1. Controller
The controller under the General Data Protection Regulation (GDPR) is:
Valente Ventures GmbH
Jahnstr. 62
60318 Frankfurt am Main
Germany
Email: hello@valente.ventures
Phone: +49 (0) 1520 / 8544 838
We have not appointed a data protection officer, as we are not required to (Art. 37 GDPR, § 38 BDSG). Questions about data protection go to hello@valente.ventures.
2. Two roles: controller and processor
qapt.ai holds short conversations with a business's clients, prospects or colleagues on that business's behalf, and returns the answers as a finished record. There are two roles:
- For the website, the onboarding and the accounts of workspace owners, we are the controller. This privacy policy covers that.
- For the content a business collects from its clients or colleagues with qapt (conversations, voice recordings, uploaded documents, records), the business is the controller and we are its processor under Art. 28 GDPR. We process this data only on its instructions.
If you received a link from a business and have questions about your answers, the best first contact is that business. We pass on requests that reach us. Businesses can request a data processing agreement (DPA) at hello@valente.ventures.
3. Where the data is processed
qapt.ai runs entirely on Microsoft Azure. Our contracting party is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, acting as our processor (Microsoft Products and Services Data Protection Addendum). We use:
- Hosting of the application, its database, file storage and server logs in the France Central region (Paris).
- AI models (Azure OpenAI) for the conversation, reading documents and turning speech into text, in the Sweden Central region, deployed in the EU data zone: requests are processed only in data centres in the EU.
- Sending emails (sign-in links and reminders), with data location Europe.
Microsoft states that prompts and responses of the Azure OpenAI models are not used to train models and are not passed to OpenAI. To detect abuse, Microsoft may store prompts and responses for a limited time within the same region; only on suspicion may authorised Microsoft staff look at them.
We use no other service providers. Fonts and all files of the website come from our own server; opening the site sends no request to Google or any other third party.
4. Visiting the website
When you open qapt.ai, the server processes technically necessary data: IP address, time, requested address, browser and operating system. This is used to deliver the page, for security and to prevent abuse, for example to limit how often emails can be requested from one address. For this, the IP address is held in memory only.
Server logs are kept for 30 days. They contain no conversation content and no email addresses.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation.
5. Cookies
qapt.ai only sets cookies that are strictly necessary for the service. These need no consent (§ 25(2) no. 2 TDDDG). There are no analytics, tracking or advertising cookies and no similar techniques.
- A cookie that recognises this browser while an onboarding, or a conversation through a link without sign-in, is under way, so nobody else can continue it. It holds a random identifier and is kept for 7 days.
- A cookie that keeps workspace owners signed in: 30 days, or until they sign out.
6. Onboarding and workspace
In the onboarding, a business describes in a conversation what it wants to collect, and its workspace is created from that. This involves: what is said in the conversation (for example name, role, company, website, email address and, if given, a phone number), voice recordings when the microphone is used, and uploaded documents or templates. When a website address is given, qapt reads the publicly available pages of that website to pre-fill questions.
To sign in, we send a link and a 6-digit code to the email address; both are valid for 10 minutes. With each sign-in we store the IP address and browser identifier to protect the account; these expire with the sign-in after 30 days.
The legal basis is Art. 6(1)(b) GDPR (providing the service and steps before a contract), and for the sign-in protection data Art. 6(1)(f) GDPR.
7. Conversations with a business's clients
When a business shares a link, the person invited answers questions there by typing or by voice input and can upload documents. For this, qapt processes the answers, voice recordings, documents and, where the business has entered them, name and email address, and turns them into a record for the business. If a conversation stalls and an email address is known, qapt sends a reminder after 24 and 72 hours. If the business has set up its own address for the hand-over (webhook), the finished record is sent there.
The answers are kept as long as the record exists, that is until the business deletes the record or its workspace; there is no fixed period. This processing is done on behalf of the business (see section 2); the business determines the legal basis. qapt never asks for religion, health details, passwords or card numbers in a conversation. Bank details, tax identification numbers, social security numbers and passport or ID numbers are entered only in a secure field: they go to qapt encrypted and are stored encrypted, the AI does not read them, and the business sees them masked until it reveals them, which is logged.
Uploaded documents are read by the AI as a whole. Confidential values such as an IBAN or a tax identification number should therefore be entered in the secure field, not sent in a document.
8. Contact by email
When you write to hello@valente.ventures, we process your message and contact details to answer it. The legal basis is Art. 6(1)(b) GDPR where a contract is concerned, otherwise Art. 6(1)(f) GDPR. We delete the message once it is dealt with and no retention duty applies.
9. Consent
Where we ask for consent, the legal basis is Art. 6(1)(a) GDPR; consent can be withdrawn at any time with effect for the future (Art. 7(3) GDPR). At present qapt.ai asks for no consent, because nothing is processed that would require it. The browser only allows the microphone when asked, and voice input is optional.
10. How long data is kept
- An onboarding left unfinished without sign-in: 7 days, with all its files.
- A finished onboarding whose workspace was never taken over by signing in, or was marked “This was not me”: 30 days.
- Voice recordings: deleted automatically after 22 days, gone for good after 30 days at the latest. The text of the answer stays in the conversation.
- Workspace, conversations, documents and records, including the answers of a business's clients: as long as the record exists, until the business deletes it or the whole workspace. There is no fixed period. Deleting the workspace removes every conversation, record, file and the account.
- Deleted files can be recovered for 7 more days (protection against accidental deletion) and are then gone for good. This also applies to a voice recording that contained a confidential value such as an IBAN or a tax identification number: it is deleted at once and gone for good after 7 days at the latest. Should that deletion fail even after several attempts, the automatic deletion of all voice recordings removes it after 30 days at the latest.
- Database backups: 7 days.
- Server logs: 30 days. Sign-in link and code: 10 minutes. Sign-in: 30 days.
Statutory retention duties, for example for invoices, remain unaffected.
11. Transfers outside the EU
No transfer to countries outside the EU is planned. All Azure services we use run in regions in the EU. With the EU Data Boundary, Microsoft commits to storing and processing customer data of these services in the EU; Microsoft lists narrow exceptions, for example for security and support. Where data reaches the USA in such a case, Microsoft is certified under the EU-U.S. Data Privacy Framework, and the Data Protection Addendum includes the European Commission's standard contractual clauses.
12. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Consent can be withdrawn at any time.
A message to hello@valente.ventures is enough. If the request concerns a conversation a business held with qapt, we pass it on to that business and help it answer.
There is no automated individual decision-making under Art. 22 GDPR. The AI asks questions and sorts answers; what happens with the record is decided by the business.
13. Complaints to a supervisory authority
You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information)
Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany
Postfach 31 63, 65021 Wiesbaden
Phone +49 611 1408-0
datenschutz.hessen.de
14. Security
Connections are encrypted (TLS). The database cannot be reached from the internet, files are kept in private storage, and keys are kept in a separate, protected key store. Every query in a workspace checks that the data belongs to the signed-in workspace.
15. Changes
We update this policy when the service or the law changes. The version published here applies.
