Privacy Policy

The German version of this page is legally binding; this English version is provided for convenience.

We respect your privacy and process your personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data-protection law. This policy explains what we collect, why, and what rights you have.

1. Controller

ultrabold Kommunikationsdesign GmbH, G7, 4p, 68159 Mannheim, Germany. Contact: welcome@ultrabold.com.

For data-protection inquiries, please reach the same address with "Datenschutz" in the subject line. We have not appointed a Data Protection Officer; we are not required to under Art. 37 GDPR or § 38 BDSG.

2. Categories of data we process

We process the following personal data:

• Account data. Your name, email address, hashed password, and the date you registered.
• Usage data. Records of prompts you send to AI models, tokens consumed, model used, cost, success / failure state, and timestamps. Stored against your account for accurate billing, history, and abuse prevention.
• Conversation history. Messages exchanged with agents — your prompts and the agents' responses — when you choose to persist conversations (you can mark turns private).
• Uploaded files. Documents you upload to an agent's file workspace, plus extracted text we cache for retrieval.
• Generated media. Images and videos produced via agents or the Studio, stored on our infrastructure under your account.
• Billing data. Top-up history and credit ledger entries. Card details are processed by Stripe; we never receive or store them.
• Technical data. IP address, browser user-agent, request timestamps. Used for security, rate limiting, and troubleshooting.
• Contact-form data. Name, email address, and your message when you use the contact form — used solely to answer your inquiry.

3. Legal bases

We rely on the following Art. 6 GDPR bases:

• Art. 6 (1) (b) — performance of contract. Account, AI runs, billing, conversation history, file workspace.
• Art. 6 (1) (c) — legal obligation. Retention of billing records under German tax law (HGB, AO).
• Art. 6 (1) (f) — legitimate interest. Security, rate limiting, abuse prevention, fraud monitoring.
• Art. 6 (1) (a) — consent. Optional marketing or product emails, if you opt in.

4. Subprocessors

To deliver the service we share specific data with the following categories of processors, each bound by a data-processing agreement:

• OpenRouter (US). Forwards prompts to AI model providers (Anthropic, OpenAI, Google, Meta, BFL, others). Prompts and generated content transit OpenRouter.
• Tavily (US). When you attach the web-search / web-fetch tools, the agent's queries and the URLs it requests are sent to Tavily for fulfilment.
• Crawlbase (US). When you attach the web-scrape tool, the URLs the agent requests are forwarded to Crawlbase for fetching.
• Stripe (Ireland / US). Payment processing for credit top-ups. Stripe receives the cardholder name, billing details, and amount; we receive a confirmation event.
• Mailgun (US / EU). Sends transactional email (verification, password reset, contact-form replies).
• Supabase, Inc. (US). Managed PostgreSQL database, hosted in the EU (Dublin, Ireland). Stores account data, agent configurations, conversations and billing / credit records at rest — this data does not leave the EU for storage.
• Server infrastructure (Frankfurt, Germany). File uploads and generated media are stored at rest on dedicated servers rented from Vultr (The Constant Company, LLC, US) in its Frankfurt, Germany datacenter — data does not leave the EU for storage. Server monitoring and management is provided by EZProvider Networks Inc. (Canada), whose remote administrative access is covered by the EU adequacy decision for Canada (Art. 45 GDPR).

Where these providers are based outside the EEA, transfers rely on an adequacy decision under Art. 45 GDPR — including, for certified US providers, the EU-U.S. Data Privacy Framework — or on EU Standard Contractual Clauses and comparable safeguards under Art. 46 GDPR. A complete list of subprocessors is available on request via the contact address above.

5. Retention

• Account data: for the lifetime of your account + up to 30 days after deletion to handle disputes.
• Conversations and files: until you delete them, or your account is closed. Soft-deleted records are purged within 30 days.
• Billing records: up to 10 years under German tax-law retention requirements (§ 147 AO).
• Server logs: 90 days for security purposes.

6. Your rights

Under the GDPR you have the right to:

• Access your personal data (Art. 15).
• Rectification of inaccurate data (Art. 16).
• Erasure ("right to be forgotten") where legally permitted (Art. 17).
• Restriction of processing (Art. 18).
• Data portability — receive your data in a structured, machine-readable format (Art. 20).
• Object to processing based on legitimate interest (Art. 21).
• Withdraw any consent you have previously given (Art. 7).
• Lodge a complaint with the supervisory authority. Our lead supervisory authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW), Königstraße 10a, 70173 Stuttgart, Germany — baden-wuerttemberg.datenschutz.de. You may also complain to the supervisory authority of your habitual residence.

To exercise any of these rights, contact us at the address in section 1.

7. Cookies and similar technologies

We use a strictly necessary session cookie to keep you signed in (Laravel session); storing it requires no consent under § 25 (2) TDDDG. We do not set tracking or advertising cookies, and we do not use third-party analytics that profile visitors.

8. AI model providers and your content

Prompts, attached files, and generated content pass through the OpenRouter network to whichever model provider you've selected. Each provider has its own data-handling policy; OpenRouter publishes a summary at openrouter.ai/privacy. Many providers offer a "no training" option that OpenRouter forwards by default; we do not enable training on user data.

9. Security

We use HTTPS for all traffic, hash passwords with bcrypt, encrypt backups at rest, and follow standard secure-development practices. No system is impenetrable; if you become aware of a vulnerability, please disclose it to us at the contact address in section 1 with "Security" in the subject line.

10. Changes

We may update this policy when the service changes materially. We'll post the new version here with a fresh "Last updated" date and, where the change is significant, notify you by email.