Privacy policy

As of 11 November 2026. The German version is legally binding.

1. Controller

This website is operated by NALSO UG (haftungsbeschränkt), Albrecht-Dürer-Straße 24, 73257 Köngen, Germany. You can reach us at info@nalso.de. Our contact for data protection is Martin Daniel Hergenröder, at the same address.

2. Visiting this website

This website is delivered via Cloudflare. When you visit it, Cloudflare processes technically necessary connection data, in particular IP address, time, requested address, browser information and status data. This is needed to deliver the site securely and reliably and to fend off attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). We do not analyse this data ourselves or combine it with other data.

We have a data processing agreement with Cloudflare. Cloudflare may also process data in the United States. Such transfers are based on the EU-US Data Privacy Framework, under which Cloudflare is certified, and on standard contractual clauses. More information: Cloudflare privacy policy.

3. No cookies, no tracking

This website sets no cookies and uses no analytics or advertising services. If you switch the language, your browser remembers that choice locally; it is not sent to us. Fonts and all other parts of the site are loaded from our own server, not from third parties such as Google.

4. Contact by email

If you email us, we process your address and the content of your message to answer your enquiry (Art. 6(1)(b) GDPR for enquiries about a contract, otherwise Art. 6(1)(f)). We delete the data once the enquiry is settled and no statutory retention obligations apply.

5. Trial bot on this page

If you enter your website address, our server fetches up to eight public pages of that website (respecting its robots.txt), extracts the text and returns it to your browser. For search by meaning, the texts are converted into number sequences via Cloudflare Workers AI. We store neither the texts nor the number sequences; the trial bot disappears when you reload the page.

If you ask the trial bot a question, the question and at most eight matching passages go to our server and, to write the answer, to Mistral AI (Paris, France) through its European service. Zero Data Retention is enabled for our account: according to Mistral, inputs and outputs are not kept longer than needed for the answer. We store neither questions nor answers. To prevent abuse we process the IP address as a hash and briefly count requests per website. Legal basis: your request and our legitimate interest in the demonstration (Art. 6(1)(b) and (f) GDPR).

6. Free trial and account

If you request a trial, we send a link to the email address you provide, transmitting the address and message text to Resend, our email delivery service. When you click the link, we create an account with your email address and a derived password hash (we do not store the password itself) and read your website for your first bot. Legal basis: steps prior to a contract (Art. 6(1)(b) GDPR). Sessions expire after 90 days. If you delete your account, we remove the account and bots unless statutory retention obligations apply.

7. Questions to an Askwerk bot

We operate Askwerk bots on behalf of our customers. The operator of the website where the bot is embedded is the controller for visitors’ questions; we process them on their instructions under a data processing agreement.

A bot’s content is stored encrypted. When you send a question, your browser finds matching passages. The question and at most eight passages go to our server; to answer, we send them with the bot’s instructions to Mistral AI (Paris) as described in section 5. For search by meaning, the question is first converted via Cloudflare Workers AI. We do not store answers. For quotas and billing we store technical usage data without text content (bot ID, time, volumes, duration, status); we process the IP address only as a hash and for at most two minutes.

If the operator has enabled question analytics, the chat asks for your consent first (Art. 6(1)(a) GDPR). With consent we store your question encrypted, without phone numbers and email addresses, and delete it after 90 days. You can withdraw consent by clearing your browser’s site data.

If you choose “Talk to the team”, we send your email address, your name (if given), your request and the chat so far by email via Resend to the operator. We do not store this content. If a bot answers via WhatsApp, messages run through the operator’s WhatsApp account with Meta; we do not store them.

8. Recipients outside the EU

Cloudflare and Resend may also process data in the United States. Transfers are based on the EU-US Data Privacy Framework where the provider is certified, otherwise on the European Commission’s standard contractual clauses. Mistral AI processes requests through its European service.

9. Your rights

Subject to the legal requirements, you have the right of access, rectification, erasure, restriction of processing and data portability. Where we process data on the basis of legitimate interests, you may object on grounds relating to your particular situation. Please contact info@nalso.de.

You may also lodge a complaint with a data protection supervisory authority. Our competent authority is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

10. Changes

We update this policy when the website or the services used change. The version published here applies.