Legal
Privacy Policy
As of: September 2026
1. Privacy at a Glance
General Information
The following notes give a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified.
Data Collection on This Website
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. Their contact details can be found in the section „Notice on the Responsible Entity“ in this privacy policy.
How do we collect your data?
Your data is collected in part by you providing it to us. This may include data you enter in a contact or registration form.
Other data is collected automatically by our IT systems when you visit the website. This is primarily technical data (e.g., internet browser, operating system, or time of page access).
What do we use your data for?
Part of the data is collected to ensure error-free provision of the website. Other data may be used to analyze your user behavior – only with your consent.
What rights do you have regarding your data?
You always have the right to obtain information about the origin, recipients, and purpose of your stored personal data free of charge. You also have the right to request correction or deletion of this data. If you have given consent to data processing, you may revoke this consent at any time for the future. You may also contact us at any time regarding this and other questions about data protection.
2. Responsible Entity
The responsible entity for data processing on this website is:
Elevatry GmbH
Alte Poststraße 10
85598 Vaterstetten-Baldham
Germany
Email: hello@elevatry.ai
3. SSL/TLS Encryption
This site uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the fact that the address line of the browser changes from „http://“ to „https://“.
When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.
4. Hosting
The content of this website is hosted by Vercel Inc. The provider is Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA.
When you visit this website, Vercel processes the data technically required to deliver it, in particular your IP address and the information listed under server log files (section 5). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing our website securely, quickly and reliably.
We have concluded a data processing agreement with Vercel under Art. 28 GDPR. Vercel operates data centres worldwide, so processing in the USA cannot be ruled out. Vercel Inc. is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); standard contractual clauses apply in addition.
5. Server Log Files
The provider of these pages automatically collects and stores information in server log files, which your browser automatically transmits to us. These include:
- Browser type and browser version
- operating system used
- referrer URL
- hostname of the accessing computer
- time of the server request
- IP address
This data is not merged with other data sources.
The collection of this data is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the error-free presentation and optimization of their website.
7. Google Analytics
With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics is only loaded after you have agreed to the “Statistics” category in the consent banner. Before that, no connection to Google is made.
Google Analytics sets cookies (“_ga” and “_ga_*”, stored for up to 2 years) and collects pseudonymous usage data, such as pages viewed, time spent, where the visit came from, the approximate location derived from the IP address, and device and browser information. Google Analytics 4 does not store full IP addresses. We always transmit the consent signals for advertising purposes as denied.
The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Data may be transferred to servers of Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); standard contractual clauses apply in addition.
Retention
Event data stored in Google Analytics is deleted automatically after 14 months.
Withdrawal
You can withdraw your consent at any time via “Cookie settings” in the footer. We then remove the Google Analytics cookies and send no further data to Google.
Browser add-on
In addition, you can prevent collection by Google Analytics with Google's browser add-on: https://tools.google.com/dlpage/gaoptout
Data Processing Agreement
We have concluded a data processing agreement with Google (Google Ads Data Processing Terms).
8. Vercel Web Analytics & Speed Insights
This website uses Vercel Web Analytics and Vercel Speed Insights by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA (“Vercel”). Web Analytics counts visits and pages viewed; Speed Insights measures loading performance (Core Web Vitals).
Neither service sets cookies. Visits are distinguished by a hash derived from the request, which is discarded after 24 hours; IP addresses are not stored. The data is processed on Vercel's servers, including in the USA. Vercel Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
The processing of this data is based on Art. 6(1)(f) GDPR (legitimate interest). The website operator has a legitimate interest in analyzing website usage to optimize their online offering. For more information on Vercel's privacy policy, please visit: https://vercel.com/legal/privacy-policy
9. Cloudflare Turnstile (Spam Protection)
This website uses the Cloudflare Turnstile service, a spam and abuse protection service provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA ("Cloudflare"). Turnstile is used to verify that form submissions on this website are made by a human and not by an automated bot.
Turnstile is only loaded on pages with a form. A connection to Cloudflare's servers is established, your IP address is transmitted, and characteristics of your browser and your interaction are evaluated to detect automated access. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting our forms against automated abuse and spam. Where information is stored in or read from your browser in the process, this is strictly necessary for the form service you are using (Section 25(2) No. 2 TDDDG). For more information on data protection at Cloudflare, see: https://www.cloudflare.com/privacy/
10. Forms (Contact, Evaluations, Waitlist)
When you send us inquiries via forms on this website or register for our waitlist, your details from the form including the contact details you provided will be stored by us for the purpose of processing the inquiry and in case of follow-up questions.
The details from our forms are transmitted to HubSpot and stored in our CRM system at HubSpot (HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA). If you request an evaluation (e.g. from the role check or the impact calculator), we also transmit your inputs and the result, such as role, team size, salary or procurement volume – but not the text of a job description you pasted or uploaded. We have concluded a data processing agreement with HubSpot. HubSpot, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); standard contractual clauses apply in addition.
The processing of this data is based on Art. 6(1)(a) GDPR (consent), which you give by submitting the form. You may revoke this consent at any time. An informal email to us is sufficient for this purpose. The legality of the data processing carried out until the revocation remains unaffected by the revocation.
The data you enter in the form will remain with us until you request deletion, revoke your consent to storage, or the purpose for data storage ceases to apply. Mandatory legal provisions — in particular retention periods — remain unaffected.
11. Appointment Booking with Microsoft Bookings
We use Microsoft Bookings, a Microsoft 365 service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (“Microsoft”), for booking demo appointments.
We only load the booking calendar on our website once you agree – via the “External media” category in the consent banner or with the “Load calendar” button. Only then is a connection to Microsoft's servers established; Microsoft receives your IP address and technical information about your browser and device, and may use cookies or similar technologies. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Alternatively, you can open the booking page directly at Microsoft or write to us by email.
When you book an appointment, we process the data you enter there – in particular name, email address, phone number if given, company and your message – and the selected time, in order to organise the demo, send you a confirmation and reminder, and set up an online meeting (Microsoft Teams) where applicable. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request).
Microsoft processes this data as our processor under the Microsoft Products and Services Data Protection Addendum. The data is stored in our Microsoft 365 tenant; Microsoft generally processes customer data from the EU within the EU Data Boundary. A transfer to the USA cannot be ruled out nonetheless. Microsoft Corporation is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); standard contractual clauses apply in addition.
We delete booking data once it is no longer needed to hold and follow up on the appointment and no statutory retention obligations apply. For more information on data protection at Microsoft, see: https://privacy.microsoft.com/privacystatement
12. External Services and Content
Fonts are served from our own server; no connection is made to Google Fonts or other font providers. We only embed third-party content as described in this policy: Cloudflare Turnstile on pages with a form, and Microsoft Bookings after your consent.
Links to social networks (e.g., LinkedIn) do not transfer personal data unless you click on the respective links. When you click on such a link, you leave this website and are subject to the privacy policy of the respective provider.
13. Data Retention Periods
Your personal data will be deleted or blocked as soon as the purpose of storage ceases to apply. Data may be stored beyond this if this has been provided for by European or national legislators in EU regulations, laws, or other provisions to which the data controller is subject.
Data will also be blocked or deleted when a storage period prescribed by the above-mentioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.
Specific retention periods: server log files are deleted after 30 days at the latest. We store your consent choice for 6 months in the cookie “elevatry_consent”. Data from forms is stored until you request deletion, withdraw your consent or the purpose ceases to apply. Event data in Google Analytics is deleted after 14 months. Booking data from Microsoft Bookings is deleted once it is no longer needed for the appointment and its follow-up.
14. Your Rights
You always have the right to access, rectification, erasure, and restriction of processing of your personal data, as well as the right to data portability and the right to lodge a complaint with a supervisory authority.
- • Access to your data stored by us (Art. 15 GDPR)
- • Rectification of inaccurate data (Art. 16 GDPR)
- • Erasure of your data (Art. 17 GDPR)
- • Restriction of processing (Art. 18 GDPR)
- • Data portability (Art. 20 GDPR)
- • Objection to processing (Art. 21 GDPR)
Please contact us at: hello@elevatry.ai
You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.
15. Objection or Withdrawal of Data Processing
If you have given consent to data processing, you may revoke this consent at any time for the future. An informal email to us is sufficient for this purpose. Consent given in our consent banner can also be withdrawn at any time via “Cookie settings” in the footer.
You may object to the future processing of your data at any time if the processing is carried out on the basis of Art. 6(1)(f) GDPR. This also applies to profiling based on these provisions.
16. California Consumer Privacy Act (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you additional rights regarding your personal information.
You have the right to: (a) know what personal information we collect, use, and disclose; (b) request deletion of your personal information; (c) opt out of the sale or sharing of your personal information; (d) non-discrimination for exercising your privacy rights. We do not sell or share your personal information as defined by the CCPA/CPRA.
To exercise your rights under the CCPA/CPRA, please contact us at hello@elevatry.ai. We will respond to verifiable consumer requests within 45 days.