Legal

Privacy policy

This is a translation for convenience. The German version (Datenschutzerklärung) is legally binding.

How personal data is processed on the website vocavo.pro and in the vocavo platform.

1. Controller

The controller within the meaning of the GDPR is:

Data protection officer: [OFFEN: Ob ein Datenschutzbeauftragter benannt werden muss]

Processing in the platform has one particularity: when a business runs its websites and landing pages with vocavo, the business is the controller for the data of its website visitors and its prospects (leads), and we are its processor. Section 8 describes this division of roles.

2. Hosting and technical provision

The website and the platform are hosted by [OFFEN: Hosting-Anbieter mit Anschrift und Serverstandort] . We manage the servers with [OFFEN: Werkzeug zur Serververwaltung, falls eines eingesetzt wird] .

This processing serves the secure and reliable provision of our service on the basis of Art. 6(1)(f) GDPR. Where data is processed as part of contractual use, the processing is additionally based on Art. 6(1)(b) GDPR. Where required, we conclude data processing agreements under Art. 28 GDPR with the service providers we use.

3. Access data and server logs

When the website, the platform and our customers' websites are accessed, technically necessary access data is processed. This includes in particular the IP address, date and time of access, requested content, browser type, operating system and referrer information.

This processing serves system security, error analysis and the stable operation of our service. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in defending against attacks and investigating faults. The logs are deleted after [OFFEN: Speicherdauer der Server- und Anwendungsprotokolle] , unless a specific security incident requires longer retention for its investigation. We do not use a third-party error monitoring tool.

4. Cookies and audience measurement

On vocavo.pro we only set technically necessary cookies:

• vocavo-session: the session cookie. It holds the language you chose, the state of signing in and, once you are signed in, your session. It expires after 120 minutes of inactivity. We store the session itself in our database, with IP address and browser identifier, so that we can detect misuse.
• XSRF-TOKEN: a security cookie against forged form submissions, same lifetime.
• remember_web_…: only set once you have signed in; it keeps you signed in until you sign out, for at most 400 days.

The legal basis is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR. We set no other cookies on vocavo.pro, which is why there is no cookie banner here.

We do not measure the use of vocavo.pro: no analytics or advertising script runs on these pages, including none from third parties.

vocavo counts visits to the websites our customers run with vocavo without cookies and without storing the IP address: an identifier is formed from the IP address and browser identifier with a key that changes daily; it only allows daily statistics and no recognition beyond the day. Section 8 describes what else happens on these websites, only with consent.

5. Fonts and external content

On vocavo.pro we serve the fonts from our own servers; we do not connect to Google Fonts or similar services. Our customers' websites are preset so that they also load their fonts from our servers and only load embedded third-party services such as videos or Stripe's pricing table once the visitor clicks them. Our customers can, however, include third-party services on their websites, such as advertising and analytics services that only load after consent. Each customer is responsible for their own website; you will find information on this in their privacy policy.

6. Contact and registration

If you contact us by email, we process your details to handle your enquiry and for any follow-up communication.

If you create an account through the registration on vocavo.pro, we process your name, your email address and the name of your company. We send you an email with a sign-in link and a six-digit code; we store both only as a check value (hash), they are valid for 15 minutes and only once. Only when you confirm your address with them do we create your user and your company's account. If your address is already registered, you receive a sign-in email instead.

The legal basis is Art. 6(1)(b) GDPR, insofar as the processing serves the performance of the contract or pre-contractual measures at your request. If no contract is concluded, we delete an enquiry no later than twelve months after the last contact. We delete unconfirmed registrations after [OFFEN: Frist für nicht bestätigte Registrierungen; abgelaufene Anmeldelinks werden derzeit nicht automatisch gelöscht] . Retention periods under commercial or tax law remain unaffected.

7. User account and connection to Claude and ChatGPT

For a user account we process name, email address and membership of accounts with the respective role. You sign in with a link or code sent by email, without a password.

When you connect vocavo to Claude, ChatGPT or another program that uses the Model Context Protocol (MCP), you grant that program access to your account through a sign-in procedure (OAuth). In doing so we receive the program's name and the addresses it returns to after signing in, and store access tokens for it (valid for 15 days, renewable for up to 60 days). Through this connection we only receive what the program sends to vocavo on your behalf, i.e. the tasks and content for your websites, not the rest of your conversation. We store changes to websites with versions, and rules you ask it to remember ("remember …") with time and author, so that they can be traced. Feedback you send with the "send feedback" function is stored with your account; we remove credentials and keys from it before storing.

The legal basis is Art. 6(1)(b) GDPR; for the traceability of changes additionally Art. 6(1)(f) GDPR, our legitimate interest lies in the security and traceability of changes.

8. Processing on behalf of our customers

With vocavo our customers process in particular:

• the content of their websites and landing pages;
• enquiries (leads) from their forms with the details the person enters, such as name, email address, phone number and message, as well as the origin of the enquiry (page, landing page, referring website, campaign parameters) and the text and time of a consent; enquiries go by email to the address the customer names and, if the customer sets it up, to their webhook or their HubSpot (section 8a);
• visitors' choices in the cookie banner of their website (cookie "we_consent") and, only with that consent, measurement through services such as Meta Pixel, Google Ads or Google Analytics that the customer includes on their website;
• only with consent to Meta measurement: the transmission of enquiries, purchases and won customers to Meta's Conversions API, with browser identifier, at the customer's choice the IP address, and with SHA-256 hashes of email address, phone number and name; without consent none of this leaves our server;
• purchases through Stripe on their websites: Stripe reports the purchase to us (amount, currency, time, at the customer's choice the buyer's email address), so that the customer sees which page and which ad led to a purchase; we do not receive payment data;
• whether an enquiry has become a customer, as reported by the customer or taken over from their HubSpot.

The respective customer is the controller for this data; we are the processor and process the data exclusively on their instructions on the basis of a data processing agreement under Art. 28 GDPR. We provide the data processing agreement to our customers on request. If you, as a visitor of such a website or as a prospect, would like information about your data, please contact the operator of the website; if you contact us, we will forward your request without delay.

For the quality check, vocavo opens our customers' pages in its own browser on our server and stores screenshots of the pages; no visitor data is processed in doing so.

8a. Connection to HubSpot

Customers can, at their own request, connect vocavo to their HubSpot account. We then transmit each new enquiry as a contact to that HubSpot account and, on request, read back whether it has become a customer. We store the access keys encrypted. The connection can be disconnected at any time; we then delete the stored access keys. The customer is the controller for this transmission; HubSpot is their service provider.

9. Artificial intelligence

9.1 AI chat programs you connect yourself

When you connect vocavo to Claude (Anthropic) or ChatGPT (OpenAI), you retrieve data from vocavo and commission changes through your own access with that provider. What the provider does with your conversations and the content retrieved is governed by your contract and your settings with that provider. The provider is not our processor.

Customers should therefore only retrieve the prospect data through the chat that they need for the task at hand, and check the privacy settings of their AI provider.

9.2 Our own AI services

vocavo itself currently uses no third-party AI services. If that changes, we will update this policy beforehand.

10. Payments through Stripe

You pay for vocavo plans through Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland). You complete the purchase and manage your payment method and invoices on Stripe's pages; you enter your payment details directly with Stripe, we do not receive them. We store your Stripe customer identifier, the plan and its status, the type of payment method and its last four digits. To calculate VAT, Stripe collects the billing address and, where applicable, the VAT identification number.

The legal basis is Art. 6(1)(b) GDPR. Stripe processes payment data as an independent controller under the rules that apply to payment service providers.

11. Recipients of personal data

Within our company, only those persons who need access to perform their tasks receive it. Beyond that, we pass data on to the following categories of recipients:

• Processors, bound by instructions only:
  • [OFFEN: Hosting-Anbieter] – hosting of platform, database and websites
  • [OFFEN: Anbieter für den Versand der E-Mails] – sending sign-in emails, notifications about new enquiries and other system emails
  • Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland – payment processing and invoices for vocavo plans; Ireland; processing also in the USA
  For data we process on behalf of our customers, this list is the "subprocessors" annex of our data processing agreement.
• Services that our customers connect or set up themselves (HubSpot, Meta's Conversions API, their own webhooks, Stripe for purchases on their websites) receive the data needed for this on the customer's instructions (sections 8 and 8a).
• Professionals and authorities, insofar as we are legally obliged to provide information or the assertion of legal claims requires it.

We do not pass on personal data to third parties for advertising purposes and do not sell data.

12. Transfers to third countries

Some service providers are based in the USA or belong to companies based in the USA (Stripe and, depending on the customer's setup, HubSpot and Meta; [OFFEN: Hosting- und E-Mail-Anbieter ergänzen, falls zutreffend] ). Processing in the USA cannot be ruled out. We base these transfers on the European Commission's adequacy decision on the EU-US Data Privacy Framework where the recipient is certified under it, otherwise on standard contractual clauses under Art. 46(2)(c) GDPR. We provide a copy of the agreed safeguards on request at [OFFEN: Datenschutz-E-Mail-Adresse von vocavo] .

13. No automated decision-making

There is no automated individual decision-making, including profiling, under Art. 22 GDPR. How an enquiry is handled is decided by a person at the respective customer.

14. Retention

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations. The data is then deleted or anonymised. For data we process on behalf of our customers, the respective customer determines the retention period.

15. Your rights

Subject to the statutory requirements, you have in particular the following rights:

• access to the data processed about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR, see section 16)

Where processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected. To exercise your rights, you can reach us at [OFFEN: Datenschutz-E-Mail-Adresse von vocavo] . If your request concerns data that a customer keeps about you in vocavo, section 8 applies.

16. Right to object under Art. 21 GDPR

You have the right to object at any time to the processing of your personal data insofar as it is based on a legitimate interest under Art. 6(1)(f) GDPR and the objection is based on grounds relating to your particular situation. If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If your data is processed for direct marketing purposes, you can object at any time without giving reasons. The objection is not subject to any form; an email to [OFFEN: Datenschutz-E-Mail-Adresse von vocavo] is enough.

17. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

Competent supervisory authority:

18. Last updated

This privacy policy was last updated in November 2026. We adapt it when legal, technical or business conditions change, for example when new vocavo features become available.