Privacy policy for the IntelliThings website

Last updated: 7 October 2026 · This is a translation of the German version. If the two differ, the German version prevails.

This privacy policy describes how we process personal data on intellithings.io. It covers visits to our website, the AI assistant Vidya, the website check, contact and call-back requests, appointment bookings and the analysis of website usage. Separate privacy notices apply to our IoT platforms, mobile apps and hardware.

1. Controller and privacy contact

myCistern Operations GmbH
Kiem-Pauli-Straße 8
84036 Landshut, Germany
Email: contact@mycistern.com

You can also use this address for privacy questions and to exercise your rights.

2. Website operation, hosting and technical data

We operate the website on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, in Germany. Hetzner processes the data required for hosting on our behalf.

When you open the website, we process in particular the IP address, time, requested address, amount of data transferred, status of the request and details of the browser and operating system. This data is required to deliver content, detect errors and protect the website against misuse. This is our legitimate interest under Art. 6(1)(f) GDPR. The website cannot be provided without processing the technically required connection data.

Server log data is deleted or anonymised after seven days at the latest. To limit abusive requests, we also process technical request identifiers and counters for no more than seven days. They are not used to create advertising profiles. Information about the hosting provider is available from Hetzner.

3. Storage in the browser and consent

We use browser storage and, where a function requires it, cookies. We distinguish technically necessary functions from optional analytics and external content.

We base technically required storage or access on Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The related processing of personal data is based on Art. 6(1)(f) GDPR, unless a requested pre-contractual or contractual service under Art. 6(1)(b) GDPR is concerned. Optional storage and access take place on the basis of your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

In the privacy settings, which you also find in the footer of every page, you can change or withdraw consent at any time with effect for the future. Declining is as easy as agreeing. The website remains usable without consent to analytics; without approval of external content, the embedded calendar stays switched off.

4. AI assistant Vidya

Vidya is an AI assistant. We process the messages you enter, the earlier conversation needed for the answer and the answers generated. Free text can contain personal information that you enter yourself. Where possible, do not enter unnecessary personal data, credentials or particularly sensitive information.

The processing serves to answer your questions, explain possible applications and prepare a next step you ask for. Our AI models run on our own servers in Germany; your content is not transmitted to external commercial AI APIs.

The legal basis is Art. 6(1)(f) GDPR: our interest in providing helpful and efficient advice that you have requested. Where you make a specific pre-contractual enquiry as a potential contracting party, the processing required for it is based on Art. 6(1)(b) GDPR.

The chat history remains in the memory of the open page during the conversation and is processed on our AI servers for the respective answer. We store the chat history (your messages and Vidya's replies, without your IP address) on our server for 90 days to review and improve the quality of the answers; it is then deleted automatically. The additional anonymisation to improve the AI is described in section 6. A conversation summary is only sent to sales if you submit the contact request yourself after reviewing it.

5. Website check

The website check processes the public web address you provide, publicly accessible page content retrieved from it, your voluntary additional information and answers to follow-up questions, and the analysis produced from them. The retrieved texts can contain personal information, such as names or business contact details. The source of this data is the respective publicly accessible websites, which are listed in the result.

We use this information for the assessment of possible IoT and AI applications that you requested. The AI infrastructure and legal bases described in section 4 apply. Where publicly accessible personal information of third parties is processed, we base this on Art. 6(1)(f) GDPR; our interest lies in analysing the publicly presented offering of the requested website, limited to that website.

The analysis does not require an email address. The check cannot be carried out without a suitable website address; additional information is voluntary. Analyses and related answers are kept in server memory for further processing for about 30 minutes after the last successful use. The additional processing under section 6 remains separate from this.

6. Improvement and training after anonymisation

We additionally use content from Vidya and the website check to improve the answer quality, clarity and reliability of our own AI and to train our models with anonymised examples.

For this purpose, existing personal information is first removed or changed in such a way that individuals can no longer be identified by means reasonably likely to be used. This also applies to information in free text and to indirect identifiers. Merely replacing a name with an identifier is not sufficient. Content that cannot be adequately anonymised is not used for this purpose.

We base the selection and processing up to complete anonymisation on Art. 6(1)(f) GDPR. Our legitimate interest is improving the advice and analyses requested by visitors. We limit personal copies to a maximum of 24 hours, do not use personal training data sets and exclude content that cannot be reliably anonymised. You can object to this additional processing on grounds relating to your particular situation; see section 12 for details.

After anonymisation, the personal copies created for this purpose are deleted. Exclusively anonymous results can then be used for quality tests and training without a fixed personal deletion period. Once there is no longer any reference to a person, we can no longer assign an anonymous example to a specific person and therefore cannot subsequently remove it on the basis of their name.

7. Contact, call-back and Starter Pack enquiries

When you contact us or request a call back, we process your name, email address, telephone number, the selected topic or Starter Pack, your message and a conversation summary that you have reviewed. We process further information if you provide it voluntarily. Name, email address and telephone number are required fields in the call-back form; an enquiry through this form is not possible without them. Alternatively, you can contact us by email.

We use the information to handle your enquiry, make the requested call and discuss a possible pilot or offer. The legal basis is Art. 6(1)(b) GDPR for your own pre-contractual or contractual enquiry. For general enquiries or contact persons of a company, the basis is Art. 6(1)(f) GDPR; our interest is handling business communication.

Your enquiry is delivered to us as an email. It is sent through our email infrastructure at STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany; the receiving mailbox is in our Microsoft 365 environment (Microsoft Ireland Operations Limited, see section 8). The service providers receive the information required for this. Further information: STRATO privacy policy.

We delete enquiries that do not lead to a contract no later than twelve months after handling is completed, unless the exceptions in section 10 apply. To avoid duplicate submissions, the website additionally stores an enquiry reference and a checksum of the enquiry for no more than 30 days, not the full content, in this local table.

8. Appointment booking with Microsoft Bookings

For appointment booking we use Microsoft Bookings from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The embedded calendar is initially blocked. It is only loaded, and a connection to Microsoft established, once you consent after the privacy notice shown.

Technical information such as IP address, browser information and the calendar address requested is then transmitted to Microsoft. When you book, Microsoft processes the information in the booking form, in particular name, email address, the selected appointment and voluntary additional information. The booking information is processed in our Microsoft 365 environment; the responsible team members receive the information required for the appointment.

Loading the embed and optional access to your device take place on the basis of your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. The appointment organisation you then request is based on Art. 6(1)(b) GDPR where you are initiating a contract yourself, otherwise on Art. 6(1)(f) GDPR for handling business appointment requests.

You can withdraw the approval in the privacy settings and use our call-back form or email instead. Data already transmitted is not retrieved merely by switching off the calendar. If you open the external booking link, you leave our website and access Microsoft directly. A booking is only confirmed once the process there is completed.

We delete booking data that is no longer needed no later than six months after the appointment; in the event of a cancellation, this period begins with the cancellation. For a business transaction arising from it, the retention rules for that transaction apply. Further information is available in the Microsoft Privacy Statement.

9. Website usage analysis with PostHog Cloud EU

After your consent, we use PostHog for usage analysis. The provider is PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. We use the EU cloud region, with the analytics data stored in Frankfurt am Main, Germany. Section 11 explains possible access from third countries and the safeguards that apply.

We want to understand which pages and functions are used and where visitors abandon processes, in order to improve the website. We record pages viewed, clicks on buttons and links including their labels, the submission of forms without the content entered, and individual usage events such as starting the chat or the website check, times, browser and device information and the referring page. We transmit page addresses without query parameters. Cookies or local browser storage contain a random identifier with which several usage events and returning visits can be linked. This data is pseudonymous; the identifier alone does not make it anonymous. The IP address is processed for the technical transmission; we do not store it as an analytics attribute.

We do not record sessions and do not transmit chat messages, website addresses entered, analysis results or form content to PostHog. Email addresses, telephone numbers and conversation summaries are not linked to analytics identifiers. We have excluded the additional use of the content we transmit by PostHog for its own product and model development.

The legal basis is your consent under Art. 6(1)(a) GDPR and, for optional storage on or access to your device, Section 25(1) TDDDG. PostHog is not loaded and no analytics events are transmitted to it before you consent. The website remains usable without consent. You can withdraw your consent at any time for the future in the privacy settings. We then stop recording and remove the analytics identifiers we have set from your browser. The withdrawal applies to the future. Analytics data already recorded is deleted or anonymised at the latest when the period stated below expires; at your request we delete it earlier, where we can still attribute it to you.

Analytics data that can be related to a person is deleted or fully anonymised no later than six months after it was recorded. Analytics identifiers in the browser remain stored for no more than six months unless you delete them or withdraw consent earlier. Further information is available in the PostHog privacy policy and the PostHog data processing agreement.

10. Storage period and longer retention

The periods stated in the individual sections apply. Your choice for optional functions of the website is stored exclusively in your browser as described in section 3 and discarded there after six months at the latest. Optional functions are technically set up so that they are not loaded without this choice.

Statutory retention obligations can prevent earlier deletion of individual records. For example, we generally keep commercial and business letters that are subject to retention for six years from the end of the relevant calendar year; the legal basis is Art. 6(1)(c) GDPR in conjunction with the relevant commercial and tax law provisions. Where records are needed for specific legal claims, we restrict further processing to this purpose and delete them once it no longer applies. This does not justify a blanket extension for all data of a transaction.

11. Recipients and processing outside the EEA

The website we operate ourselves and our AI run in Germany. The service providers we use are named with the respective functions. Where they act on our instructions, they process data on our behalf. Responsible persons in our company receive data only within the scope of their tasks.

For external cloud services there is no blanket assurance of processing exclusively in Germany. With Microsoft and PostHog, intra-group processing or support access outside the European Economic Area, including in the USA, can take place in particular. Choosing the PostHog EU region does not generally rule out such access either. The safeguards agreed for the respective recipient apply to such transfers: in particular EU standard contractual clauses and, where the specific recipient and transfer are covered, an adequacy decision such as the EU-US Data Privacy Framework. Details are set out in the linked provider information. You can request a copy of the safeguards relevant to our processing through our privacy contact; where necessary, information requiring protection is redacted.

12. Your rights and objection

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time with effect for the future. The lawfulness of processing up to the withdrawal remains unaffected.

Objection where we rely on legitimate interests: Where we base processing on Art. 6(1)(f) GDPR, you can object on grounds relating to your particular situation. We then no longer process the data concerned unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need the data for legal claims. This also applies to the additional processing for anonymisation under section 6 for as long as the data still relates to a person.

Direct marketing: You can object at any time to the processing of your personal data for direct marketing, including any related profiling. You do not need to give reasons. The processing concerned for direct marketing then ends.

Please contact contact@mycistern.com. You can also lodge a complaint with a data protection supervisory authority, in particular at your habitual residence, place of work or the place of the alleged infringement. The authority responsible for our registered office is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany: complaint to the BayLDA.

Using the voluntary services described and providing your information is not required by law. The respective sections explain which information is needed for a particular function and what the consequences of missing information are. Without the information marked as required in the booking form, Microsoft Bookings cannot create an appointment for you.

13. AI results and automated decisions

Vidya and the website check produce automated suggestions and assessments. These do not establish a contract, do not confirm technical suitability and do not replace an individual review. We do not make any solely automated decisions with legal or similarly significant effect for you within the meaning of Art. 22 GDPR on the basis of these website functions.

14. Changes

We adapt this policy when functions, recipients or the processing change. The version published on the website applies. If new processing requires your consent, we obtain it separately; an update of this text does not replace it.