Privacy policy

1) Controller and scope

1.1 This privacy policy applies to CIRO NOISE, the team workspace operated by CIRO GmbH at https://www.ciro-noise.de. It also applies to its programmatic interfaces (API and MCP) and to the public pages of the application, for example ticket forms and ticket status pages, and to our website with the contact form on the help page and the booking of demo appointments. Personal data means any information relating to an identified or identifiable natural person.

1.2 The controller within the meaning of the General Data Protection Regulation (GDPR) is CIRO GmbH, Maischer Str. 10, 85386 Eching, Germany, phone: +49 89 24 88 31 22, e-mail: hello@ciro.gmbh, represented by its managing directors Andre Teich and Markus Froese, registered with the Munich Local Court (Amtsgericht München) under HRB 312001.

1.3 CIRO NOISE is aimed primarily at businesses; private individuals can register as well. You use the application as a member of an organization. For the content your organization processes in CIRO NOISE (wiki pages, tasks, tickets, receipts, meeting notes, passwords, uploaded files), the organization is normally the controller under the GDPR. We then act as its processor (section 6). For the operation of the application itself – your account, sign-in, billing and platform security – we are the controller. This policy covers both roles.

1.4 For any question about data protection, write to hello@ciro.gmbh or to the postal address above.

2) Data collected when you access the application

2.1 Every time you access CIRO NOISE, your browser sends technical data to our servers, which is processed in so-called server log files. This includes:

• the address (URL) requested and the resource served
• date and time of access
• the amount of data transferred and the response status
• the page you came from (referrer), where your browser sends it
• browser type and version and the operating system
• the IP address of your device

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is running the application in a stable and secure way. We keep log data only for a short period and do not combine it with other data. The exception is when concrete indications of an attack or abusive use require an investigation.

2.2 To prevent abuse, we limit the number of requests that a single IP address or access token can make within a period of time (rate limiting), in particular for sign-in, for sending one-time codes and for the API. For this we process the IP address and the identifier of the access token for a short time. The legal basis is Art. 6(1)(f) GDPR.

2.3 The application uses TLS encryption throughout (visible by the https:// prefix and the lock icon in the address bar). All data you exchange with us is therefore protected against interception in transit.

3) Hosting and storage

3.1 Application hosting (Vercel)

CIRO NOISE runs on the infrastructure of Vercel Inc., USA. Vercel executes our server functions, serves the static parts of the application and accepts incoming requests through its global network. Our server functions run in a region we have configured; connection data such as the IP address may be processed briefly outside the EU when a request is accepted.

We have concluded a data processing agreement with Vercel. For transfers to the USA the provider is certified under the EU-US Data Privacy Framework; in addition, the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR) apply.

3.2 Database (Prisma Postgres)

All business data – accounts, organizations, wiki, boards, tickets, accounting, meetings, password vault, audit log – is stored in a PostgreSQL database that we operate through the Prisma Data Platform (Prisma Data, Inc.). The database is hosted in a data center region within the European Union. A data processing agreement is in place with the provider. The provider could gain access from a third country for administration or support purposes. Where that happens, it is covered by the standard contractual clauses of the European Commission.

3.3 Files (Vercel Blob)

Uploaded files – attachments to tasks and tickets, receipts, organization logos, generated images – are stored in the Vercel Blob object store. Storage is private: there are no publicly reachable file addresses. Every file is served exclusively through an application route that first checks that you are signed in and permitted to see the file.

3.4 The legal basis for hosting is Art. 6(1)(b) GDPR (provision of the contracted service) and Art. 6(1)(f) GDPR (legitimate interest in reliable and secure operation). Organization content is processed on behalf of the organization under Art. 28 GDPR.

3.5 Server-side error monitoring (Sentry)

So that we can detect and fix outages quickly, our server functions and the upstream request handling report technical errors to the Sentry service of Functional Software, Inc., 45 Fremont Street, San Francisco, USA. Reports are sent exclusively to an ingestion endpoint in Sentry's EU data region (Frankfurt am Main, Germany) and stored there. Reports are only sent from our environments hosted on Vercel.

An error report contains the error message, the stack trace (the place in the program code where the error occurred), the requested address (URL) and route, technical details of the runtime environment, and request headers such as browser type and language. In addition, for a sample of 10% of operations we record how long the individual processing steps take (performance monitoring) in order to find slow spots. We do not transmit IP addresses, sign-in or session data, or an identifier of your account. In individual cases, however, a report may contain excerpts of the data being processed when the error occurred. Examples are identifiers in the requested address or details contained in an error message itself.

These reports are generated on our servers without accessing your device or setting cookies; we therefore do not ask for consent for them. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable operation of the application and in fixing errors quickly. You can object to this processing under section 14.2. Where a report touches an organization's content, Sentry acts as our sub-processor (section 6.3).

We have concluded a data processing agreement with the provider. Even with the EU data region, the provider, as a company headquartered in the USA, may access data, for example for operations and support. For such transfers to the USA the provider is certified under the EU-US Data Privacy Framework; in addition, the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR) apply. Sentry deletes error reports and performance data automatically when the retention period of our plan expires, after 90 days at the latest.

4) Cookies, local storage and consent

4.1 We use technically necessary cookies and storage entries without consent, because the application does not work without them or your settings would not persist. In detail:

• Session cookie: keeps you signed in after login. The cookie is set as HttpOnly and cannot be read by scripts in the browser. We run the session on our own infrastructure (Better Auth). If you sign in with Google, Google is involved only in the sign-in itself (section 5.3); the session cookie is set by us.
• Active organization (ciro_active_org): remembers which organization you are currently working in if you are a member of several organizations.
• Language (ciro_locale): stores your language choice (German or English).
• Color mode and theme preset: store your choice between light and dark mode and your organization's color theme so the page renders correctly on first load.
• Cookie settings: store your choice in the cookie banner in your browser's local storage. The choice is valid for twelve months; after that we ask again.

4.2 The legal basis for storing and reading these necessary cookies and entries is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), as they are strictly necessary to provide the service you have expressly requested. Where personal data is processed in the course of this, it is based on Art. 6(1)(b) GDPR (performance of the usage contract) and Art. 6(1)(f) GDPR (legitimate interest in a functioning, secure application).

4.3 We only use two services if you consent to the “Analytics” category in the cookie banner: usage analytics by Amplitude (4.4) and error reports from your browser to Sentry (4.5). Before you consent, we do not load the program code of these services into your browser, and your browser sends no data to them. The legal basis for storing and reading information in your browser is your consent under Section 25(1) TDDDG; for the related processing of personal data it is Art. 6(1)(a) GDPR. We do not embed tracking pixels or advertising networks; the “Functional” and “Marketing” categories currently contain no services.

4.4 Usage analytics (Amplitude)

With your consent, we use Amplitude to measure how CIRO NOISE is used – on the public pages of our website and inside the application. This shows us which paths visitors take, where they drop off and where using the product gets stuck. The provider is Amplitude, Inc., San Francisco, USA. The data is sent to Amplitude's EU data region and stored there. The following is collected:

• page views with the address and title of the page and the previous page (referrer), as well as the start and end of a visit
• the origin of a visit, such as campaign parameters in the address
• clicks on controls including their labels, notable click patterns (such as repeated clicks or clicks without effect), starting and submitting forms – without the content entered – and file downloads
• page loading times and requests to our servers that end in a server error (address, status code, duration – without content)
• on the public pages, additional named events: clicks on buttons and links leading to sign-in, pricing, contact or a feature, use of the price calculator and the tool comparison, opening a question in the FAQ, starting a sign-in, the creation of a new account and booking a demo appointment
• after sign-in: the internal identifier of your account, your organization's short name, your role, your seat type and the organization's plan – not your name and not your e-mail address
• technical details such as browser, operating system, device type and language, and a randomly generated device identifier
• an approximate location (such as the country), which Amplitude derives from your IP address on receipt; at our instruction, Amplitude does not store the IP address itself

After sign-in, we link the measurements to your account through the internal identifier. To us, this usage data is therefore not anonymous but attributable to you. When you sign out, we remove this link in your browser. The pages organizations show their customers – request forms, ticket status pages, appointment management, the invoice portal and embeds on other websites – as well as pitch pages and share links are neither measured nor recorded.

Session replay: Amplitude records how the page is built and changes in your browser – mouse movements, clicks, scrolling and the content displayed. This is not a video but a reconstruction of the page that helps us understand usability problems. By default every visit is recorded; we can lower the share per environment. Entries in form fields are masked in your browser before anything is sent. Particularly sensitive areas are hidden entirely: password vault entries and their sharing, one-time codes, API keys shown once, customer links and PINs of tickets, access codes and share links of pitch pages, invitation links and calendar subscription addresses. Other displayed text is not masked – names, tasks, tickets, receipts or other content of your organization shown on screen may therefore be included in a recording.

Amplitude stores the device identifier and details of the current visit in cookies whose names begin with “AMP_” and in your browser's local storage; the cookies expire after twelve months. If you withdraw your consent, we delete these cookies. We keep usage data and recordings for as long as we need them to improve CIRO NOISE.

We have concluded a data processing agreement with the provider. Even with the EU data region, the provider, as a company headquartered in the USA, may access data, for example for operations and support. For such transfers to the USA the provider is certified under the EU-US Data Privacy Framework; in addition, the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR) apply.

4.5 Error reports from your browser (Sentry)

With your consent, your browser also reports technical errors to Sentry – the same provider in the same EU data region (Frankfurt am Main, Germany) as in section 3.5. A report contains the error message and stack trace, the page viewed, browser, operating system and device type, and the last technical steps before the error (page changes, clicks on controls, network requests without their content). For a sample of 10% of operations we additionally record loading times. We do not transmit form contents, names or an identifier of your account; your screen session is not recorded (no session replay).

Sentry does not set any cookies in your browser; the program sends reports directly to the ingestion endpoint in the EU. In the process, your IP address is technically visible to Sentry; we do not transmit it as part of the report. Section 3.5 applies to data processing on our behalf, third-country transfers and the retention period.

4.6 Your consent is voluntary; you can use CIRO NOISE without restriction without it. You can change or withdraw it at any time with effect for the future – via the “Cookie settings” link in the footer of our website or directly at https://www.ciro-noise.de/cookies. After you withdraw consent, your browser no longer sends data to Amplitude or Sentry, and we delete Amplitude's cookies (“AMP_”) in your browser. Data already collected is kept until its retention period ends; you can request its erasure under section 14. This does not affect the lawfulness of processing carried out before the withdrawal. If we add a new service to a category, we will ask you again.

4.7 We also use your browser's local storage for interface settings, such as the most recently selected theme or collapsed sections. These settings do not leave your device.

4.8 You can delete or block cookies in your browser at any time. Without the session cookie, however, signing in to CIRO NOISE is not possible.

5) Registration, sign-in and account

5.1 To use CIRO NOISE you need a personal account. For this we process your e-mail address, your name and any details you voluntarily add to your profile. An account is created by your own registration, by signing in with a Google account or by accepting an invitation from your organization.

5.2 Sign-in works without a password: you receive a time-limited one-time code or a sign-in link by e-mail (see section 7 for delivery), or you sign in with your Google account (section 5.3). After a successful sign-in you receive a session that is maintained through an HttpOnly cookie. We do not offer sign-in through other social networks or identity providers.

5.3 Sign-in with Google

You can register and sign in with your Google account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ('Google'). If you choose 'Continue with Google', we redirect you to Google. There you sign in and allow Google to transmit details from your Google account to us. We only request the permissions for your e-mail address and your profile. Signing in does not give us access to your contacts, files or other Google services.

From Google we receive your e-mail address and whether Google has verified it, your first and last name, the address of your profile picture and an identifier of your Google account. We use this to create your account or sign you in. If Google has verified your e-mail address and an account with this address already exists with us, we link the two. To maintain the link we also store the identifier of your Google account and the access tokens Google issues at sign-in.

Google learns that you are signing in to CIRO NOISE and processes the sign-in under its own terms. In doing so, Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the European Commission has adopted an adequacy decision for transfers to certified companies (Art. 45 GDPR). Details are set out in Google's privacy policy at https://policies.google.com/privacy.

The legal basis is Art. 6(1)(b) GDPR: signing in with Google is one way, chosen by you, of performing the usage contract. You can use sign-in by e-mail instead at any time. We store the details from Google as part of your account until you delete it (section 5.9). You can also revoke the permission for CIRO NOISE at any time in your Google account settings.

5.4 For each session we store the time of sign-in, the IP address and the browser identifier. This protects your account, for example by making unusual sign-ins detectable. Session data is deleted when you sign out or when the session expires.

5.5 Your organization's password vault has an additional layer of protection: before accessing it you confirm your identity again with a one-time code sent by e-mail. The confirmation is valid for a limited period.

5.6 If an organization invites you, we process the e-mail address entered by the organization to deliver the invitation, together with the role or role bundle intended for you. If you do not accept the invitation, it expires at the end of its validity and the data is deleted.

5.7 If you register without an invitation, we automatically create an organization for you, named after you, in which you are the owner. You can set it up or rename it afterwards. CIRO NOISE cannot be used without an organization, because permissions, seats and data are attached to it.

5.8 The legal basis for processing your account data is Art. 6(1)(b) GDPR. For invitations we additionally rely on Art. 6(1)(f) GDPR until you accept (the inviting organization's legitimate interest in working with you).

5.9 You can delete your account yourself at any time in your settings under 'Account & data', or ask us to delete it. We delete your account data once no membership remains, all contracts have been settled and no statutory retention obligations apply. Content you created for your organization remains with the organization; where technically possible it will no longer be attributed to you by name.

6) Organizations, members and processing on behalf

6.1 An organization is the tenant in CIRO NOISE. For each organization we store its name, short code, industry, logo, theme, company details and billing address, its members with their roles and permissions, and the booked seats. Each organization's data is logically separated from all other organizations; every access is checked against the organization and the role of the person accessing it.

6.2 Within an organization, content is created that may contain personal data:

• Wiki: pages, versions and comments
• Boards: projects, tasks, comments, mentions, assignments, attachments
• Support: tickets containing the requester's data (name, e-mail address, phone number, messages, attachments) and the processing history
• Accounting: receipts and invoices with details of suppliers and payments
• Meetings: participants, notes, summaries
• Password vault: credentials, stored in encrypted form
• Images: generated or uploaded visuals

6.3 For this content, the organization decides on the purposes and means of processing. It is therefore the controller under the GDPR, and we process the data as its processor under Art. 28 GDPR, solely on its instructions. Processing on behalf is governed by a data processing agreement with the organization, which organization admins can request from us. The sub-processors we use are named in this policy. Error reports (Sentry) and usage analytics with session replay (Amplitude) may touch organization content that appears in an address or on screen. Sections 3.5, 4.4 and 4.5 describe which data that is and how we limit it.

6.4 Within your organization your name, e-mail address and profile are visible to the other members. Changes to content are recorded with your name and a timestamp so that collaboration remains traceable. Security-relevant events (invitations, role changes, access through API keys) are recorded in an audit log that organization admins can view. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (traceability and security).

6.5 If you leave an organization or are removed from it, your membership, your permissions and the API keys bound to that organization end. Your account remains.

6.6 Please address data subject requests concerning an organization's content (for example access to data in a ticket) to the organization. If such a request reaches us directly, we forward it to the organization and support it in responding.

7) E-mail delivery (Brevo)

7.1 We send transactional e-mails: one-time codes and sign-in links, invitations, notifications (for example on mentions, assignments or new replies in tickets) and messages about your subscription and invoices. We currently do not send marketing e-mails or a newsletter for CIRO NOISE.

7.2 For delivery we use Brevo (Sendinblue GmbH), Köpenicker Str. 126, 10179 Berlin, Germany. We transmit the recipient address, subject and content of the respective message. We have concluded a data processing agreement with the provider.

7.3 Where an e-mail is necessary to perform the usage contract (sign-in, invitation, billing), the legal basis is Art. 6(1)(b) GDPR. For all other e-mails it is Art. 6(1)(f) GDPR (legitimate interest in reliable collaboration within the team). You choose which notifications you receive by e-mail in your personal settings.

8) Payment processing (Stripe)

8.1 Booked seats are processed through Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe provides the checkout, the customer portal (invoices, payment methods, cancellation) and invoicing.

8.2 We transmit to Stripe the organization's name, billing e-mail address, billing address, VAT identification number (where provided), the number of booked seats and the billing period, and an internal identifier of the organization. Changes to company details and billing address in CIRO NOISE are synchronized to the Stripe customer so that invoices are issued correctly. Payment details such as card numbers are entered directly with Stripe; they never reach our systems.

8.3 From Stripe we receive the subscription status, the timing of payments and invoices, and notices of failed payments, so that we can manage your subscription and inform you about problems.

8.4 Stripe may transfer data to affiliated companies in the USA. The provider is certified under the EU-US Data Privacy Framework; in addition, the standard contractual clauses of the European Commission apply. Where Stripe processes data for fraud prevention and to meet its own legal obligations, Stripe is itself the controller. You can find details at https://stripe.com/privacy.

8.5 The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR for the retention of invoices under Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB) (ten years).

9) Support and communication channels

9.1 Support is optional and is set up by the organization. With it, the organization handles requests from its own customers as tickets. The requesters' data processed in this context – name, e-mail address, phone number, message content, attachments, timestamps – is processed by us on behalf of the organization (section 6). The organization configures the channels in its settings and is responsible for them.

9.2 Web form and e-mail replies

Requests reach the organization through the web form it embeds on its website; they become tickets. Acknowledgments and replies from the ticket are sent to the requester by e-mail – through the delivery service described in section 7 (Brevo, Germany). Sender and recipient addresses, subject, content and attachments are processed. Incoming e-mails are not received.

9.3 SMS channel (Twilio)

If the organization has set up the SMS channel, text messages are sent and received through Twilio Inc., USA. The phone numbers of the parties, the message text and timestamps are processed. For transfers to the USA the provider is certified under the EU-US Data Privacy Framework; in addition, the standard contractual clauses of the European Commission apply.

9.4 Public ticket form

Each organization can offer a public form through which its customers submit a request without an account. The details entered (name, e-mail address, subject, message, attachments) are processed, together with the sender's IP address for a short time to prevent abuse. The form carries the organization's branding; the organization is the controller for handling the request.

9.5 Public status page with PIN

Anyone who has submitted a ticket receives a link to a status page and a PIN. Together they allow the requester to view the status of the ticket and reply. The PIN protects the ticket from access by third parties; whoever receives the link should not share the PIN. Failed PIN attempts are limited and logged.

9.6 AI in support

If AI assistance is enabled for Support, incoming tickets are automatically prioritized and categorized (section 10).

9.7 For us, the legal basis is the organization's instruction (Art. 28 GDPR). The organization typically relies on Art. 6(1)(b) GDPR (handling a request within a customer relationship) or Art. 6(1)(f) GDPR (legitimate interest in answering requests). Tickets remain stored until the organization deletes them or the contract with the organization ends.

10) AI features

10.1 CIRO NOISE includes features based on large language and image models (AI). Your organization can switch off each feature individually:

• prioritization, categorization and translation of incoming support requests, and reply suggestions
• recognition of receipts and documents (amounts, date, issuer, line items) in accounting
• the AI assistant, which answers questions from your organization's wiki, boards and other content and cites its sources; for this we convert content into vectors for the knowledge search
• meeting summaries and action items
• chapter suggestions for offers from your organization's content library
• classification of Instagram comments and drafts for replies and direct messages
• the AI demo on pitch pages, which answers visitors from your organization's knowledge base
• brand kit suggestions (colors, fonts, brand voice) from a given website
• article drafts for the magazine
• optionally, the generation of images and background removal for portraits

10.2 We run the language models through Google Cloud Vertex AI provided by Google Cloud EMEA Limited, Ireland. We use exclusively models of Google's Gemini family, including the model we use to prepare content for the knowledge search. We do not call models of other providers for these features. Processing takes place in data center locations within the European Union; the language models are pinned in our configuration to an EU region or to Google Cloud's EU multi-region. A data processing agreement is in place with Google Cloud.

10.3 For processing we transmit the content needed for the respective feature – for example the text of a support request, the image of a receipt, excerpts of wiki pages or your question to the AI assistant. The provider does not use this content to train its models. We store the models' responses only where the feature requires it (for example the recognized receipt data, the summary of a meeting or a generated image).

10.4 AI features run only when you trigger them or when your organization has enabled automatic processing (such as prioritizing requests on arrival). The AI assistant only accesses content you are allowed to see yourself; it has no permissions beyond yours.

10.5 For every request we record, per organization, the type of feature, the model used, the time and the amount consumed (tokens). This usage data does not contain the content of the request. It is used for quota checks, billing and showing the organization its usage.

10.6 AI results are suggestions, not decisions. CIRO NOISE does not make automated decisions within the meaning of Art. 22 GDPR that have legal effect on you. Review AI results before acting on them.

10.7 For organization content, the legal basis is the organization's instruction (Art. 28 GDPR); the organization generally relies on Art. 6(1)(b) or (f) GDPR for using these features. We process the usage data on the basis of Art. 6(1)(b) GDPR.

11) Integrations, API access and MCP

11.1 Integrations your organization can connect

Organization admins can connect external services to CIRO NOISE. A connection exists only if the organization actively sets it up, and it can be disconnected in the organization settings at any time. After connecting, we store the credentials required (such as access tokens) and exchange with the service only the data needed for the respective feature. The service's own privacy notice applies to its processing.

• Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): Calendar, Meet and Drive via the Google APIs – events, attendees, meeting links and files.
• Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, Dublin 18, Ireland): calendars via the Microsoft Graph interface – events and attendees. Calendars of other providers are connected through a subscription address (ICS) the person provides; we only fetch that address.
• Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland): comments and direct messages to the organization's Instagram account so they can be handled as tickets. Meta may transfer data to the USA; the provider is certified under the EU-US Data Privacy Framework.
• Contentful (Contentful GmbH, Berlin, Germany): publishing articles from the magazine pipeline.
• Magnific (Freepik Company S.L., Spain): generation of images and background removal for portraits – image descriptions (prompts) and format settings are transmitted, no files you uploaded.

Each person connects their own calendar in their settings: with Google or Microsoft through their sign-in (for Google through the same access as sign-in with Google, section 5.3) or through the subscription address (ICS) of another calendar. We then read the events of the selected calendar – title, time, location and attendees – for a period from 30 days back to 180 days ahead, in order to detect busy times and display appointments. Appointments you arrange in CIRO NOISE, such as booked appointments, are added to this calendar. Other members see only that the time is busy, not the title or location of your events. We store the access tokens encrypted. If you disconnect, we delete the events imported through that connection.

For us, the legal basis is the organization's instruction (Art. 28 GDPR); the organization generally relies on Art. 6(1)(b) or (f) GDPR for the connection.

11.2 API keys

Your organization can issue API keys that allow programs to access CIRO NOISE. A key is bound to a person and to one or more organizations and has at most that person's permissions. We log access through a key (key, time, function called) so that organization admins can trace what happens through the interfaces.

11.3 Connecting an AI assistant (MCP)

You can connect an external AI assistant – for example Claude by Anthropic – to CIRO NOISE through the Model Context Protocol (MCP). The connection only exists because you establish it: when connecting, we show you a consent screen where you choose the organization and see which permissions the access receives. If you are a member of several organizations, we ask – we never choose silently on your behalf. The access then applies to exactly the organization you consented to and does not follow a later switch.

A connected assistant has at most the permissions you have yourself, and reaches only the features you released:

• Tasks and boards: tasks, comments, labels, attachments and the names of the people involved.
• Wiki: page tree, page content and attachments. Pages classified as confidential stay invisible to an assistant – in search as well.
• Knowledge: approved knowledge entries. Confidential entries only with the explicit permission for them.
• Support: subject, number, customer name and status of requests.
• Business partners: companies, contacts and deals.
• Files: name, type and origin of your organization's files plus a permission-checked download link. Every source stays behind its own feature permission.
• Images: your organization's gallery – list, view, delete.
• Time tracking: read-only, and only which requests are pending for you and who in the same group would be absent in the same period. The type of a sick note is not disclosed.

Explicitly NOT reachable through such a connection: the password vault, clocking in, correcting and approving in time tracking, HR administration and its reports, your organization's billing, and your organization's Google Drive. Those areas require a browser session.

The content the assistant retrieves is transmitted to its provider and processed there under that provider's terms. If you use Claude, that is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, and Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA; data may be transferred to the USA. We are not responsible for that processing – the assistant's provider is, or you as its user. The provider's privacy notice sets out the basis for the transfer. We transmit no data to the provider on our own initiative – we only answer the calls your assistant makes.

On our side, each call creates one entry in your organization's audit log: who, which organization, which tool and when. We do not store the content of your conversation with the assistant, and we do not evaluate the calls for any other purpose. Organization admins can view the log; it is kept for as long as the organization exists (section 13).

You can revoke the connection at any time under “My account → API keys”; after that the access answers no further call. The legal basis is Art. 6(1)(b) GDPR, because you initiate and use the connection yourself. Questions go to hello@ciro.gmbh (section 1.4).

12) Contact, contact form and demo appointments

12.1 If you contact us by e-mail or phone, we process the data you provide (name, contact details, content of your request) solely to handle your request. If your request relates to a contract, the legal basis is Art. 6(1)(b) GDPR. Otherwise it is Art. 6(1)(f) GDPR (legitimate interest in answering your request).

12.2 Contact form on the help page

At https://www.ciro-noise.de/hilfe you can write to us using a form. We process what you enter: your request (subject and description), your name and your e-mail address or phone number – one of the two is enough – as well as the language of the page and the time. The form does not accept attachments. To protect against abuse, we briefly process your IP address (section 2.2).

We store your request as a support request in CIRO NOISE, in the organization of CIRO GmbH, where our team handles it. We are the controller for this processing. You receive a request number, a link to a status page and a PIN (section 9.5). If you provided an e-mail address, we send you a confirmation of receipt and our replies by e-mail via Brevo (section 7). If your e-mail address belongs to a company already in our customer database, we assign the request to that company and may add you there as a contact. If AI support is switched on for our support team, the request is classified by urgency on receipt (section 10).

Before submitting, you confirm that we may store your details in order to handle your request. The legal basis is Art. 6(1)(b) GDPR if your request concerns an existing contract or its conclusion, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering your request).

12.3 Booking a demo appointment

At https://www.ciro-noise.de/demo-buchen you can book an appointment for a demonstration of CIRO NOISE with CIRO GmbH. We process:

• your name and e-mail address
• optionally your phone number and the e-mail addresses of further attendees
• your answers to the booking questions: company, size of your team, features you are interested in, and a free-text message
• the selected time slot and your time zone

We add the appointment to the calendar of the member of our team who runs the demonstration (Google or Microsoft, section 11.1); this usually also creates the video meeting link. Further attendees are listed as guests in the calendar entry and are invited through it. You receive a confirmation by e-mail with a link to cancel or reschedule the appointment, and reminders before the appointment; the e-mails are sent via Brevo (section 7). If your e-mail address belongs to a company already in our customer database, we assign the appointment to that company and may add you there as a contact.

The legal basis is Art. 6(1)(b) GDPR (carrying out the appointment you booked and pre-contractual steps at your request). We process the e-mail addresses of further attendees under Art. 6(1)(f) GDPR; our legitimate interest lies in inviting the people you want to bring to the appointment.

12.4 Retention

We delete requests and appointment bookings once the matter has been fully resolved and we no longer need them for follow-up, at the latest three years after the end of the year in which the last contact took place. If a contract results from the request, the periods for contract data and the statutory retention obligations apply.

13) Retention periods

How long we keep data depends on the purpose, the legal basis and statutory retention periods:

• Account: until your account is deleted.
• An organization's data and content: until the organization deletes it or the contract with the organization ends. After the contract ends, we keep the data available for export for the retrieval period stated in the terms and conditions and delete it afterwards.
• Invoices and accounting records of our own billing: ten years under Section 147 AO and Section 257 HGB.
• Sessions: until sign-out or expiry of the session; one-time codes and sign-in links: until used or until their short validity expires.
• Invitations: until accepted or expired.
• Sign-in with Google: the details from your Google account as part of your account, until it is deleted.
• Connected calendars: imported events, for as long as the connection exists.
• Requests through the contact form and demo appointments: until the matter has been fully resolved, at the latest three years after the end of the year of the last contact (section 12.4).
• Server log files and security logs: short-lived, unless a security incident requires longer analysis.
• AI usage data: for the billing period and the subsequent retention period for billing records.
• The organization's audit log: for as long as the organization exists.
• Access via API keys and connected AI assistants (who, which tool, when): as part of the organization’s audit log, for as long as the organization exists.
• Error reports and performance data at Sentry: deleted automatically when the retention period of our plan expires, after 90 days at the latest.
• Usage data and session recordings at Amplitude: for as long as we need them to improve CIRO NOISE; Amplitude's cookies in your browser expire after twelve months and are deleted when you withdraw consent.
• Your choice in the cookie banner: twelve months.

Data processed on the basis of consent is kept until you withdraw consent. Data processed on the basis of a legitimate interest is kept until you validly object. This does not apply if we can demonstrate compelling legitimate grounds for continued processing. Otherwise we delete data as soon as it is no longer necessary for the purpose for which it was collected.

14) Your rights

14.1 As a data subject you have the following rights toward us. The provision cited in each case sets out when they apply:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• notification of rectification, erasure or restriction to recipients (Art. 19 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• lodging a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, a message to hello@ciro.gmbh is sufficient. If your request concerns content an organization processes in CIRO NOISE, the organization is your point of contact (section 6.6); we support it in responding.

14.2 Right to object

WHERE WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF A LEGITIMATE INTEREST UNDER ART. 6(1)(F) GDPR, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION (ART. 21(1) GDPR).

IF YOU OBJECT, WE WILL NO LONGER PROCESS THE DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS.

SHOULD WE PROCESS YOUR DATA FOR DIRECT MARKETING IN THE FUTURE, YOU MAY OBJECT AT ANY TIME WITHOUT GIVING REASONS (ART. 21(2) GDPR).

14.3 Supervisory authority

The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de. You may also contact the supervisory authority of your place of residence or work.

15) Changes to this privacy policy

We update this policy when our processing changes – for example through new features, new service providers or changes in the law. The current version is always available at https://www.ciro-noise.de/datenschutz; the date at the bottom of the page shows the version. For material changes affecting your account we will additionally inform you by e-mail or within the application.