Legal

Privacy policy

1. General information

The protection of your personal data is important to us. We process personal data exclusively in accordance with the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR).

This privacy policy informs you about which personal data we process when you visit our website, contact us, use our web-based application HAYP Hospitality AI Platform, or maintain a business relationship with us.

Personal data is any information relating to an identified or identifiable natural person, e.g. name, email address, phone number, IP address or usage data.

2. Controller

BrainSite GmbH
Unterriedener Hauptstraße 22
90518 Altdorf bei Nürnberg
Germany

Email: info@brain-site.com
Phone: +49 1511 8513298

If you have any questions about data protection or the processing of your personal data, you can contact us at any time.

3. Scope

This privacy policy applies to:

visiting our website,
using our web-based application HAYP Hospitality AI Platform,
communication with us by email, phone, contact form or other means,
as well as any other data processing associated with our services.

It is aimed in particular at:

visitors to our website,
prospective customers,
contact persons of customers and business partners,
registered users of our platform,
and other communication partners.

4. Categories of personal data

Depending on the type of use, we may process in particular the following categories of personal data:

Master data – e.g. name, company, position
Contact data – e.g. email address, phone number, address
Contract data – e.g. details of booked services, contract status, communication in the course of service delivery
User data / account data – e.g. login data, user ID, roles, permissions, workspace assignment
Content data – e.g. text entries, uploaded content, edited documents, prompts, requests, comments
Usage data – e.g. access times, features used, technical events, interaction data within the platform
Log and security data – e.g. IP address, timestamps, error logs, system events, security-relevant logs

5. Purposes and legal bases of processing

We only process personal data to the extent legally permissible. Processing takes place in particular for the following purposes:

Providing and operating our website
Providing and operating our platform
Setting up and managing user accounts and workspaces
Handling contact inquiries
Carrying out pre-contractual measures
Fulfilling contractual obligations
Providing AI-supported features
Improving stability, security and usability
Error analysis and abuse prevention
Fulfilling legal obligations
Asserting, exercising or defending legal claims

Processing is based in particular on:

Art. 6(1)(a) GDPR – consent
Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures
Art. 6(1)(c) GDPR – legal obligation
Art. 6(1)(f) GDPR – legitimate interests

Our legitimate interests lie in particular in the secure, stable, efficient and economical provision of our website and platform, as well as in the optimization of our business and support processes.

6. Visiting our website and server log files

When you access our website, your device's browser automatically transmits information to our servers or to the servers of our technical service providers. This information is processed in so-called server log files.

In particular, the following data may be processed:

IP address
Date and time of access
URL or file accessed
Referrer URL
Browser type and version
Operating system used
Access status
Amount of data transferred

This data is processed in order to:

provide the website technically,
ensure the security and stability of the systems,
detect attacks and abuse,
and analyze technical errors.

The legal basis is Art. 6(1)(f) GDPR.

Server log data is stored only as long as necessary for the purposes stated. It is then deleted or anonymized unless longer retention is required for security or evidentiary reasons.

7. Contact

If you contact us, e.g. by email, phone, contact form or other communication channels, we process the data you provide to handle your request.

In particular, the following data may be processed:

Name
Email address
Phone number
Company
Content of your message
other information you voluntarily provide

Processing takes place:

to handle your request,
to carry out pre-contractual measures,
to communicate within existing contractual relationships.

Legal bases are:

Art. 6(1)(b) GDPR, insofar as the request relates to a contract or the initiation of a contract,
Art. 6(1)(f) GDPR otherwise, due to our legitimate interest in efficient and appropriate communication.

8. Registration and user account

The use of certain features of our platform may require setting up a user account.

As part of registration and account use, the following data may be processed in particular:

Name
Email address
Company / organization
Username
Encrypted or hashed authentication data
Roles and permissions
Date and time of registration, login and account-related actions
IP address
Workspace or organization assignment

Processing takes place for the following purposes:

Setting up and managing user accounts
Authenticating users
Providing protected platform areas
Rights and role management
Abuse prevention and system security

The legal basis is Art. 6(1)(b) GDPR, supplemented by Art. 6(1)(f) GDPR with regard to security and abuse-prevention measures.

Users are obliged to keep their access data confidential and to protect it from access by unauthorized third parties.

9. Use of the HAYP Hospitality AI Platform

When using our platform, we process personal data to the extent necessary to provide the features, carry out the technical operation, enable collaboration within workspaces, and fulfil our contractual services.

In particular, the following data may be processed:

User and account data
Role and permission information
Organization and workspace assignments
Inputs, content and work states within the platform
Uploaded files and documents
AI-related inputs and outputs
Usage and interaction data
Log and security data
Support and communication data

Processing takes place in particular for the following purposes:

Providing and operating the platform
User and rights management
Collaboration within teams and workspaces
Processing and storing content
Providing AI-supported features
Ensuring stability, integrity and security
Support and troubleshooting
Contract performance and customer support

The legal basis is generally Art. 6(1)(b) GDPR. Insofar as the processing is also necessary for system security, product improvement or abuse prevention, it is based on Art. 6(1)(f) GDPR.

10. Processing of content, files and user inputs

When using our platform, content may be processed that is entered, uploaded, stored, edited or managed by users.

This may include in particular:

Texts
Documents
Tables
Instructions and prompts
Comments
Communication content
other work-related content

Insofar as such content contains personal data, processing takes place solely for the purpose of providing the respective platform feature and enabling the processing requested by the user.

We recommend not entering sensitive personal data or other particularly sensitive information into our systems unless this is strictly necessary and expressly provided for contractually or technically.

11. Use of AI services from OpenAI and Anthropic

To provide certain AI-supported features, we use technical services from the providers:

OpenAI, L.L.C., USA
Anthropic PBC, USA

When using the platform, inputs, content and contextual data may be transmitted to and processed by these services, insofar as this is technically necessary to provide the respective feature.

In particular, the following data may be processed:

Text inputs and prompts
Content provided by the user
Context-related processing information
Generated results
Technical metadata
Security- and system-related log data

Processing takes place in particular for the following purposes:

Generating and structuring content
Supporting workflows
AI-supported analysis and processing of inputs
Improving the usability of our platform features

The legal basis depends on the context of use:

Art. 6(1)(b) GDPR, insofar as the processing is necessary to fulfil our contractual services,
Art. 6(1)(f) GDPR, insofar as the processing is based on our legitimate interest in efficient, modern and high-performing platform features,
where applicable, Art. 6(1)(a) GDPR, if consent is obtained.

Insofar as users provide personal data in inputs or uploaded content, this data may likewise be processed to the extent necessary.

Inputs and outputs are not used to train general AI models, insofar as this has been contractually agreed accordingly.

Processing of personal data in the USA cannot be ruled out. Insofar as a third-country transfer takes place, this occurs only in compliance with the legal requirements of Art. 44 et seq. GDPR, in particular on the basis of suitable safeguards such as standard contractual clauses or other permissible transfer mechanisms.

Further information: https://openai.com/privacy, https://www.anthropic.com/privacy

Purely automated decision-making within the meaning of Art. 22 GDPR does not take place, unless expressly stated separately.

12. Logging and monitoring with logz.io

For technical monitoring, error analysis, security monitoring and to ensure the stability of our systems, we use logz.io.

Provider: Logz.io Ltd., Tel Aviv, Israel

In the course of using this service, the following data in particular may be processed:

Technical log data
IP addresses or shortened/pseudonymized IP addresses, where technically implemented
Timestamps
Error and system events
Usage and diagnostic data
Security-relevant information

Processing takes place for the purpose of:

Detecting and analyzing technical issues,
Monitoring system stability and performance,
Investigating incidents,
Detecting and preventing abuse and security incidents.

The legal basis is Art. 6(1)(f) GDPR.

Israel has a level of data protection recognized as adequate by the European Commission.

Further information: https://logz.io/privacy-policy/

13. Use of Amazon CloudFront

For the secure, stable and performant delivery of our website and, where applicable, individual platform content, we use Amazon CloudFront, a content delivery network.

Provider: Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg

Using this service may process technically necessary connection data, in particular:

IP address
Browser information
Time of access
Content requested
Technical connection data

Processing takes place to optimize the availability, delivery speed and security of our services.

The legal basis is Art. 6(1)(f) GDPR.

Insofar as data is transferred to third countries in this context, this only occurs in compliance with the legal requirements of Art. 44 et seq. GDPR.

Further information: https://aws.amazon.com/privacy/

14. Cookies and similar technologies

Our website and platform may use cookies and comparable technologies. Cookies are small text files stored on your device that contain certain information.

We use such technologies in particular:

to technically provide our services,
to maintain sessions,
to authenticate logged-in users,
to ensure security and stability,
and, where applicable, for a user-friendly presentation and functionality.

Insofar as cookies or similar technologies are strictly necessary for technical operation, their use is based on Art. 6(1)(f) GDPR.

Insofar as technologies requiring consent are used beyond that, this is based on Art. 6(1)(a) GDPR.

You can withdraw your consent at any time with effect for the future and adjust your settings accordingly.

15. Recipients of personal data

Within our company, only those departments that need the data to fulfil the respective purposes are granted access to personal data.

In addition, personal data may be transferred to external recipients insofar as this is legally permissible and necessary, in particular to:

Hosting and infrastructure service providers
Content delivery and cloud service providers
Logging and monitoring service providers
AI service providers
Support and communication service providers
Payment or billing service providers, where applicable
Advisors, lawyers or auditors, where necessary
Authorities or courts, where a legal obligation exists

Insofar as external service providers process personal data on our behalf, we conclude – where necessary – data processing agreements pursuant to Art. 28 GDPR.

16. Third-country transfers

Insofar as personal data is transferred to or processed by recipients outside the European Union or the European Economic Area, this occurs only in compliance with the legal requirements of Art. 44 et seq. GDPR.

A transfer may take place in particular if:

an adequacy decision of the European Commission exists,
appropriate safeguards, e.g. standard contractual clauses, have been agreed,
or another legally permissible transfer mechanism applies.

17. Retention period

We store personal data only for as long as necessary for the respective processing purposes or as required by statutory retention obligations.

Relevant criteria for the retention period are in particular:

Duration of the contractual or usage relationship
Duration of processing a request
statutory retention periods
legitimate interests in documentation, IT security and legal defense
technical and organizational necessity

As soon as the respective purpose no longer applies and there are no further legal or legitimate reasons for retention, the relevant data is deleted or anonymized.

18. Data security

We take appropriate technical and organizational measures to protect personal data against loss, manipulation, unauthorized access, unauthorized disclosure or other unlawful processing.

These include in particular measures for:

Access control
Authentication
Encryption
System security
Logging
Availability and resilience of our systems

Our security measures are regularly reviewed and adapted to the state of the art.

19. Rights of data subjects

Within the framework of the statutory requirements, you have the following rights:

Right of access pursuant to Art. 15 GDPR
Right to rectification pursuant to Art. 16 GDPR
Right to erasure pursuant to Art. 17 GDPR
Right to restriction of processing pursuant to Art. 18 GDPR
Right to data portability pursuant to Art. 20 GDPR
Right to object pursuant to Art. 21 GDPR
Right to withdraw consent with effect for the future
Right to lodge a complaint with a supervisory authority

If you wish to exercise any of these rights, please contact us using the contact details given above.

20. Right to object

Insofar as we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time to this processing for reasons arising from your particular situation.

If personal data is processed for the purpose of direct marketing, you have the right to object at any time to this processing; this also applies to any profiling related thereto.

21. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes data protection law.

For private companies in Bavaria, the following supervisory authority is responsible in particular:

Bayerisches Landesamt für Datenschutzaufsicht
Promenade 18
91522 Ansbach
Germany

Website: https://www.lda.bayern.de

22. Changes to this privacy policy

We reserve the right to amend this privacy policy if this becomes necessary due to legal, technical or organizational changes. The version published on our website or within our platform at the time shall apply.