# Privacy notice > How inteliwert.com handles personal data: logs, search, accounts, your library, AI processing, payments, analytics after your cookie choice, your rights. What Inteliwert processes about you on its website, in the dashboard and through its API, why it does, and the rights you have under the GDPR. *Last updated: 3 November 2026* ## Who is responsible Bandpey GmbH is the controller for the processing described in this notice. Bandpey GmbH, Gmunder Str. 20b, 81379 Munich, Germany Email: [hello@inteliwert.com](mailto:hello@inteliwert.com). Telephone: [+49 89 20071543](tel:+498920071543). Send questions about this notice, and requests to use your rights, to that email address. You can write in English or German. ## The short version - Search, the opportunity pages, the read API and the MCP server need no account. To deliver them, our hosting provider, Cloudflare, processes technical data about each request, such as your IP address. - If you create an account, we store your email address encrypted. There is no password: you sign in with an email link or code, or with Google, Microsoft or LinkedIn. - What you put into your library in the dashboard stays private to your workspace. We process it only to provide the library to you, and we never use it to train AI models. - The AI features run on AI models of Cloudflare Workers AI. We send them only what a task needs, and the logs of these requests hold no content. - Payments run through Stripe. We never receive your card or bank details. - Until you choose “Accept all” or “Accept essentials” in the cookie banner, the banner covers the page and nothing from Google or Microsoft loads. With either choice, the website loads Google Analytics and Microsoft Clarity and they set their cookies; never in the dashboard. You can change your choice any time under “Cookie settings” in the footer. - Company profiles show company data from public sources only. Sole traders and other natural persons get no profile. - We do not sell personal data. To use your rights, write to us. ## What this notice covers This notice covers the website inteliwert.com, the dashboard at dashboard.inteliwert.com, the read API and the MCP server at api.inteliwert.com, and the emails we send. It does not cover the websites we link to, the sign-in pages of Google, Microsoft or LinkedIn, Stripe’s payment pages, or the assistant you use with Inteliwert. Each has its own privacy policy. ## How we handle data We process personal data only where the law allows it: to provide the service you use, to meet a legal duty, where our legitimate interests are not overridden by yours, or with your consent. Each section below names what we process, why, on which legal basis and for how long. We collect what the service needs and no more. Our usage records, telemetry and error reports hold ids and counts, never your search words or the content of your library. We store account data, the libraries and our databases in Cloudflare’s European Union jurisdiction. Pages and interfaces are served over HTTPS only, so what your browser and our servers exchange is encrypted in transit. We store email addresses encrypted, and sign-in links, codes, sessions and access keys only as one-way hashes. Each workspace’s library is kept apart from every other. No system is completely secure, so please tell us if you think personal data about you has been exposed. ## Visiting this website: server logs When you open a page of the website or the dashboard, or a program calls our API, the request goes to the servers of our hosting provider, Cloudflare. To answer it, and to keep the service secure, the provider processes technical data about the request: - your IP address - the date and time of the request - the address of the page or file requested - the response status and the amount of data transferred - the page you came from, if your browser sends it - your browser and operating system, as your browser reports them We process this data to deliver the service, keep it secure, and find and fix errors. The legal basis is our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR). The service cannot be delivered without it. Our hosting provider processes the data on our behalf. We do not use the logs to identify visitors, and we do not combine them with other data. The provider keeps them only as long as needed for the purposes above. The provider may process data on servers in several countries, including outside the European Economic Area, as described under “Who receives data”. Downloading a file from the [press kit](https://inteliwert.com/press-kit), such as a logo, is an ordinary request and appears in the server logs like any other. ## Searching and opportunity pages When you search or open an opportunity page, the words you type and the filters you choose are part of the page address. Our hosting provider’s servers pass them to our read API to find the matching notices, and the answer is a page or, for an assistant, data. The request appears in the server logs described above. To keep the service available for everyone, the read API counts requests per IP address over a short window and refuses requests above the limit for a while. It does not use the IP address for anything else, and we do not combine searches with other data or build a profile of you. The legal basis is our legitimate interest in answering your search and keeping the service secure and working (Art. 6(1)(f) GDPR). Every page loads a small script from this website that offers read-only tools to an assistant built into your browser, if your browser has one. It does nothing until that assistant uses it, and it only requests pages of this website. AI assistants can query the same public notices through our MCP server at api.inteliwert.com/mcp. It needs no account. A request carries what the assistant sends: search words, filters or an opportunity number. To keep the service available, the server counts tool calls per IP address over a short window, as the read API does, and keeps a daily count of all anonymous calls; that count stores the time and the tool's name, never the IP address or the request. The legal basis is the same as for searching (Art. 6(1)(f) GDPR). What the assistant's provider does with the answers is governed by that provider's own privacy policy. ## Company profiles The website shows public profiles of companies and public bodies that appear in public procurement notices. A profile is built from public sources only: the notices themselves, the open-data registers GLEIF and Wikidata, and the company’s own website where its Impressum confirms that the website belongs to the company. Our crawler fetches such a website under the rules on the [InteliwertBot page](https://inteliwert.com/bot). Profiles contain company data only: name, legal form, seat, identifiers such as the VAT ID or the register entry, awards from notices, certifications the company names, and its website. Sole traders, other natural persons and organisations whose legal form is unclear get no profile. Profiles name no people. Where a profile links a LinkedIn page, we found it through LinkedIn’s official interface and checked that the page names the same website. We store only the page’s identifier and when we checked it. Company data can still relate to a person, for example where a company name contains a person’s name. The legal basis is our legitimate interest, and that of the public, in transparency about who takes part in public procurement and in making smaller suppliers visible (Art. 6(1)(f) GDPR). To object, to have a profile corrected or removed, or to ask that a company never be tagged on LinkedIn, email [hello@inteliwert.com](mailto:hello@inteliwert.com). We normally answer within one month. ## Your account and sign-in Search needs no account. You need one for the dashboard at dashboard.inteliwert.com and for the plans. When you sign up, we create your account and a workspace in which you are the owner, on the free plan. **What we process.** Your email address; how you sign in; the identifier of your account at your sign-in provider, if you use one; your workspace, your role in it (owner, admin or member) and its plan; when you signed up and your sessions; and records of what your account uses. We store your email address encrypted and look it up by a keyed hash; it is never stored or logged in plain text. There is no password. **Signing in.** With an email link, we send a link that works once, for 15 minutes. With Google, Microsoft or LinkedIn, you sign in on the provider’s page, and the provider tells us your email address and an identifier of your account there, which we store only as a keyed hash; we receive no password. The first time, we may send a code or a link to the address to confirm it: a code works for 10 minutes, a link for 15. We store links and codes only as hashes. The provider processes your sign-in under its own privacy policy. **Bot protection.** The sign-in pages use Cloudflare Turnstile to tell people from automated programs. It runs in your browser and sends Cloudflare technical data about your browser and how the page is used; we receive only the result of the check. **Staying signed in.** When you sign in, we set a session cookie (see “What your browser stores”). It holds a random value, of which we store only a hash. It lasts 30 days or until you sign out. The website and the dashboard each set their own. **Emails.** We send sign-in links and codes from signin@notify.inteliwert.com through Cloudflare Email Service. They contain no tracking pixels and no tracked links. We send no newsletters or advertising. **Usage records.** For each operation that counts against your plan, such as an AI action, we record the time, the operation, the credits it used and the ids of your account and workspace. We use these records to apply your plan’s limits, to show your usage and to settle payments. **Purpose and legal basis.** We process this data to provide your account and the contract for its use (Art. 6(1)(b) GDPR), and to keep accounts and the service secure, for example by limiting sign-in attempts per address and per IP address (Art. 6(1)(f) GDPR; our legitimate interest is a secure service). **How long.** Account data and usage records for as long as your account exists. A session ends after 30 days or when you sign out. To delete your account, write to [hello@inteliwert.com](mailto:hello@inteliwert.com). We then delete your account, your workspace and its library, and keep only what commercial and tax law requires us to keep, without your email address. ## Your library in the dashboard In the dashboard, each workspace has a private library: the files you upload, such as PDFs, office documents, scans and audio recordings; the sources you connect, such as web addresses, news feeds or cloud storage; and your notes and your conversations with the dashboard’s assistant. To make them searchable, we read their text, recognise the text of scans, transcribe recordings with the speakers marked, split the text into passages, and build a search index and a graph of what they mention. Answers to your questions cite the passages they rest on. If a source you connect needs credentials, we store them encrypted with a key of your workspace. If you create an access key in the dashboard, an assistant you give it to can search your library over MCP; we store the key only as a hash. What the assistant’s provider does with the answers is governed by its own privacy policy. **Where.** Each workspace’s library has its own database and file storage, apart from every other workspace, in Cloudflare’s European Union jurisdiction. It is never shown on a public page or in another workspace, and never used to train AI models. **Purpose and legal basis.** We process your library only to provide it to you as you use it (Art. 6(1)(b) GDPR). We look at its content only where you ask us to, for example in a support request, or where the law requires it. You decide what goes into your library. If your files contain personal data of other people, such as names in CVs or references, make sure you are allowed to use it for this purpose; we process it only on your instructions, to provide the library. **How long.** Until you delete it. You can delete files and whole libraries at any time; when you delete a library, we delete its files, its database and everything we derived from them. When we delete your account at your request, we delete your workspace’s library. ## AI processing The AI features of the dashboard use AI models that Cloudflare provides through Workers AI: answering questions about your library with citations, recognising the text of scans, transcribing recordings, and building the search index and the graph. Each request goes through Cloudflare’s AI Gateway. **What is sent.** Only what the task needs: your question with the passages of your library it draws on, the page images of a scan, a recording, or text to be indexed. The result comes back to your workspace and is stored there, for example in your conversation. **Logs.** The gateway keeps a log entry for each request with its time, the model, its size and its cost, but not its content: we send every request with the setting that leaves the content out of the log, and these requests are not cached. A request to transcribe a recording opts out of the model maker’s improvement programme. Our usage records note each request’s cost in credits, with numbers only. **No training.** We do not use your content, your questions or the answers to train AI models. **Purpose and legal basis.** To provide the AI features you use (Art. 6(1)(b) GDPR). Cloudflare processes these requests on our behalf. Workers AI runs in Cloudflare’s data centres, which may be outside the European Economic Area, as described under “Who receives data”. ## Plans and payment Paid plans are bought and managed through Stripe: checkout, the billing portal, payment methods, invoices and receipts are Stripe’s pages and emails. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. **What Stripe processes.** What you enter at Stripe: your name, email address, billing address and VAT ID, and your payment details, such as your card or bank account. Your payment details go straight to Stripe; we never receive them. **What we store.** Stripe’s ids for your workspace as a customer and for its subscriptions, the plan, the billing interval, the number of seats, the subscription’s state and period, the credits it grants, and the ids, types and times of Stripe’s payment events. We send Stripe your workspace’s id, so that a payment reaches the right workspace. **Purpose and legal basis.** To sell and run your plan and to grant its credits (Art. 6(1)(b) GDPR), and to keep the records commercial and tax law require (Art. 6(1)(c) GDPR with section 147 of the German Fiscal Code, AO, and section 257 of the German Commercial Code, HGB). Stripe processes payment data as our payment service provider; for its own legal duties, such as preventing fraud and money laundering, Stripe is responsible itself, under its privacy policy ([stripe.com/privacy](https://stripe.com/privacy)). **How long.** Subscription records for as long as the subscription runs, then for as long as commercial and tax law requires, generally up to ten years. Stripe keeps payment data under its own rules. Stripe may process data in the United States, as described under “Who receives data”. ## Website analytics When you choose “Accept all” or “Accept essentials” in our cookie banner, or on the cookie settings page, we use Google Analytics 4 and Microsoft Clarity on the pages of this website to understand how visitors use it and to improve it. Both choices switch them on. They never run in the dashboard, on the account pages, in the API or in our emails. Until you choose, the banner covers the page and neither service is loaded: no request goes to Google or Microsoft and none of their cookies is set. Google Analytics 4 is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It records pages viewed, referrer, approximate location, device and browser data and interactions such as scrolling, outbound clicks and form submissions. Google states that Google Analytics 4 does not log or store IP addresses of users in the EU. We keep Google Analytics event data for 14 months. Google signals and ad personalisation are switched off. Once analytics run, the search words you enter are part of the page address and are therefore sent to Google Analytics. Clicks on an email link are counted as an event, without the address or the message. Microsoft Clarity is provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. It records clicks, scrolling, mouse movement, page and device information to produce heatmaps and session replays. Session replay reconstructs your interaction with the page; text you type into forms is masked and not sent. Clarity keeps replays for 30 days and heatmap and aggregate data for 9 months. We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement ([privacy.microsoft.com/privacystatement](https://www.microsoft.com/privacy/privacystatement)). We have connected our Microsoft Clarity and Google Analytics accounts so that Clarity can show Google Analytics reporting figures next to its heatmaps and replays. Clarity retrieves this aggregated reporting data from Google; replays are not sent to Google. Legal basis: your choice in the cookie banner, Art. 6(1)(a) GDPR; storing and reading information on your device is based on section 25(1) TDDDG. You can change your choice at any time under “Cookie settings” in the footer. Google LLC and Microsoft Corporation may process data in the USA. Both are certified under the EU-U.S. Data Privacy Framework; we also rely on the providers’ data processing terms, which include the EU Standard Contractual Clauses. Google’s privacy policy: [policies.google.com/privacy](https://policies.google.com/privacy). ## What your browser stores Before you choose in the cookie banner, the website sets no cookies, except the sign-in cookies below when you sign in. It uses your browser’s local storage for the two entries of the website marked “strictly necessary” below. They stay on your device: the website’s own pages read them, and they are never sent to us or to anyone else. You can delete them at any time in your browser’s settings, and the website works without them; without the banner choice, the banner asks again. - **inteliwert-theme-mode (local storage)**: This website. Your colour-mode choice: light, dark or system. Set when you use the colour-mode switch, read on every page load. Kept until you delete it. Strictly necessary; the entry does not identify you. - **inteliwert-cookie-consent (local storage)**: This website. Your banner choice (all or essentials) and when you made it. 12 months, then the banner asks again. Strictly necessary. - **__Host-iwrt_session (cookie)**: This website and the dashboard, each its own. Keeps you signed in: a random value, of which we store only a hash. Set when you sign in; 30 days, or until you sign out. Strictly necessary. - **__Host-iwrt_oauth (cookie)**: This website and the dashboard. Set when you sign in with Google, Microsoft or LinkedIn, to match the provider’s answer to your sign-in; encrypted. 10 minutes. Strictly necessary. - **__Host-iwrt_pending (cookie)**: This website and the dashboard. Set while you confirm your email address after signing in with a provider. 30 minutes. Strictly necessary. - **Dashboard entries (local storage)**: The dashboard. Your settings and work in progress, such as the library you last opened and a message you have not sent yet. They stay on your device until you delete them. Strictly necessary. - **_ga**: Google, first-party cookie. Distinguishes visitors. 2 years. Analytics, set after your cookie choice. - **_ga_KDZT0C0F7L**: Google, first-party cookie. Keeps session state. 2 years. Analytics, set after your cookie choice. - **_clck**: Microsoft Clarity, first-party cookie. Clarity user ID and preferences. 1 year. Analytics, set after your cookie choice. - **_clsk**: Microsoft Clarity, first-party cookie. Joins page views into one session replay. 1 day. Analytics, set after your cookie choice. - **CLID, MUID, MR, SM, ANONCHK**: Microsoft, third-party cookies (clarity.ms, bing.com). Recognise the browser across Microsoft services. Up to 1 year. Analytics, set after your cookie choice. We store the strictly necessary entries because you ask for them, by signing in or by using the colour-mode switch, the banner or the dashboard. Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG) allows this without consent, because the storage is strictly necessary to provide a function you have expressly requested. The analytics cookies are set after your choice in the cookie banner (section 25(1) TDDDG), as described in the section on website analytics. ## Emails you send us The email links on this website, such as those on the [contact page](https://inteliwert.com/contact), open your own email app with a prefilled message. Nothing is sent to us until you send it. If you email us, we process your email address, your name if you give it, the content of your message and the date and time. We use it to answer you, to let you know when a feature opens if you ask us to, to handle support requests, requests about your rights and security reports, and to keep a record of our correspondence. The legal basis is Art. 6(1)(b) GDPR where you ask about a contract or steps before one, and otherwise our legitimate interest in answering the people who write to us (Art. 6(1)(f) GDPR). Writing to us is voluntary. We keep a message for as long as we need it to deal with your request, and longer where the law requires us to keep business correspondence, which is generally six years under German commercial and tax law. Then we delete it. Our mailbox is hosted by Google Workspace, which processes messages on our behalf. Email is not encrypted from end to end by default. Please do not send credentials, keys or customer data. ## Links to other websites This website links to other websites: - the profiles of Bandpey GmbH on LinkedIn, GitHub, X and YouTube, and [bandpey.com](https://bandpey.com) - official publication sources, such as TED, the Bekanntmachungsservice (oeffentlichevergabe.de) and the EU Funding & Tenders Portal, for example on the [coverage page](https://inteliwert.com/coverage) - the websites, LinkedIn pages and GLEIF records named on company profiles A link takes you to a site with its own privacy notice. Pages here load nothing from those sites until you follow a link. Once you do, the operator of that site is responsible for what it processes. ## Who receives data We use service providers that process personal data on our behalf and only on our instructions, under data processing terms as Art. 28 GDPR requires: - Cloudflare, our hosting provider: the website, the dashboard and the API; our databases (D1) and file storage (R2); the dashboard’s engine (Containers and Durable Objects); AI models (Workers AI) and their gateway (AI Gateway); bot protection (Turnstile); our emails (Email Service); caching and rate limiting. - Stripe, for payments, invoices and the billing portal, as described under “Plans and payment”. - Google (Google Ireland Limited), for our mailbox (Google Workspace) and, after your choice in the cookie banner, for Google Analytics on the website. - Microsoft (Microsoft Ireland Operations Limited), after your choice in the cookie banner, for Microsoft Clarity on the website. When you sign in with Google, Microsoft or LinkedIn, that provider handles your sign-in as a controller in its own right, under its own privacy policy. Where a provider processes data outside the European Economic Area, we rely on an adequacy decision of the European Commission where one covers the transfer (for the United States, the EU-US Data Privacy Framework, for providers certified under it), and otherwise on the EU standard contractual clauses in the provider’s data processing terms. Cloudflare answers each request in a data centre near you, which may be outside the European Economic Area; the databases and file storage in which we keep data stay in its European Union jurisdiction. The counts we keep for running the service, such as response times and cache hits, contain no personal data. We pass data to authorities or advisers only where the law requires it or where we need it to establish, exercise or defend legal claims. We do not sell personal data and we do not share it for advertising. ## How long we keep data We keep personal data only for as long as we need it for the purpose we collected it for; each section above says how long that is. Where the law requires us to keep data longer, in particular records of payments and invoices under commercial and tax law (generally up to ten years) and business correspondence (generally six years), we keep it only to meet that duty. If you ask us to delete data that we must keep, we delete everything else and restrict the processing of what remains to that duty until its period ends; then we delete it. ## Your rights Under the GDPR you have the right to: - access your personal data and information about its processing (Art. 15 GDPR) - have inaccurate data corrected and incomplete data completed (Art. 16 GDPR) - have data erased where the legal requirements are met (Art. 17 GDPR) - restrict processing in the cases the law provides (Art. 18 GDPR) - be told which recipients we informed of a correction, erasure or restriction (Art. 19 GDPR) - receive data you gave us in a portable format, where this applies (Art. 20 GDPR) - object, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 21 GDPR) > **Your right to object (Art. 21 GDPR).** Where we process data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time, on grounds relating to your particular situation. We then stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. Where we process data on the basis of your consent, such as your choice in the cookie banner, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR), under “Cookie settings” or by writing to us. You can also block or delete cookies in your browser’s settings. We make no decisions based solely on automated processing, and we do not use analytics to identify individual visitors. To use a right, including to get a copy of your account data or to delete your account, email [hello@inteliwert.com](mailto:hello@inteliwert.com). We may ask for proof of identity, and we normally answer within one month. You also have the right to complain to a data protection supervisory authority. For Bandpey GmbH that is the [Bavarian State Office for Data Protection Supervision (BayLDA)](https://www.lda.bayern.de). You can also contact the authority where you live or work. ## Changes and contact We update this notice when the service or the law changes, and before the service processes data in a way this notice does not describe. The date at the top shows the latest version. Questions: [hello@inteliwert.com](mailto:hello@inteliwert.com), or by post to Bandpey GmbH, Gmunder Str. 20b, 81379 Munich, Germany. Please mark postal inquiries “Privacy”. --- Page: https://inteliwert.com/legal/privacy Inteliwert is a product of Bandpey GmbH, an international data and AI software company in Munich, Germany, founded and led by Roozbeh Bandpey. Bandpey's products: Facthory, Emolysis, Copolly and Inteliwert. Inteliwert on LinkedIn: https://www.linkedin.com/company/intelliwert, GitHub: https://github.com/inteliwertai.