Privacy policy

1. Controller and contact

The controller for the processing described here is Waterglass FlexCo, Vienna, represented by its managing director Bernhard Hauser. You can reach us at hi@waterglass.ai, and our postal address is stated in the imprint. We have not appointed a data protection officer, because the statutory conditions for one are not met. The contact person for data protection matters is Bernhard Hauser, reachable at the same address.

2. What this policy covers

This policy applies to the website www.waterglass.ai and to our consulting and project business. The Waterglass Waves platform, that is the console at waves.waterglass.ai, its interfaces and the execution environments in which AI agents run, has its own Privacy Notice for Waterglass Waves. That notice describes the processing for accounts, billing and operation of the platform and for the content customers process there.

For further products we publish separate privacy notices on the respective product page as soon as they process personal data beyond the flows described here.

3. Hosting and server logs

The website is delivered by Vercel Inc. (United States), and the server functions run in the European Union. When you access the site, the technical data required for delivery is processed, in particular the IP address, the time of access, the address requested and details of the browser.

This data appears in operational logs that are retained only for a short period. The purpose is the secure delivery of the site, fault diagnosis and the prevention of abuse. The legal basis is our legitimate interest in a secure and functioning website (Article 6(1)(f) GDPR). Vercel acts as our processor (section 13).

4. Visitor statistics without cookies

We measure how the website is used with Vercel Web Analytics, without cookies and without storing anything on your device. It records page views and general technical details such as country, device type and browser. Visits are neither tracked over time nor attributed to you.

The legal basis is our legitimate interest in understanding which pages are used (Article 6(1)(f) GDPR). You may object to this processing (section 18).

5. Language and country

The site is available in German and English. We store your language choice and the country derived from your connection in cookies so that the site opens in the right language and the region in the language picker is preselected. We do not store the IP address for this purpose.

These cookies are required for the functions named. Their use rests on our legitimate interest in a usable site (Article 6(1)(f) GDPR, § 165(3) TKG 2021 (Austrian Telecommunications Act)). Their lifetimes are stated in section 16.

6. Campaign attribution with your consent

If you reach the site through a link that carries campaign parameters, for example from an advertisement, a newsletter or a partner page, a dialog asks for your consent before we keep any of it. If you consent, we store in your browser's local storage a record with the campaign parameters, a click identifier of the advertising platform, the page you arrived on and the time of the click, for up to 90 days, together with your decision. Without your consent nothing is stored. An enquiry or booking made while you are still on the page you arrived on is attributed from the link itself, without anything being stored.

The record stays in your browser and is transmitted to us only together with an action of yours, such as an enquiry, a booking or use of the AI check. We use it solely to measure which channels lead to enquiries and bookings (section 7).

The legal basis is your consent (Article 6(1)(a) GDPR and § 165(3) TKG 2021). You can withdraw it at any time through "Manage consent" in the footer of every page, which also deletes the stored records, or by clearing your browser's site data. We record whether we asked for your consent and how you decided, without the click identifier and without any further information about you, so that we can demonstrate and improve the consent request. The legal basis for this is our legitimate interest (Article 6(1)(f) GDPR).

7. Advertising platforms and the conversion log

Where you reached us through an advertisement, we share the click identifier together with the type and time of your action, such as an enquiry or a booked call, with the platform that served the advertisement, so that it can measure advertising performance. At present these are Google (Google LLC, United States) for Google Ads and OpenAI Ireland Limited (Ireland) for advertisements in ChatGPT. Neither platform receives your name, your email address or the content of your enquiry. Each platform acts as an independent controller for that measurement. This concerns the website alone and is unrelated to the AI model providers named in the Waves notice.

We record the same events in a conversion log that contains the type and time of the event, the click identifier and the campaign parameters, but no names and no email addresses. We keep it with Google, which acts as our processor for it (section 13), and retain its entries for 24 months.

The legal basis for the transfer to the platforms and for the log is your consent to the attribution under section 6 (Article 6(1)(a) GDPR).

8. Contact and proposal enquiries

Through the contact form and the proposal dialog we collect your name, email address, company and the details of your request, together with the page, the language and the route through which the enquiry reached us. We use this data to answer you and to prepare an offer. The legal basis is the performance of pre-contractual steps at your request (Article 6(1)(b) GDPR). Name and email address are required, everything else is voluntary.

Enquiries reach us as an email sent through Resend (processing in Ireland) to our mailbox hosted with Google Workspace.

Information you enter in the proposal dialog may reach us even if you do not complete the dialog. We use it to improve the enquiry process and, where contact details are included, to follow up on your enquiry. The legal basis is our legitimate interest in a working enquiry process (Article 6(1)(f) GDPR). You may object to this processing (section 18).

We keep enquiries for three years after the last contact and then delete them, unless a contract follows, in which case section 12 applies.

9. The AI check

The AI check is a self-assessment with questions about your company and where it stands on the use of AI. The answers are evaluated automatically and the result is shown to you immediately. The evaluation produces no decision with legal or similar effect for you.

To receive the written report, you enter your name and email address. We send the report by email through Resend (processing in Ireland) and receive an internal notification with your answers so that we can prepare for a follow-up conversation. The legal basis for the report is the performance of a service you requested (Article 6(1)(b) GDPR), and for the follow-up our legitimate interest in responding to your interest (Article 6(1)(f) GDPR).

Use of the AI check is also transmitted to us as a signal, together with the attribution record described in section 6 where you consented, and is shared with the advertising platforms as described in section 7. These signals contain no contact details.

We keep your answers and the report for twelve months and then delete them, unless a project follows, in which case section 12 applies.

10. Booking a call through Cal.eu

You can book a call with us through a scheduling dialog. The booking calendar is provided by Cal.com Europe (Cal.eu) and operated in the European Union. When you open it, Cal.eu receives the technical connection data of your browser and may set its own cookies within the calendar. You enter the booking data, that is your name, email address, the chosen slot and any notes, directly with Cal.eu. The appointment is entered into our calendar hosted with Google Workspace. Cal.eu acts as our processor.

A completed booking is recorded in the conversion log described in section 7, together with the attribution record where you consented. The legal basis for the booking is the arrangement and holding of the appointment you requested (Article 6(1)(b) GDPR). We keep booking data for three years after the last contact.

11. Event notifications

If you sign up for notifications about our events, we store your email address and your language with our email provider Resend (Resend, Inc., processing in Ireland) and inform you about upcoming events until you unsubscribe. The legal basis is your consent (Article 6(1)(a) GDPR).

Every email contains an unsubscribe link. When you unsubscribe, we keep a suppression record so that we do not write to you again. Registration for an event itself takes place on the event platform Luma, which acts as an independent controller for the data you enter there.

12. Customers, prospects and business partners

In our consulting and project business we process the data of contact persons at customers, prospects, suppliers and partners: name, position, business contact details, correspondence, and contract and invoicing data. The purposes are the preparation, performance and invoicing of contracts, communication, and the fulfilment of our accounting and tax obligations. The legal bases are the performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR), legal obligations (Article 6(1)(c) GDPR, in particular § 132 BAO (Austrian Federal Fiscal Code)) and our legitimate interest in maintaining business relationships (Article 6(1)(f) GDPR).

We also obtain contact details of potential customers from publicly accessible sources, such as company websites and professional networks, and from providers of business contact data. Where we contact you on that basis, we tell you where we obtained your data.

Recipients are our tax adviser, our bank, our email and calendar provider (Google Workspace) and, where a project requires it, the service providers named in the project agreement. Where we process personal data on behalf of a customer in a project, a separate data processing agreement governs that processing.

We keep accounting records for seven years (§ 132 BAO) and correspondence for three years after the end of the business relationship, in line with the general limitation period, unless a longer period is required for the defence of legal claims.

13. Recipients and processors

We share personal data only with service providers that support us in operating the website and delivering our services, under contracts that oblige them to protect your data, and with the recipients named in sections 7 and 12.

Our processors are Vercel Inc. (United States) for hosting, server functions and visitor statistics. Google Ireland Limited, with possible transfers to Google LLC (United States), for our mailbox and calendar (Google Workspace) and for the Google Sheet that holds the conversion log. Resend, Inc. (United States, processing in Ireland) for sending emails and for the event notification list. Cal.com Europe (Cal.eu) for booking calls. Our tax adviser receives accounting records under a professional duty of confidentiality.

Independent controllers that receive data from us are Google LLC for Google Ads measurement and OpenAI Ireland Limited for advertisements in ChatGPT, both as described in section 7, and Luma for event registrations as described in section 11.

14. Transfers to third countries

Vercel Inc. and Google LLC are established in the United States, and Google may process Workspace and Sheets data there. For these transfers we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and in addition on the standard contractual clauses contained in their data processing agreements. Google Ads measurement involves a transfer to Google LLC in the United States, for which Google acts as an independent controller. Resend, Inc. processes our data in Ireland, and for any access from its country of establishment we rely on the standard contractual clauses in its data processing agreement.

OpenAI Ireland Limited is established in Ireland. Cal.eu processes within the European Union. No other transfers to third countries take place through this website.

15. Retention

We keep personal data only as long as necessary for the purposes described here or as required by law. In particular: server logs for a short period only. Attribution records in your browser for up to 90 days. Conversion log rows for 24 months. Enquiries, proposal requests and bookings for three years after the last contact. AI check answers and reports for twelve months. Event notification contacts until you unsubscribe, after which the unsubscribed entry is kept as a suppression record. Accounting records for seven years. Correspondence with customers and business partners for three years after the end of the business relationship. After these periods the data is deleted or anonymised.

16. Cookies and local storage

We set two first-party cookies, one for your language choice with a lifetime of one year and one for the derived country with a lifetime of seven days (section 5). We do not use advertising cookies, and our visitor statistics work without cookies (section 4).

With your consent, we store two records in your browser's local storage for the campaign attribution described in section 6: the attribution record, for up to 90 days, and your consent decision. You can delete both through "Manage consent" in the footer or by clearing your browser's site data. You can control cookies through your browser settings.

17. Your rights

Under the GDPR you have the right of access to the data stored about you (Article 15), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18) and to data portability (Article 20). You may withdraw any consent you have given at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.

To exercise your rights, contact support@waterglass.ai. We respond within one month. Where there are reasonable doubts about your identity, we may request additional information to verify it.

18. Right to object

Where we process your data on the basis of a legitimate interest under Article 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation (Article 21 GDPR). We then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You may object to processing for the purpose of direct marketing at any time without stating reasons. Send your objection to support@waterglass.ai.

19. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for us is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

20. Obligation to provide data and automated decisions

You are neither legally nor contractually obliged to provide us with personal data. Without the information marked as required in the individual sections, however, we cannot provide the respective service, for example answer an enquiry, send a report or maintain an account.

No automated decision-making producing legal effects or similarly significant effects within the meaning of Article 22 GDPR takes place.

21. Changes

We update this privacy information when our processing, the legal situation or our service providers change. The version in force is published on this page together with its date. We additionally inform customers with a current contract in text form about material changes that affect them.