Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

archmax GmbH Paulinenstr. 14 72072 Tübingen Germany

Phone: +49 151 65150089 Email: info@archmax.ai

archmax GmbH is represented by its managing directors Dr. Steffen Wütz and Dr. Tobias Große-Puppendahl. Further details can be found in our imprint.

This privacy policy applies to:

• our website, including the contact form,
• archmax Cloud, our hosted platform for archmax automation, which companies use to design, test and operate AI agents.

In archmax Cloud we act in two roles: we are the controller for your user account and for operating the platform. The content that customers process in archmax Cloud, on the other hand, we process on behalf of the respective customer. Details can be found in the part "archmax Cloud".

Our managing director Dr. Steffen Wütz is the contact person for all data protection questions. You can reach him at info@archmax.ai or at the address above. We have not appointed a data protection officer, as we are not legally required to do so (Art. 37 GDPR, Section 38 BDSG).

We process personal data on the following legal bases:

• Art. 6(1)(a) GDPR, where you have given your consent,
• Art. 6(1)(b) GDPR, where processing is necessary for the performance of a contract with you or to take steps prior to entering into a contract,
• Art. 6(1)(c) GDPR, where we are legally obliged to process data, for example under commercial and tax retention requirements,
• Art. 6(1)(f) GDPR, where processing is necessary for our legitimate interests or those of a third party and your interests do not override them.

Storing information on your device and accessing it is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). We only use technologies that are strictly necessary to provide the services you request (Section 25(2) no. 2 TDDDG). No consent is required for this.

We only share personal data where this is necessary for the purposes described in this policy. Recipients are primarily service providers we use as processors, for example for hosting, sign-in, email and AI processing. They are contractually bound by our instructions under Art. 28 GDPR. The sections below describe which service providers we use for which purpose.

We only disclose data to authorities and other public bodies where we are legally required to do so. We do not sell personal data and do not share it with third parties for advertising purposes.

In the event of a sale of our business, a reorganization or a comparable transaction, personal data may pass to the acquirer or legal successor to the extent necessary to continue our services. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in continuing our business operations.

Some of our service providers are based outside the European Union and the European Economic Area, in particular in the USA, or may access data from there. Data is only transferred to such a third country if the requirements of Art. 44 et seq. GDPR are met, that is:

• on the basis of an adequacy decision of the European Commission (Art. 45 GDPR); for the USA, this applies to companies certified under the EU-U.S. Data Privacy Framework, or
• on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which we have agreed with the recipient.

Wherever possible, we choose data centers in the EU. You can request a copy of the relevant safeguards at info@archmax.ai.

We operate our website and archmax Cloud with Railway Corporation, San Francisco, USA. The servers, databases and storage we use are located in data centers in the Netherlands (EU). Railway processes the data as our processor. For possible access from the USA, we have agreed standard contractual clauses with Railway.

Further information can be found in Railway's privacy policy: https://railway.com/legal/privacy

We only store personal data for as long as necessary for the respective purpose and delete it afterwards, unless statutory retention obligations apply. In accordance with Section 257 HGB and Section 147 AO, we retain invoices and accounting records for eight years, commercial and business correspondence for six years, and books and annual financial statements for ten years, and restrict their processing to fulfilling these obligations during that time. Deleted data may remain for up to 90 days in backups that serve solely for recovery after incidents. Specific periods are stated in the individual sections.

We protect your data with appropriate technical and organizational measures under Art. 32 GDPR, in particular:

• encrypted transmission of all connections via TLS (HTTPS),
• encryption of credentials for third-party services with AES-256-GCM,
• strict separation of data between customers and organizations,
• role-based access rights and per-user request limits,
• ongoing review and improvement of these measures.

Each time you visit our website, we automatically process information transmitted by your browser:

• IP address,
• date and time of access,
• page requested and amount of data transferred,
• HTTP status code,
• the website from which you reached us (referrer),
• browser type, operating system and language setting.

We need this data to deliver the website, to ensure its stability and security, and to detect faults and attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and reliable operation. We do not combine this data with other data sources or analyze it for marketing purposes. We delete log data after 30 days at the latest.

Our website does not use any analytics, tracking or marketing services and does not embed third-party content such as maps or videos. We also serve fonts from our own server.

We only set one technically necessary cookie called "NEXT_LOCALE". It stores the language you selected (German or English) if it differs from your browser's language setting and is deleted when you close your browser. The legal basis is Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR; our legitimate interest lies in showing you the website in your preferred language.

You can reach us via the contact form, by email or by phone. For the contact form, we process your name, email address, company and message; for email and phone, the information you provide to us.

We use this data solely to respond to your inquiry and, where applicable, to prepare an offer or a contract. The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in responding to your inquiry.

We do not store contact form submissions in a database on our website; instead, we send them by email to our mailbox. For email, we use Microsoft 365 (Exchange Online) provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as our processor. The same applies to emails we exchange with users and customers of archmax Cloud, for example in support or for notices about the contract. Access by Microsoft Corporation in the USA cannot be ruled out; it is certified under the EU-U.S. Data Privacy Framework. Further information: https://privacy.microsoft.com/en-us/privacystatement

We delete your inquiry once it has been fully dealt with and no statutory retention obligations apply, for example because the correspondence led to a contract. You can object to the storage at any time; in that case we cannot continue the conversation.

Our website contains links to services of other providers, for example to our source code on GitHub. Simply visiting our website does not transmit any data to these providers. Only when you follow a link does the respective provider's privacy policy apply.

archmax Cloud is intended for companies and their employees. We process data there in two roles:

• As controller, we process the data we need for your user account, sign-in, managing organizations, billing, secure operation and communicating with you.
• As processor, we process all content that you or your organization bring into archmax Cloud or have agents process, for example workflows, files, chat histories, sessions and data from connected systems. The controller for this data is our customer, that is, the company using archmax Cloud. This is governed by our data processing agreement under Art. 28 GDPR, which forms part of our terms of use for archmax Cloud.

If you would like to know how your employer or another customer of ours processes your data in archmax Cloud, please contact them directly. We forward any such requests we receive to the respective customer.

You need a user account to use archmax Cloud. For this, we process:

• your email address and whether it has been verified,
• your name, if you provide it or your sign-in provider transmits it,
• a unique user identifier and the sign-in method,
• the time you last used archmax Cloud, in order to identify inactive accounts,
• the time the account was created and last changed.

For registration and sign-in, we use the Auth0 service of Okta, Inc., San Francisco, USA, as our processor. Auth0 processes your sign-in data, for password sign-in your password solely as a cryptographic hash, as well as technical data such as IP address, browser and time of sign-in in order to detect misuse. On our behalf, Auth0 also sends emails to verify your address and to change your password. We never receive your password ourselves. Auth0 stores the data in data centers in the EU. As Okta is based in the USA, access from the USA cannot be ruled out; this is covered by the section "Transfers to third countries". Further information: https://www.okta.com/privacy-policy/

If you sign in with an existing account of another provider, such as Google or Microsoft, that provider transmits your email address, your name and an identifier to us. Processing by that provider is subject to its own privacy policy.

The legal basis is Art. 6(1)(b) GDPR if you yourself are our contractual partner. If you use archmax Cloud as an employee of a customer, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in performing our contract with the customer and giving you access. We base misuse detection on Art. 6(1)(f) GDPR. We store your account data for as long as your account exists; for deletion, see section "Account closure and deletion".

In archmax Cloud you work in organizations. For this, we store the organization's name, its members and their roles. If a member invites another person, we store the invited person's email address, the status of the invitation and a randomly generated invitation token. The inviting person shares the invitation link themselves; we do not send invitation emails. An invitation expires after 14 days.

The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR; our legitimate interest lies in enabling collaboration within an organization.

For paid plans, we process your company's contract and billing data, such as company name, address, VAT ID, contact persons and billing address, the selected plan, billed usage and incoming payments. We use this data to perform the contract, issue invoices and fulfill our obligations under commercial and tax law. The legal bases are Art. 6(1)(b) and (c) GDPR.

Recipients are our tax advisers, the accounting software we use and our bank. Payments are made by bank transfer; we do not use payment service providers. We retain the data for the statutory periods (see section "Retention period").

When you use archmax Cloud, we process on behalf of our customer the content you create or that arises when agents run, in particular:

• agents, workflows, skills, settings and their versions,
• uploaded and generated files,
• sessions with inputs, chat messages, intermediate steps, results and human decisions,
• test cases and evaluations,
• connections and credentials for third-party services.

This content may contain personal data whose type and scope are determined by the customer. We process it solely to provide archmax Cloud and only in accordance with the customer's instructions as set out in the data processing agreement. We do not use customer content to train AI models.

We store the content in databases and object storage with our hosting provider in the Netherlands (see section "Hosting").

To enable agents to carry out tasks, archmax Cloud sends instructions, inputs and the content required in each case to language models. There are two cases:

• Agents and workflows only use language models from a provider that the customer chooses itself and stores in archmax Cloud with its own credentials. archmax Cloud transmits the data directly to that provider on behalf of the customer. The customer determines the provider and processing location and concludes its own contract with the provider. The provider is not our processor; its processing is subject to its own privacy policy.
• We only provide a language model ourselves for the design agent that helps you design workflows in the editor. Its model calls run through a model gateway that we operate in the EU to Amazon Bedrock from Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, which we use as a sub-processor. We use the Frankfurt region (eu-central-1) for this; requests may be distributed to other regions within the EU but do not leave the EU.

For each design agent call, the gateway stores metadata such as the model, time, number of tokens and cost, but not the content of requests and responses. Amazon Web Services does not store model inputs and outputs and does not use them for training; model developers such as Anthropic have no access to this data. Amazon.com, Inc. is certified under the EU-U.S. Data Privacy Framework. Further information: https://aws.amazon.com/privacy/

In both cases, AI processing takes place as part of our processing on behalf of the customer.

You can connect archmax Cloud to services such as Microsoft 365 (for example Outlook, OneDrive, SharePoint and Teams), Google Workspace (for example Gmail, Google Drive, Docs, Sheets and Calendar) and other applications. To do so, you sign in with the respective provider and grant archmax Cloud the requested permissions. We store the access tokens issued in this process and any credentials you enter in encrypted form. They are never shown to language models in plain text.

archmax Cloud only accesses data of a connected service if an agent or workflow of the customer requires it, and only within the scope of the permissions granted. A connection belongs to the agent it was created for and thus to that agent's organization; every member of the organization can use it. We process the retrieved data as the customer's processor (see section "Content and processing on behalf of customers"). Processing by the connected service is subject to its own privacy policy. You can remove a connection in archmax Cloud at any time and additionally revoke the permission with the provider.

We do not use data from Microsoft 365 for advertising or to develop, improve or train generalized AI models. Data from Google Workspace is additionally governed by the following section "Google Workspace data".

This section applies to all data that archmax Cloud receives through Google APIs, for example from Gmail, Google Drive, Google Sheets, Google Docs and Google Calendar (Google user data).

archmax Cloud's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy

Which data we access: When you connect a Google service, archmax Cloud only requests the permissions for that service:

• Gmail: read emails and settings, manage drafts, send emails on your behalf and retrieve your email address,
• Google Drive: see, download, create, edit and delete files in your Google Drive,
• Google Sheets: see and edit spreadsheets, and see and manage files in Google Drive in order to find spreadsheets,
• Google Docs: see and edit documents, and see and manage files in Google Drive in order to find documents,
• Google Calendar: see calendars and events, and create, change and delete events.

Which of this data an agent actually accesses is determined, within these permissions, by the workflow the customer defines.

How we use it: We use Google user data solely to provide the features of archmax Cloud that you or your organization use. An agent reads, creates or changes data in Google when a workflow, a chat or a test calls for it, and the results appear in the respective session. We do not use Google user data for advertising, marketing, profiling or analytics, we do not sell it, and we do not use it to develop, improve or train generalized or non-personalized AI or ML models. Statistics we compile about the use of archmax Cloud do not contain Google user data.

Who receives it: Google user data is only received by:

• the language model the customer has configured for its agents, to the extent an agent needs the data for its task (see section "AI processing by language models"),
• the design agent's language model at Amazon Bedrock in the EU, when you use the design agent and it reads results of earlier sessions or, with your approval, tries out a connection,
• the members of your organization, who can use the connection and see the sessions of its agents, and people to whom the customer makes an agent available through a chat, webhook or MCP endpoint,
• our hosting provider as processor (see section "Hosting"),
• authorities, where we are legally required to disclose it.

In the event of a sale of our business or a comparable transaction, we only transfer Google user data with your prior explicit consent.

Who at archmax can access it: Our staff only read Google user data if you have explicitly agreed to this for specific content, for example as part of a support request, if it is necessary for security purposes such as investigating abuse, or if the law requires it.

How we store and protect it: We store the access tokens issued by Google encrypted with AES-256-GCM. They never reach your browser or a language model; archmax Cloud uses them solely on the server to call Google APIs. Data an agent retrieves from Google is stored as part of the respective session in our database and object storage in the Netherlands. When the customer deletes the session, the agent or the organization, this data immediately becomes inaccessible to everyone.

How to end access: You can revoke archmax Cloud's access at any time in your Google Account at https://myaccount.google.com/connections. archmax Cloud can then no longer access your data at Google, and the stored access tokens become ineffective. You can request the deletion of the access tokens and your Google user data at any time at info@archmax.ai; we then delete them within 30 days, unless statutory retention obligations apply.

Agents can fetch web pages and search the web when a workflow uses this capability. For this, we transmit the addresses to fetch and the search terms to the ScrapingBee service of VostokInc SAS, 66 Avenue des Champs-Élysées, 75008 Paris, France, which carries out the requests for us as a sub-processor. Search terms may contain personal data if a workflow provides for it. This processing takes place on behalf of our customer.

Customers can make their agents available to third parties via chat interfaces, webhooks or as MCP servers, for example to their own customers or employees. If you use such an endpoint, we process your inputs, messages, uploaded files and, where applicable, sign-in information on behalf of the customer operating the endpoint. That customer is the controller; please direct any data protection questions to them.

To protect against misuse, we process technical request data such as origin and time and limit the number of requests.

To operate archmax Cloud, we process as controller:

• usage and cost data, such as the number of tokens consumed and the resulting costs per user and organization, in order to enforce quotas and bill for services,
• short-lived per-user counters we use to limit the number of requests per minute in order to prevent overload and misuse,
• technical logs of the application and of failed requests with IP address, time, requested address and error message, in order to detect and fix faults.

The legal basis is Art. 6(1)(b) GDPR where the data is required for billing, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in secure, stable and economical operation. We delete log data after 30 days at the latest and billing data once statutory retention periods have expired.

archmax Cloud does not use any analytics, tracking or advertising cookies. We only use technically necessary storage technologies:

• The application keeps your access tokens only in the browser's memory; they are not stored permanently on your device.
• Auth0's sign-in library sets a cookie that records for one day whether a sign-in session exists. Auth0 itself sets cookies on its own domain that maintain your sign-in session and protect against misuse.
• In your browser's local storage, we remember display settings such as the color scheme and expanded or collapsed areas.
• In session storage, we briefly note an ongoing sign-in attempt to avoid redirect loops.

The legal basis is Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(b) and (f) GDPR. You can delete local storage entries at any time in your browser settings.

You can close your account at any time in the archmax Cloud settings. This ends your memberships in all organizations, and we delete your Auth0 sign-in account. Organizations that are left without members are closed together with their agents, environments and credentials. Anything you created in organizations that still have other members, such as agents, workflows and sessions, remains, as it belongs to the organization.

We immediately block all data that is no longer needed after closure, so that neither you nor other users can access it, and permanently delete it 30 days after closure, unless statutory retention obligations apply. This includes your user account, your memberships and all content of the closed organizations.

We automatically close accounts on the free plan that have not been used for six months and whose organizations have no active workflows. We announce this at least 30 days in advance by email to your verified address; if you sign in during this period, your account remains. The same procedure as for a closure by you then applies. A workflow is active as long as it can be started by a schedule, a webhook, a chat or MCP endpoint or another trigger.

Content we process on behalf of a customer is deleted or returned after the end of the contract in accordance with our data processing agreement.

You have the following rights with regard to your personal data:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object to processing (Art. 21 GDPR),
• right to withdraw consent with effect for the future (Art. 7(3) GDPR).

To exercise your rights, simply send a message to info@archmax.ai. If your request concerns data we process on behalf of a customer, we forward it to the customer and support them in responding.

Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

Where we process your data for direct marketing, you can object at any time without giving reasons. Please send your objection to info@archmax.ai.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg Lautenschlagerstraße 20 70173 Stuttgart Germany https://www.baden-wuerttemberg.datenschutz.de

You are under no legal or contractual obligation to provide us with personal data. However, without the information required for a contact inquiry or a user account, we cannot process your inquiry or provide you with archmax Cloud.

We do not make any decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). How customers use their agents in archmax Cloud is determined by the customers on their own responsibility.

We update this privacy policy when our website, archmax Cloud or the legal requirements change. The version published on this page applies.