Privacy policy

1. Controller

CertoClav Sterilizer GmbH
Peintner Straße 10, 4060 Leonding, Austria
Commercial register: FN 122912d, Landesgericht Linz
Phone: +43 732 674 278
Email: contact@chatflamingo.com

The contact for data protection is Michael Simon. You can reach him at contact@chatflamingo.com or at the address given above.

A data protection officer within the meaning of Art. 37 GDPR has therefore not been appointed; there is no obligation to do so: our core activity consists neither of regular and systematic monitoring of data subjects on a large scale nor of large-scale processing of special categories of personal data.

2. Principle

We process personal data only in so far as this is necessary to operate this website and to provide our service. Cookies are set for audience measurement and for measuring our Google ads — but only after you have expressly agreed to it. Before your consent nothing is stored and nothing is sent to Google for that purpose; the website works unchanged either way. Details in points 3.3 and 3.4. On top of that there is our own chat, which uses no cookies but does keep entries in your browser so that a conversation does not start over on every page — point 3.5. We use no third-party tracking pixels.

3. Visiting this website

3.1 Hosting and server logs

This website is delivered through the network of Cloudflare, Inc. When you visit it, the operator of the infrastructure processes technically necessary connection data, in particular IP address, date and time, the address requested, the volume of data transferred, the status message and the identifier transmitted by the browser.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of the website.

Cloudflare processes this data as our processor. The basis is the data processing agreement that Cloudflare provides as part of its terms of business and which includes the European Commission's standard contractual clauses.

We do not keep server logs of our own. The connection data arises in Cloudflare's network and is held there only briefly to fend off attacks and to troubleshoot. We do not evaluate it and do not combine it with other data.

3.2 Fonts

The fonts used are served from our own server. No connection is made to an external font provider, in particular not to Google Fonts.

3.3 Audience measurement (Google Analytics) — only with consent

We use Google Analytics 4 to see which pages are read and where visitors come from. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A cookie is stored on your device, and a random identifier, the pages visited, time on page, approximate location at country and city level, device type, browser and the referring address are processed. Google truncates the IP address before storing it; we never receive it.

The data flows into a property of our own that covers this website and nothing else (G-X3QY1REKPS). It is not combined with data from our company's other websites.

This happens solely with your consent — the same prompt as in point 3.4, and the same withdrawal. Without your consent, analytics_storage stands at denied in Google's consent mode and no cookie is set. The legal basis is your consent under § 165(3) TKG 2021 (Austria) and § 25(1) TDDDG (Germany) respectively, and Art. 6(1)(a) GDPR.

We build no profile across other websites. "Google signals", the feature that joins users across devices, is switched off in this property. Event data is retained for two months — the shortest period Google allows. On transfers to the United States, see point 9.

3.4 Ad measurement (Google Ads) — only with consent

We advertise this website through Google Ads. To see which ad leads to a signup, we use Google's conversion tracking. For this, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, stores a cookie on your device and reads the ad click identifier (gclid, gbraid or wbraid) from the address you called up. Processed in this context are that identifier, date and time, the page visited, your IP address and the identifier transmitted by your browser. What we learn from it is only how many signups came from which ad — not who signed up.

This happens solely with your consent. A prompt appears the first time you visit. As long as you have not agreed, Google's consent mode ("Consent Mode v2") stands at denied: no cookie is set and no identifier is transmitted. If you decline, it stays that way permanently.

Your answer is remembered by your browser alone (localStorage, key cf-consent). That entry never leaves your device. It is the consent mechanism itself and is therefore permitted without consent under § 165(3) no. 1 TKG 2021 and § 25(2) TDDDG respectively.

The legal basis for storing and reading information on your device is your consent under § 165(3) TKG 2021 (Austria) and § 25(1) TDDDG (Germany) respectively; for the subsequent processing it is Art. 6(1)(a) GDPR.

Withdrawal: you can withdraw your consent at any time with effect for the future. The Change consent button at the foot of every page is enough. It covers both measurements, the one under point 3.3 and the one under point 3.4. Withdrawal stops them immediately and deletes the cookies set for them (_ga*, _gcl*, _gac*). The lawfulness of the processing carried out up to that point remains unaffected.

In so far as data is collected for this measurement and transmitted to Google, we are joint controllers with Google (Art. 26 GDPR); the basis is the joint controller arrangement that Google incorporates into its Google Ads terms. Google is the sole controller for its own subsequent processing. On transfers to the United States, see point 9.

The essence of that arrangement: obtaining your consent and informing you under Art. 13 GDPR is our job — that is what this page does. Google is answerable for the security of the processing and for data subject rights in respect of the data held by it. Under Art. 26(3) GDPR you may exercise your rights against either of us; if you come to us, we pass your request on to Google.

3.5 Our own chat on this website

ChatFlamingo itself runs on this website — the same widget we sell. It is loaded from cdn.chatflamingo.com and talks to our own instance at cf-n5k368.chatflamingo.com. No processor is involved; we run that instance ourselves.

What is stored on your device: no cookies, but entries in your browser's localStorage, all prefixed certochat-. These are a random session identifier (certochat-session), where your visit came from — referring address and landing page — (certochat-touch), the conversation itself, and whatever you enter in the chat (such as certochat-name and certochat-email). The whole set is discarded after seven days. If your browser does not allow localStorage, the widget falls back to sessionStorage and finally to memory — in which case nothing remains once you close the tab.

What is sent to us: the session identifier, the address of the page you are on, the language, the referring address and the landing page. That is what keeps a conversation together across page changes and tells us what you are reading when you ask a question. If you write in the chat, we also process the content of your messages and whatever you choose to enter.

The legal basis for storing and reading on your device is § 165(3)(2) TKG 2021 and § 25(2)(2) TDDDG respectively: the entries are necessary for the service you called up — the chat — to work at all. The subsequent processing rests on our legitimate interest in working advice on our own website (Art. 6(1)(f) GDPR), or on Art. 6(1)(b) GDPR where your enquiry concerns a contract.

You can avoid the chat entirely: it does not open by itself with your data, and without a message from you we learn nothing about you beyond what is listed above. You can delete the entries at any time through your browser's site data.

4. Getting in touch

If you write to us or call us, we process your details in order to handle the enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry is directed at a contract, otherwise Art. 6(1)(f) GDPR.

We delete enquiries and the associated correspondence twelve months after our final reply. Where the enquiry leads to a contract, the periods in point 10 apply instead.

5. Account and use of the service

For a ChatFlamingo account we process the details you provide when creating it — in particular email address, display name and the address of your website — as well as data that arises during use, such as the number of sign-ins and of AI answers consumed. The legal basis is Art. 6(1)(b) GDPR.

If you arrived through one of our ads, we additionally store the ad click identifier and the origin details from the address you called up (campaign, ad group, search term, device) with the account. This tells us which ad brings new accounts. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in managing our advertising economically. We delete these details no later than 90 days after the signup. You may object to this processing at any time under Art. 21 GDPR.

A free account whose widget has not been loaded for 90 days is shut down after prior notice and the associated data is deleted.

If you book a paid plan, we handle the payment through Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland. Stripe processes your name, your e-mail address, the billing address and the details of the payment method you choose. Which methods are available — card, PayPal, Klarna and others — depends on your country.

We do not see payment data such as card numbers. They are entered directly with Stripe. From Stripe we receive only whether a payment succeeded, which method was used, and the details we need for the invoice and our tax records. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for keeping the invoice data.

If you book ChatFlamingo as an app through the Shopify App Store, billing does not run through Stripe but through Shopify. The amounts then appear on your regular Shopify invoice and are collected by Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland. Shopify decides on its own responsibility which data it processes for this; Shopify's own privacy policy applies. From Shopify we learn which plan is booked for which store and whether the billing is active. Your payment method and your payment data we see no more than we do with Stripe. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for keeping the invoice data.

6. Data of your website visitors

If you use ChatFlamingo on your own website, you are the controller for your visitors' data under data protection law. We process this data exclusively on your behalf and on your instructions. The details are governed by the data processing agreement, which forms part of the contract with us.

Processed on your behalf are, in particular:

• the content of chat messages and the conversation history
• details visitors provide voluntarily, such as name, email address or phone number
• pages visited, time on site, browser and operating system
• approximate location from the IP address — can be switched off in the dashboard
• files and images uploaded by visitors

The conversations are held in a database assigned to your account. You set the retention periods for attachments and whole conversations yourself.

7. Artificial intelligence

Where questions are to be answered automatically, the content of the question, the conversation so far and the matching extract from your knowledge base are transmitted to our language model provider in order to generate the answer.

For this we use language models from Anthropic PBC, San Francisco, USA, and OpenAI Ireland Ltd., Dublin, Ireland. OpenAI also processes via OpenAI, L.L.C. in the USA. Which model answers is set by you in the dashboard.

Both providers are our processors and — in so far as data of your website visitors is affected — sub-processors within the meaning of the data processing agreement. Data processing agreements including the European Commission's standard contractual clauses are in place with both. The legal basis is Art. 6(1)(b) GDPR, and for visitor data your instruction under Art. 28 GDPR.

The transmitted content is not used to train the models. This is excluded in the contracts with both providers. The providers store the content only temporarily for abuse monitoring and delete it afterwards.

Asked directly, the bot points out that it is an AI. This satisfies the transparency obligation under Art. 50 of the AI Regulation (EU) 2024/1689.

8. Recipients and processors

We pass data on only to service providers we have bound as processors under Art. 28 GDPR. These are:

Cloudflare, Inc.	delivery of this website, protection against attacks · San Francisco, USA · DPA with standard contractual clauses
Salesforce, Inc. (Heroku)	operation of the application and the databases · San Francisco, USA, data centre in the EU · DPA with standard contractual clauses
Anthropic PBC	language model for the AI's answers · San Francisco, USA · DPA with standard contractual clauses
OpenAI Ireland Ltd.	language model for the AI's answers · Dublin, Ireland · DPA with standard contractual clauses for processing in the USA
Stripe Payments Europe, Ltd.	payment processing for paid plans · Dublin, Ireland · DPA; processing by Stripe, Inc. in the USA is covered by standard contractual clauses

Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) processes data in two roles: for the audience measurement under point 3.3 as our processor under Art. 28 GDPR (the basis being Google's Analytics data processing terms including the standard contractual clauses), and for the ad measurement under point 3.4 as a joint controller with us under Art. 26 GDPR. In both cases data reaches Google only if you have consented.

Shopify International Limited (The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland) is not in the table, because Shopify is not our processor. Anyone who books the app through the Shopify App Store is in a contractual relationship with Shopify for that; Shopify is a controller in its own right under Art. 4(7) GDPR. This concerns the billing under point 5 only — anyone using ChatFlamingo without the Shopify app has nothing to do with Shopify.

The systems you connect to your chat are not recipients within the meaning of this table. When your bot creates a ticket in your helpdesk, writes a contact into your CRM or answers in WhatsApp Business, Facebook Messenger or Instagram, it does so on your instruction and with your own credentials. You are the controller for this; we process on your behalf. Which providers you use for it — for those three channels Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland — is your own decision, and they belong in your own privacy policy. Our sub-processors remain the ones listed in Annex 2 of the data processing agreement.

We do not currently use external error monitoring. If further service providers are added, we will name them here before they are used.

Beyond that we pass data on only where we are legally obliged to do so or where it is necessary to enforce our rights.

9. Transfers to third countries

Cloudflare, Salesforce, Anthropic, OpenAI and — where consent to the measurement has been given — Google also process data in the United States. The basis for the transfer is the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR. In so far as a recipient is certified under the EU-US Data Privacy Framework, the transfer is additionally based on the Commission's adequacy decision of 10 July 2023 under Art. 45 GDPR.

You can obtain a copy of the standard contractual clauses from us: write to contact@chatflamingo.com and we will send them to you.

In addition, the following have been agreed: encryption in transit and at rest, limiting the transmitted data to what is necessary for the particular answer, and an obligation on the recipient to inform us about official requests for information, in so far as that is legally permitted.

10. Retention periods

Server logs	no storage of our own, see point 3.1
Enquiries by email or phone	12 months after the final reply
Account data	for the term of the contract, then 30 days, then deletion
Ad click identifier and ad origin	90 days after the signup
Ad measurement cookie	lifetime set by Google, 90 days at most; deleted immediately on withdrawal
Audience measurement cookie	up to 2 years; deleted immediately on withdrawal
Our chat's entries in the browser (certochat-*)	7 days, then the chat discards the whole set by itself
Event data in Google Analytics	2 months — the shortest period Google allows
Free account without use	90 days after the widget was last loaded, after prior notice
Conversations of your website visitors	after the period you set in the dashboard; in the free account 60 days at most
Invoices and vouchers	7 years after the end of the calendar year (§ 212 UGB, § 132 BAO)

If a period expires while litigation is pending or threatened, we continue to retain the data concerned on a restricted basis until the matter is resolved.

11. Your rights

Under the GDPR you have the right to

• access to the data concerning you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• withdraw consent given, with effect for the future (Art. 7(3))

To exercise them, write to contact@chatflamingo.com.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

12. Obligation to provide data

The details requested are necessary to conclude a contract and to create an account. Without them we cannot provide the service.

13. No automated individual decision-making

Automated decision-making with legal effect within the meaning of Art. 22 GDPR does not take place. The bot's answers are information, not decisions about people.

14. Changes

Version of this policy: 26 September 2026. We adapt it when the processing changes.