Privacy Policy

1. Controller

DigitalMaster Hub GmbH, Barlowstraße 31, 81927 München, represented by managing director Eros Sailer. Contact: hi@digitalmaster-hub.com, phone +49 89 38169031. No data protection officer has been appointed; please direct any privacy-related inquiries to the contact address above.

2. Hosting & server location

DataVault is operated on Amazon Web Services (AWS) in the eu-central-1 (Frankfurt am Main) region. Data is stored and processed within the EU. A data processing agreement (Art. 28 GDPR) is in place with AWS.

3. What data we process

Account data: email address and login credentials (managed via Amazon Cognito). Content data: documents, emails, and their content that you upload, as well as metadata extracted from them (classification, entities, full text, vectors). Usage data: logs of uploads, searches, and chats (audit log) for traceability and security.

4. Purposes & legal bases

Processing takes place to fulfil the usage agreement (Art. 6(1)(b) GDPR), to comply with legal obligations such as GoBD-oriented retention (Art. 6(1)(c)), and on the basis of legitimate interests in security and product operation (Art. 6(1)(f)).

5. AI-assisted processing

For classification, entity recognition, embedding, and research, document contents are passed to Amazon Bedrock (models including Anthropic Claude, Cohere Embed), exclusively within EU regions. The content is not used to train the models.

6. Cookies & analytics

Strictly necessary cookies: We set necessary cookies for login and session management. These are required for operation; no consent is required for them (§ 25(2) TTDSG).

Google Analytics (only with consent):For anonymized reach measurement we use Google Analytics 4 (provider: Google Ireland Ltd., Ireland) with Google’s consent mode (Consent Mode v2). Before you give consent, no analytics cookies are set and no personal analytics data is collected. In this state, Google can only receive anonymous, aggregated signals without cookies and without identifiers. Only after you actively consent via our cookie banner (legal basis: Art. 6(1)(a) GDPR, § 25(1) TTDSG) are analytics cookies set and full measurement activated. IP addresses are shortened/anonymized by Google Analytics 4 by default. Processing may involve a transfer to Google LLC (USA); this is based on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

Your consent is voluntary and can be withdrawn at any time with effect for the future. Withdrawing is as simple as giving consent: Change cookie settings.

7. Recipients / processors

Amazon Web Services EMEA SARL: infrastructure, database, and storage (EU region Frankfurt), AI processing via Amazon Bedrock, authentication (Amazon Cognito), text recognition (Amazon Textract), as well as email receipt and delivery (Amazon SES). Stripe Payments Europe, Ltd.: processing of payments and subscriptions (only for paid usage; full payment data is not stored in DataVault). Google Ireland Ltd.: reach measurement (Google Analytics), only after consent; may involve a transfer to Google LLC (USA) based on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework. Data processing agreements pursuant to Art. 28 GDPR are in place with the providers listed above.

8. Retention period

Content data is stored for the duration of use. Certain records are subject to statutory retention periods (GoBD/HGB/AO, typically up to 10 years) and are retained accordingly via S3 Object Lock. Deletion takes place after the retention period expires or upon request.

9. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21), as well as the right to lodge a complaint with a supervisory authority (Art. 77). The competent authority for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach.

10. Contact for privacy matters

hi@digitalmaster-hub.com

Last updated: July 2026. GoBD statements are indicative only and do not constitute a guaranteed compliance claim.