Privacy Policy

Last updated: 2026-08-21 · Jurisdiction: Germany (DSGVO / BDSG)

1. Controller

Mignuti Media — Eduard Ditler, Pfarrer-Mengesstr. 5, 56112 Lahnstein — see Imprint. Contact: media@mignuti.com.

2. Data we process

• Account data: email, name, organization. Basis: Art. 6(1)(b) GDPR.
• Knowledge-base content (PDFs): uploaded by customers. Processed on the customer's instructions under AVV (Art. 28 GDPR).
• Chat messages (end-user ↔ bot): stored on behalf of the customer. Anonymized after 90 days (message content scrubbed; aggregated metrics retained).
• Billing: processed via Stripe (Ireland). Payment card data never touches Mignuti Chatbot servers.

3. Sub-processors

Full list: /en/legal/subprocessors. Changes are notified 30 days in advance (opt-in).

4. International transfers

Platform data (database, files, auth) is processed exclusively in the EU (our own server in Germany, netcup GmbH). For AI responses, chat messages are transferred to Anthropic PBC (USA), and for semantic search to OpenAI (USA) — safeguarded by the EU-US Data Privacy Framework (Art. 45 GDPR) and, in addition, EU SCCs 2021/914. As an additional safeguard, personal data (email, phone, IBAN, credit card, etc.) is automatically redacted before any transfer to the AI providers (PII redaction). On request, an EU-only mode can be enabled per bot (AI processing via Azure OpenAI in the EU) — in that case no third-country transfer to Anthropic takes place.

5. Your rights (Art. 15–22 GDPR)

Access, rectification, erasure, restriction, objection, portability. Email media@mignuti.com. End-users who chat with a mignuti-chatbot-powered widget can request deletion via the in-widget "delete my conversation" link (no account required).

6. Retention

• Messages (content): 90 days, then anonymized.
• Billing records: 10 years (§ 147 AO German tax law).
• Audit log: 2 years active, 7 years cold.

7. Cookies & Analytics

Marketing site uses Plausible (EU, cookie-free). After consent, the chat widget stores a session ID in the browser's localStorage (no cookie, no cross-site transmission) for conversation continuity. No third-party tracking.

8. Complaints

Competent supervisory authority: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI RLP), Hintere Bleiche 34, 55116 Mainz — datenschutz.rlp.de. You may also lodge a complaint with any data-protection supervisory authority.

9. Minors (Art. 8 GDPR)

Mignuti Chatbot is a B2B service aimed exclusively at business customers — not at children. The chatbot is not intended to deliberately address persons under 16. As a processor we operate the widget on behalf of our customers; the customers (controllers) warrant in the Data Processing Agreement that they will not target the widget at minors under 16 and will obtain any consent required under Art. 8 GDPR. If we become aware of children's data collected without the required consent, we delete it without undue delay.