Back to the start page

Privacy Policy

This is a convenience translation of our German Datenschutzerklärung, which is the binding version. It explains, under Articles 13 and 14 GDPR, which personal data we process in connection with the website agentfabrik.de, the waitlist, the customer account, the central sign-in service adam-auth and the operation of your Adam instance.

1. Controller

No data protection officer has been designated. In our assessment the conditions for a mandatory designation (Article 37(1) GDPR: core activities consisting of large-scale regular and systematic monitoring or large-scale processing of special categories; section 38(1) BDSG: as a rule at least 20 persons permanently engaged in automated processing, or processing subject to a data protection impact assessment) are currently not met; we reassess this whenever our processing or company size changes materially. Contact for data protection is the managing director Mohamed Aajour at info@quilar.de.

2. Who is responsible for what

• Website, waitlist, customer account, sign-in service: Quilar GmbH is the controller.
• Your Adam instance, business use: the customer (company, freelancer, organisation) is the controller for the content on its instance (e-mails, calendar, contacts, chats, documents). Quilar GmbH provides, operates and maintains the instance as a processor under Article 28 GDPR on the basis of our data processing agreement (German). Data subjects whose data is processed on a customer instance should address the customer first; we support the customer in answering.
• Your Adam instance, private use: if you use Adam as a consumer, we are the controller for the technical operation and sections 5 to 8 apply to you directly.

3. Website agentfabrik.de

3.1 Server logs. When you visit the site our server processes IP address, time, requested page, transferred volume, referrer, browser and operating system for secure and stable operation (Article 6(1)(f) GDPR). Logs are deleted after 14 days at the latest unless needed to investigate a security incident.

3.2 Fonts. The "Inter" font is served from our own server. No external font provider is used.

3.3 Waitlist. We process your e-mail address, optionally your name, your language choice, a timestamp and a salted hash of your IP address (rate limiting only). Legal basis: your consent (Article 6(1)(a)), pre-contractual steps (Article 6(1)(b)) and our legitimate interest in abuse prevention (Article 6(1)(f)). Entries are stored in an append-only file on our own infrastructure in the EU and deleted once the waitlist has been processed or you withdraw (e-mail to info@quilar.de).

3.4 Cookies and local storage (section 25 TDDDG). We store adam_consent (your cookie decision) and adam-lang (your language) in localStorage; both are strictly necessary. Google Analytics cookies (_ga, _ga_*) are set only after you click "Accept". Without consent no Google script is loaded (Consent Mode v2, default denied). You can change your decision at any time via "Cookie settings" in the footer.

3.5 Google Analytics (consent only). With your consent we use Google Analytics 4 (measurement ID G-TVFM0LM3QV) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be transferred to Google LLC, USA. Cookies last up to 2 years. Legal basis: consent (Article 6(1)(a) GDPR, section 25(1) TDDDG). Transfers to the USA rely on the EU-US Data Privacy Framework adequacy decision where Google LLC is certified, otherwise on standard contractual clauses. Withdraw via "Cookie settings", then "Decline". More: policies.google.com/privacy.

3.6 Contact. If you contact us we process your details to handle the request (Article 6(1)(b) or (f) GDPR) and delete them once the matter is closed and no retention duty applies.

4. Customer account, orders, contract

Once ordering through agentfabrik.de is available we process name, company, e-mail address, login data, billing and payment data, the chosen operating variant, your instance hostname, contract data and security-relevant event logs. Purposes: concluding and performing the contract, provisioning and billing your instance, account security. Legal bases: Article 6(1)(b), (c) (statutory retention under section 257 HGB and section 147 AO) and (f) GDPR. Sign-in: authentication runs through the identity service Zitadel (open-source software) that we host ourselves on a server operated by us in Germany; no third party is involved. Zitadel stores your e-mail address, password hash or passkey/two-factor setup, sessions and sign-in logs. Its database is backed up daily, encrypted with age (public key) and transferred to a second server operated by us (our operations server) at Hetzner Online GmbH in a data centre in Germany, where the newest backup per day is kept for 14 days and per week for 8 further weeks. That server cannot decrypt the backups; we keep the private key offline, outside both servers. No additional provider is involved; Hetzner remains the sole hosting processor. Payment: billing is currently by invoice; we process your billing address and the payment reference of your transfer. Should we use a payment provider in future (e.g. for card or direct-debit payments), it processes your payment data under its own responsibility and we do not receive full card details; we will name the provider here before using it.

5. Operation of your Adam instance

5.1 Hosting. Each instance runs on its own virtual server rented for you from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. Instances are separated from each other; there is no shared database. Hetzner is our processor for the infrastructure and has no contractual access to content.

5.2 Data on your instance. Account and device data; chat and voice messages (audio, transcripts, Adam's replies); tasks, notes, appointments, reminders; contacts and per-interaction redacted one-liners (max. 280 characters; one-time codes, links, IBANs, passwords and health details are removed before storage; no full e-mail bodies, no attachments); data from connected accounts (sections 7 and 8); event and audit logs; usage metrics of AI calls (token counts, duration, cost; no content); knowledge base documents and their text embeddings.

5.3 Purposes and legal bases. Providing the ordered functions (Article 6(1)(b); for business customers on the customer's instructions under Article 28), security and troubleshooting (Article 6(1)(f)), and your consent where you voluntarily connect third-party accounts (Article 6(1)(a)). Data of third parties (e.g. e-mail senders) on a business customer's instance is processed on the customer's legitimate interest in organising its communication (Article 6(1)(f)).

5.4 Messaging channels. Adam is reachable through the Adam app, a Matrix server self-hosted on your instance or, if you set it up, Telegram (Telegram FZ-LLC, Dubai, UAE; Telegram's privacy policy applies in addition). Outgoing messages to third parties are sent only after your explicit approval.

5.5 Voice. Voice messages are transcribed and replies can be read aloud. Depending on your instance configuration we use one of the providers in section 10 (OpenAI, Microsoft Azure or ElevenLabs); only the audio or the text to be spoken is transmitted.

5.6 Backups. The instance database is backed up nightly on the instance's own server and rotated there; it does not leave the server. Backups are read only for recovery and are deleted with the server no later than 90 days after termination (section 12).

6. AI processing (Anthropic Claude, AWS Bedrock)

Adam's answers are generated by a large language model of the Claude family by Anthropic. For each request your message, the context needed for the task (e.g. appointments, e-mail excerpts, notes) and system instructions are sent to the model. In both variants you contract for the model yourself with the provider; we configure your instance for it and take part in this transfer as your processor (business customers) or as operator of your instance. You choose when onboarding:

• Adam via AWS Bedrock (recommended, GDPR-compliant variant): the model is used pay-as-you-go through Amazon Bedrock in the AWS Europe (Frankfurt, eu-central-1) region in your own AWS account, which we set up for you as an additional service. Your contracting party is the AWS entity responsible for your account; AWS acts as your processor under the AWS GDPR Data Processing Addendum, which forms part of the AWS Service Terms. According to AWS, Amazon Bedrock inputs and outputs are not used to train models, are not shared with model providers (Anthropic) and are processed and stored encrypted in the chosen region. Your instance accesses the Claude models in eu-central-1 with a narrowly scoped permission only; the credentials are stored encrypted on your instance, not on the platform.
• Adam via your own Anthropic subscription: you connect your existing Anthropic account (subscription or API key) to your instance. Requests then go to Anthropic's servers in the USA (section 11). Your contracting party is Anthropic (for EEA customers Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland); the terms and privacy policy of your Anthropic account apply, including its rules on the use of content. We are not a party to that contract. This is not the variant we classify as GDPR-compliant; you assess yourself whether it is suitable for your data.

We do not train models on your content. OpenAI may additionally be used for embeddings (knowledge base search, section 10). Adam makes no automated decisions with legal effect under Article 22 GDPR: actions with external effect are executed only after your approval.

7. Connecting your Microsoft account

You may voluntarily connect your Microsoft account (Outlook.com, Microsoft 365) to your Adam instance. You start the connection yourself in Adam and confirm it by signing in and consenting at Microsoft. Without a connection none of the processing in this section takes place.

7.1 Permissions requested (Microsoft Graph, delegated): openid, profile, email (sign-in, name, e-mail address and account identifier); offline_access (background renewal); Calendars.Read (read calendars and events); Mail.Read (read mailbox); Mail.Send (optional, only if you enable sending for your instance; every send requires your approval). Each permission is shown on Microsoft's consent page; for work or school accounts your administrator may restrict or grant consent.

7.2 Data processed: account data (name, e-mail address, tenant and object identifier); access and refresh tokens, stored on your instance encrypted with AES-256-GCM, never logged in clear text, renewed in the background at least daily; calendar data within a window around the current date (time, title, location, attendees, description, meeting link; events marked private or confidential are imported as a time block without content); e-mail data (sender, recipients, subject, date, preview text; the full body only when a specific function needs it; attachments are not downloaded).

7.3 Flow via the sign-in service. The connection runs through our central sign-in service adam-auth (section 9), registered at Microsoft as the application "Adam". It exchanges the authorisation code for tokens, encrypts them for your instance only and hands them over; it stores no tokens. Afterwards the tokens exist only on your instance.

7.4 Legal basis, withdrawal. Consent (Article 6(1)(a) GDPR) and, where the functions are part of the contract, Article 6(1)(b). You can disconnect at any time in Adam; the tokens on your instance are then deleted and syncing stops. You can additionally revoke consent at Microsoft: work or school accounts at myapps.microsoft.com, personal accounts at account.live.com/consent/Manage. Microsoft's privacy statement applies to your Microsoft account.

8. Connecting your Google account

Once the Google integration is enabled you may voluntarily connect your Google account (Gmail, Google Calendar) to your Adam instance. Flow, storage and withdrawal correspond to section 7; the connection also runs through the sign-in service adam-auth.

8.1 Scopes requested: openid, email (sign-in, e-mail address and account identifier); https://www.googleapis.com/auth/calendar.readonly (read calendars and events); https://www.googleapis.com/auth/gmail.readonly (read e-mail; restricted scope, only if you enable mailbox reading); https://www.googleapis.com/auth/gmail.send (send e-mail on your behalf, only if you enable this function; every send requires your approval). We request only the scopes needed for the functions you enable and show them to you before consent.

8.2 Use of Google user data, Limited Use. Adam's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide or improve user-facing features of Adam that are visible to you (calendar and inbox overview, answers to your questions about events and e-mails, sending you approve).
• Google user data is not transferred to third parties except as necessary to provide these features (processing by the AI model under section 6 within your request), for security purposes, to comply with applicable law, or as part of a merger, acquisition or asset sale after your explicit prior consent.
• Google user data is not used for advertising, not sold and not used for credit or lending decisions.
• Humans do not read Google user data unless you have given affirmative agreement for specific messages, it is necessary for security purposes (e.g. investigating abuse), it is necessary to comply with applicable law, or the data is aggregated and used for internal operations.
• Google user data is not used to develop, improve or train generalised or non-personalised AI or machine-learning models.

8.3 Revoking at Google. Besides disconnecting in Adam you can revoke access at myaccount.google.com/permissions. Google's privacy policy applies to your Google account.

9. Sign-in service adam-auth (auth.agentfabrik.de)

adam-auth is the central service through which Adam instances connect accounts at Microsoft (and, in future, Google). It is registered with the providers as the application "Adam" and is the only component holding the certificate. It is built to store nothing permanently:

• What it processes: the identifier of the requesting instance, requested provider and capabilities, a random state value, the authorisation code returned by the provider, and the tokens and account details (name, e-mail address, account identifiers) issued by the provider for the duration of the exchange. When a token is refreshed, the refresh token passes through the service in memory only.
• For how long: pending sign-ins at most 10 minutes, encrypted hand-over bundles at most 60 seconds, replay protection at most 5 minutes; all in memory only. No database, no cookies, nothing on disk. A restart clears all pending operations.
• Encryption: tokens are encrypted solely with the public key of the requesting instance (X25519, AES-256-GCM) and signed by the service; only that instance can open them. Return addresses come from a fixed allowlist of instances.
• Logs: the operational log contains only event type, instance identifier, provider, result, duration and a reason code. No IP addresses, no account names, no codes, no tokens. Logs are rotated by size; the target retention is at most 7 days.
• Rate limiting: to prevent abuse the service counts calls per IP address (IPv6 per /64) within a one-minute window in memory; counters expire with the window.

Quilar GmbH is the controller for the sign-in service. Legal basis: performance of the connection you initiated (Article 6(1)(b) GDPR) and our legitimate interest in secure operation (Article 6(1)(f)). The service runs on our own infrastructure in Germany.

10. Recipients and processors

We disclose personal data only where necessary to provide the service, where you have consented or where we are legally obliged. Article 28 GDPR agreements are in place with all processors. "Optional" providers are used only if the respective function is enabled for your instance:

The providers actually active for your instance are listed in Annex 3 of the data processing agreement or in your instance overview. Authorities receive data only where legally required.

11. Transfers to third countries

• Anthropic (USA), if you choose "your own Anthropic subscription": the transfer takes place under your own contract with Anthropic. For business accounts the Anthropic Data Processing Addendum provides EU standard contractual clauses (Implementing Decision (EU) 2021/914, modules 2 and 3); for consumer subscriptions Anthropic's privacy policy applies (adequacy decisions and standard contractual clauses according to Anthropic). We have not verified an Anthropic certification under the EU-US Data Privacy Framework. As Anthropic's contracting party you check which safeguard applies to your account; we do not classify this variant as GDPR-compliant.
• Google LLC (USA) for Google Analytics and the Google account connection, Microsoft Corporation (USA) for the Microsoft account connection, and OpenAI, ElevenLabs, Telnyx/Twilio (USA) where enabled: the EU-US Data Privacy Framework adequacy decision (Implementing Decision (EU) 2023/1795 of 10 July 2023) where the provider is certified, otherwise standard contractual clauses.
• Telegram (UAE), only if you set up Telegram: no Article 46 safeguard exists; the transfer relies on your explicit consent (Article 49(1)(a) GDPR) after this information about the risks.

With "Adam via AWS Bedrock" AI processing stays in the AWS Frankfurt region (eu-central-1); no third-country transfer takes place for it. Copies of the safeguards of our own providers are available on request.

12. Retention and deletion

• Website server logs: 14 days.
• Waitlist: until processed or until you withdraw.
• Customer account and contract data: for the contract term; invoice data 10 years (section 147 AO), commercial correspondence 6 years (section 257 HGB).
• Content of your instance: for the contract term; 30 days after termination for export, then the instance including its storage is deleted; backups are overwritten or deleted no later than 90 days after termination.
• Customer account in the identity service: until the account is deleted, at the latest 30 days after termination; encrypted backups of the Zitadel database up to 14 days (daily) plus 8 weeks (weekly).
• Tokens of connected accounts: until disconnection or end of contract, then deleted immediately.
• Contact interactions: 730 days by default; mailbox event logs 30 days; the customer may set shorter periods.
• Audit and security logs of the instance: 12 months; records of data-subject requests 36 months.
• IP addresses in the instance's Matrix chat: 7 days.
• Sign-in service adam-auth: operations at most 10 minutes, hand-over bundles 60 seconds, operational log at most 7 days.
• Google Analytics: cookies up to 2 years; event-level usage data in our Google Analytics property is deleted after 2 months (the shortest retention Google offers); aggregated reports contain no user identifiers.

13. Your rights

You have the rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20), objection to processing based on Article 6(1)(f) (Article 21) and withdrawal of consent with effect for the future (Article 7(3)). Adam provides export and deletion functions for data on your instance (JSON export, deletion of individual contacts with a block against re-ingestion, deletion of the whole profile). For any request, e-mail info@quilar.de. If your request concerns data on a business customer's instance we forward it to that customer and support them in answering.

14. Right to lodge a complaint

You may lodge a complaint with a supervisory authority (Article 77 GDPR), in particular in the Member State of your residence, workplace or the alleged infringement. The authority responsible for Quilar GmbH is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, Germany, phone +49 211 38424-0, poststelle@ldi.nrw.de, www.ldi.nrw.de.

15. Data security

Measures under Article 32 GDPR include: TLS for all connections; separate servers per customer; encryption of stored tokens (AES-256-GCM) with an instance-specific key; end-to-end encrypted token hand-over by the sign-in service; SSH key-only server access; mandatory approval for all actions with external effect; redaction of sensitive details before storage; encrypted backups; logging of security-relevant events; regular security updates. Details are in Annex 2 of the data processing agreement.

16. Transparency on the use of AI

Adam is an AI system within the meaning of Regulation (EU) 2024/1689 (AI Act). When you write to or speak with Adam you are interacting with an AI system, not a human (Article 50(1)). Texts, summaries and drafts generated by Adam are AI-generated; Adam marks them accordingly when they leave your instance, as far as technically possible and legally required (Article 50(2) and (4)). AI-generated content may contain errors and does not replace professional review.

17. Changes

We update this policy when our processing, the law or our providers change. The version published here applies; customers are informed of material changes in text form.

Sources

• GDPR: eur-lex.europa.eu/eli/reg/2016/679/oj
• Section 25 TDDDG: gesetze-im-internet.de/ttdsg/__25.html
• EU-US Data Privacy Framework, Implementing Decision (EU) 2023/1795: eur-lex.europa.eu/eli/dec_impl/2023/1795/oj
• Standard contractual clauses, Implementing Decision (EU) 2021/914: eur-lex.europa.eu/eli/dec_impl/2021/914/oj
• AI Act, Regulation (EU) 2024/1689: eur-lex.europa.eu/eli/reg/2024/1689/oj
• Google API Services User Data Policy: developers.google.com/terms/api-services-user-data-policy
• Anthropic Commercial Terms and DPA: anthropic.com/legal/commercial-terms, anthropic.com/legal/data-processing-addendum
• AWS Bedrock data protection and FAQ: docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html, aws.amazon.com/bedrock/faqs; AWS GDPR DPA: d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf

Last updated: November 2026