmations, reminders, changes and cancellations of appointments including the calendar file; the recipient's address, name and the details of the appointment (type, time, place, link to manage it or to the video room) then pass through the customer's SendGrid account. Staff who have connected their own Gmail continue to write from there. The customer can also receive replies to emails from their other sender domains, for example to campaigns, through SendGrid in this way, and, if they choose such a domain as their reply address, also replies to their other emails from the contact, whichever route they were sent by; they go with sender, recipient, content and attachments to claritos, arrive in the customer's inbox and are rated there (section 15). Here, too, SendGrid does not state where it processes these emails; they may pass through the USA.
GoHighLevel — handover of contacts and triggers to an account held there.
Meta Platforms — measurement of advertising performance, if the customer provides an advertising account.
The respective provider's own privacy policy applies to processing on their side. We store the access credentials in encrypted form and delete them when the connection is ended.
17. Backups by the customer
An organisation can download its data as an archive — tables as CSV, documents in their original form, plus a part that can be evaluated for tax purposes. This serves the fulfilment of its own retention obligations and a change of provider (Art. 6(1)(b) and (c) GDPR).
What you should know about this:
Such an archive contains personal data of the organisation's contacts, clients and business partners — depending on the business, health data as well.
Only whoever administers the organisation may start it. Every run and every later download is logged.
Access credentials are not included. Passwords, keys and tokens for connected services are expressly left out.
The download link is sent by email to the addresses the organisation enters for this purpose — which may include people outside it, such as their tax advisers. Whoever holds the link can reach the archive; the organisation decides who receives it.
The archive can be encrypted with a password. The organisation sets the password itself; it never appears in the delivery email.
After 30 days the link expires, and we delete the archive from our storage.
This is to be distinguished from our own operational backup: we back up the entire platform in encrypted form with a provider-independent storage service (Backblaze) so that we can restore it after an outage. This backup is not accessible to anyone and serves solely secure operation (Art. 6(1)(f) GDPR).
18. Logs inside the application
In addition to the logs of our hosting provider (section 5), claritos keeps its own event log: errors and security-relevant events — incoming interface calls, triggered backups or failed background processing, for instance. It contains as little personal information as possible, as a rule only internal identifiers. These entries are deleted after 90 days. The legal basis is our legitimate interest in secure and traceable operation (Art. 6(1)(f) GDPR).
19. Service providers used
We use service providers who process data solely on our behalf and on our instructions (processing on behalf of a controller pursuant to Art. 28 GDPR):
Vercel Inc. (USA), execution in the EU — operation and delivery of the pages. The server functions run exclusively in European data centres (Frankfurt, Paris, Dublin). Delivery of the pages themselves runs over a worldwide network; the log data named in section 5 arises in the process, depending on your location also outside the EU.
Supabase Inc. (USA), data held in Frankfurt am Main — database.
Cloudflare, Inc. (USA), storage jurisdiction European Union — storage and delivery of images, videos and documents. When a file is retrieved, your IP address is transmitted to this service for technical reasons.
Railway Corp. (USA), execution in Amsterdam — background processing, such as generating PDF documents, text recognition and backups, as well as calendar access and the mailbox in your mail app (section 14), where Railway accepts the requests of calendar devices and the connections of mail programs directly and processes their IP addresses in doing so.
finAPI GmbH (Germany), processing in Germany — bank connection (section 14): retrieving balances and transactions, checking the account holder of an IBAN and submitting direct debits.
Inngest, Inc. (USA) — orchestration of recurring jobs. Only internal identifiers are transmitted.
Plus Five Five, Inc. ("Resend", USA), sending from Ireland — sending our emails.
Backblaze, Inc. (USA), storage in the EU region (EU Central) — encrypted backups.
CloudConvert (EU region) — conversion of Office files to PDF.
Anthropic PBC (USA) and Google, via the Vercel AI Gateway — machine processing pursuant to section 15.
European Perspective SAS (France), operator of Staan — web search for completing contact details from public sources and for research by the writing assistance for letters.
LiveKit Incorporated (USA), project data in the EU (Frankfurt) — transmitting video, audio, chat, raised hands and reactions in video rooms and recording the audio for the summary (section 14). Video and audio are not stored there; LiveKit places recordings in our storage in the EU. What LiveKit records about how a session ran, such as who joined when, is kept in the EU (Frankfurt).
Twilio Inc. (USA) — sending the SMS code at a higher level of assurance for the electronic signature.
Google Ireland Limited (Ireland) — signing in with Google, sending emails from the user's mailbox, matching with their Google Calendar and participants and attendance times, transcripts and selected recordings from Google Meet, where the user has established the connection. See section 13.
Acting as independent controllers, that is, not on our behalf:
Stripe Payments Europe, Ltd. (Ireland) — payment processing.
SSL.com — issuing the seal for the electronic signature.
Qonto (Olinda SAS, France) and Wise Europe SA (Belgium) — payouts in the partner programme (section 11).
Only if a customer connects them themselves do the following come into play (section 16): Zoom Video Communications, Pingen AG (Switzerland), LetterXpress (Germany), MailCheap (Cyberlabs, Inc.), Twilio SendGrid, GoHighLevel and Meta Platforms. Without such a connection, no data flows to them.
Corresponding agreements are in place with all processors.
Push services of browser makers (for example Google, Apple, Mozilla, Microsoft) — notifications on the device. If someone allows notifications in their browser or in the installed app, we deliver them through the push service of the maker of their browser. That service receives a device address assigned by the browser for this purpose, the time and the message in encrypted form; it cannot read it. Notifications to participants of a learning platform only say who wrote where or what is new, never the text. Anyone who withdraws the permission or switches notifications off receives no more; we delete a device address that is no longer valid. The push services may operate outside the EU.
20. Transfers to third countries
Where service providers process data outside the European Union, this takes place on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) with supplementary safeguards, or on the basis of an adequacy decision.
Every provider that stores your data processes it in the EU — including those whose company is based in the USA:
Vercel — server functions in Frankfurt, Paris and Dublin.
Supabase — database in Frankfurt am Main.
Cloudflare R2 — file storage with the jurisdiction "European Union".
Railway — background processing, calendar access and the mailbox in your mail app in Amsterdam.
finAPI — bank connection in Germany.
MailCheap/Cyberlabs — mailboxes in Germany.
Resend — email sending from Ireland.
Backblaze — encrypted operational backups in the EU region.
Your content — documents, bookkeeping entries, contacts, records, files — is therefore stored exclusively in the EU, backup copies included. For the event of access under US law, the standard contractual clauses apply in addition.
Five routes do leave the EU, and we name them expressly:
Delivery of the pages runs over a worldwide network so that pages appear quickly everywhere. The log data from section 5 arises in the process — essentially your IP address and the address requested — at a node outside the EU depending on your location. No content is involved.
Machine processing (section 15) transmits the content concerned to Anthropic PBC and Google in the USA. This concerns actual content — the text of a document to be read, for instance. It happens only for the features named there and only with what the respective feature requires.
Video, audio and chat in video rooms (section 14) are transmitted by LiveKit along the shortest path between participants, depending on their location also via data centres outside the EU. Video, audio, chat messages, raised hands and reactions, the name in the room and the IP address are transmitted in the process. Video and audio are not stored in the process.
Requests from calendar devices and connections of mail programs (section 14) are received by Railway at nodes of its worldwide network, depending on the device's location also outside the EU, and forwarded to Amsterdam. The device's IP address, the requested address and the appointments in request and response pass through this node; the connections of mail programs pass through it encrypted and are only decrypted on our server in Amsterdam.
The SMS code at a higher level of assurance for the electronic signature (section 10) goes via Twilio in the USA; your mobile number is transmitted in the process.
For Switzerland, where the letter-sending provider Pingen is based, an adequacy decision of the European Commission exists; a transfer there therefore requires no additional safeguards.
21. Retention periods
We store personal data only for as long as is necessary for the respective purpose. It is then deleted, unless a statutory retention obligation applies. In detail:
Event log of the application: 90 days (section 18).
Backup archives: 30 days (section 17).
Audio recordings from video rooms: until the transcript has been created, at most six hours after the session ends.
Consents in video rooms: as long as the document of the session.
Files from the chat of video rooms: as long as the document of the session.
List of finished Zoom meetings for import: 90 days for meetings without a connection to claritos (no appointment or instant meeting in claritos).
Documents, bookkeeping entries and invoices: according to commercial and tax retention obligations, as a rule ten years (sections 147 AO, 257 HGB).
User account and content: until deleted by you or until the end of the contract with the business they belong to.
22. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 21). You may withdraw consent at any time with effect for the future.
Where your rights concern content that a business processes in claritos, that business is your point of contact (section 14).
23. Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, your place of work or the place of the alleged infringement. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf, Germany
Phone: +49 (0)211 / 38424 - 0
24. Links to other sites
Our pages may refer to third-party websites. The respective providers are solely responsible for their content and data processing.
25. Changes
We adapt this policy when the processing described here changes. Last updated: November 10, 2026.
