1. Controller
Controller within the meaning of the General Data Protection Regulation (GDPR):
Tim Melnyk und Amir Dohmosh GbR „AgentDeck“, Harpprechtstraße 13, 80933 München, Germany, represented by its partners Tim Melnyk and Amir Dohmosh.
We have not appointed a data protection officer because no legal obligation to do so applies. Please send questions about data protection to the email address above.
2. Hosting and visiting this website
When you visit the website, technically necessary connection data is processed, such as your IP address, date and time, the page requested, referrer URL, browser type and operating system. This serves to deliver the website, keep it secure and diagnose errors (Art. 6(1)(f) GDPR).
The website, servers and databases are operated by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (AWS), as our processor; data is stored in Frankfurt am Main. To deliver pages quickly and protect against attacks, AWS also uses servers outside the EU, in particular in the United States. Transfers there rely on the EU-US Data Privacy Framework, under which AWS is certified, and additionally on standard contractual clauses.
Access logs are deleted after 30 days and logs of blocked or suspicious requests after 90 days, unless a specific security incident requires longer retention.
3. Fonts and program libraries
All fonts and program libraries of the website are served from our own server. The website embeds no third-party content, so visiting these pages does not transmit your IP address to any third party.
4. Local storage, cookies and analytics
We use no tracking cookies and no analytics or advertising services.
Only once you open the agent and accept its data processing notice does it store, in your browser’s local storage, your acceptance and random identifiers for the session and conversation, so a conversation survives a page change (§ 25(2) no. 2 TDDDG), and, where present, the campaign parameters of your entry page (e.g. utm_source) for as long as the browser tab is open. If you close the agent’s prompt, the website remembers that for two days. You can delete these entries at any time by clearing your browser’s site data.
5. The AI agent on this website
The button in the bottom-right corner opens the AgentDeck agent. It is an AI system, not a person, and the chat window labels it as such. The window is loaded from our own servers.
Before you can write to the agent, the chat window tells you that you are talking to an AI and how your input is processed, and asks for your consent. When you write, we process your messages, the agent’s replies, the page you are on, its language, the time and the session identifier. The legal basis is your consent (Art. 6(1)(a) GDPR) and, where the enquiry concerns working together, Art. 6(1)(b) GDPR.
If you show interest in working together, the agent may ask for your name, company, email address or phone number. Giving them is voluntary. What you provide is stored as an enquiry so we can come back to you. The agent makes no decisions with legal effect for you (Art. 22 GDPR).
Conversations and enquiries are stored with AWS in Frankfurt. To generate replies, we send the conversation to our processor OpenAI (OpenAI Ireland Ltd., Dublin; processing also in the United States on the basis of standard contractual clauses). OpenAI does not use the content to train its models.
Please do not enter health data, credentials, payment details or anyone else’s personal data. Conversations are deleted automatically 180 days after the last message, and an enquiry that came from one together with the last conversation belonging to it, unless a business relationship has resulted.
You can delete your conversations yourself at any time under “Chat history” in the agent; they are then also deleted on our servers. Deleting your last conversation also withdraws your consent. For anything else, such as access to your data or deleting other data, an informal email to info@agentdeck.eu is enough; you can also withdraw your consent there at any time.
6. Callback requests
You can request a callback through the callback form or in the chat. We then process your phone number, name, company where given, your consent, the time and the page language in order to call you about your enquiry. The legal basis for the call is your consent (Art. 6(1)(a) GDPR) and, for handling the enquiry, Art. 6(1)(b) GDPR.
The callback is made by our AI voice assistant, which identifies itself as an AI at the start of the call. For this we use Twilio (telephony), OpenAI (speech processing) and ElevenLabs (speech output) as processors. Data is also processed in the United States, on the basis of the EU-US Data Privacy Framework or standard contractual clauses.
We make no audio recording. We store the content of the call as text and delete it like a chat conversation (section 5), and the callback request itself no later than 180 days after it was last processed. You can withdraw your consent at any time by writing to info@agentdeck.eu; processing carried out before then remains lawful. We do not use the number for any other purpose.
7. Demo bookings through Calendly
The booking buttons lead to an external booking page operated by Calendly, LLC, USA. Calendly is not embedded in this website; data is only sent to Calendly after you follow the link. If you make a booking, Calendly and we process the contact details, appointment data and voluntary information you submit in order to handle your request. Our legal basis is Art. 6(1)(b) GDPR.
8. Contact by email
If you contact us by email, we process your email address, the content of your message and any information you voluntarily provide in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual enquiries and otherwise Art. 6(1)(f) GDPR.
Our mailbox is operated by Google Cloud EMEA Limited, Dublin (Google Workspace), as our processor; processing in the United States relies on the EU-US Data Privacy Framework.
The chat conversations printed on the pages themselves are non-interactive product examples. The agent you can actually use is the one described in section 5.
9. Recipients and retention
Data is disclosed only to the service providers named in this policy for the relevant purpose — AWS, OpenAI, Twilio, ElevenLabs and Google as processors, and Calendly as described — and to public authorities where we are legally required to do so. We do not sell personal data or use it for third-party advertising.
Retention periods are given in each section. Booking and email data is kept as long as needed for your enquiry or a resulting business relationship. Statutory retention obligations remain unaffected.
10. Your rights
Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw consent at any time with effect for the future. An informal email to info@agentdeck.eu is enough.
Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). An informal message to info@agentdeck.eu is enough.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular at your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.
11. AgentDeck Sailing (sailing.agentdeck.eu)
This privacy policy also applies to our website sailing.agentdeck.eu for sailing schools and charter companies. Hosting, local storage and the AI agent work there as described in sections 2 to 5; that site does not offer callbacks.
Through the enquiry form there we process your name, phone number, preferred contact channel and, if you provide them, your Instagram name and website, in order to answer your enquiry (Art. 6(1)(b) GDPR). The enquiry is stored with AWS in Frankfurt and deleted 180 days after it arrives, unless a business relationship results. If you choose WhatsApp, Instagram or Telegram as your contact channel, we reply to you there, and the privacy terms of that provider also apply.
12. Agents on our clients’ websites
We also operate AI agents on behalf of our clients, for example on their websites, in messengers or on the phone. There, the client is the controller within the meaning of the GDPR; we process the data only on the client’s behalf and on its instructions (Art. 28 GDPR). Which data is processed there, for what purpose and for how long is set out in the client’s privacy policy. Please send requests about your rights to the client; if such a request reaches us, we forward it to the client. This privacy policy applies only to our own websites agentdeck.eu and sailing.agentdeck.eu.
13. Updates
We update this privacy policy when the website, the services used or the legal position changes. The version published on this page applies. This policy is available in German and English; the German version prevails.