Privacy policy

Compoundio Technology Holding GmbH respects your privacy. This Privacy Policy explains how we process personal data when you visit compoundio.co, contact us or use Compoundio Technology Cloud.

1. Controller

The controller responsible for the processing described in this Privacy Policy is:

Compoundio Technology Holding GmbH
Distlerstr. 18
70184 Stuttgart
Germany
Commercial Register: Amtsgericht Stuttgart, HRB 795131
VAT identification number: DE 369520248
Email: info@compoundio.co
Telephone: +49 (0)176 31266319

2. Personal data we process

2.1 Website

When you visit our website, our systems and service providers may process technical data needed to deliver and secure it. This can include your IP address, the date and time of access, requested pages or files, the referring website, browser, operating system, language, general device information and technical error or security information.

2.2 Contact enquiries

If you contact us by email, telephone or contact form, we may process your name, contact details, company information, message content and any information or documents you choose to provide. We use this information to respond to your enquiry and manage related business discussions.

2.3 Compoundio Technology Cloud

Compoundio Technology Cloud is an optional, read-only informational and venture-matching application made available through supported ChatGPT experiences and connected to Compoundio’s MCP service.

When the application is used, Compoundio’s MCP service may receive the information sent to the relevant tool. This may include your business goal, company stage, selected priority or desired result, selected Compoundio venture and optional text needed to provide the requested result.

The application does not require your name, email address or telephone number. Please do not submit passwords, payment information, confidential information, trade secrets, special-category personal data or other information that is unnecessary for the requested result.

Compoundio does not create a separate user account for the application and does not persist prompts or matching results in a separate application database. The application is configured not to write raw prompt text to ordinary application logs.

Limited operational logs may contain a request identifier, time of request, network or IP information, tool name, request status, duration and technical error information. These logs are used only for security, reliability, rate limiting and troubleshooting.

The MCP service is hosted on Google Cloud Run. When you access the application through ChatGPT, OpenAI also processes your ChatGPT conversation under its own applicable terms, privacy notice and account or workspace settings. Compoundio does not control OpenAI’s processing or retention of the ChatGPT conversation.

2.4 Cookies and similar technologies

The website uses necessary cookies and may use optional analytics or marketing technologies. Where consent is required, optional technologies are used only after you have consented. You can change or withdraw your choice through the website’s cookie settings. Further information is available in our Cookie Policy.

3. Purposes and legal bases

We process technical data to operate, secure and troubleshoot the website and application under Article 6(1)(f) GDPR. Our legitimate interests are providing secure and reliable services, preventing misuse and resolving technical problems.

We process contact enquiries and requested business discussions under Article 6(1)(b) GDPR where this is necessary to take steps at your request before entering into a contract. Otherwise, ordinary business communication is processed under Article 6(1)(f) GDPR.

We provide requested application results under Article 6(1)(f) GDPR based on our legitimate interest in providing the informational service requested by the user. Related business communications are processed under Article 6(1)(f) GDPR where legally permitted, or under Article 6(1)(a) GDPR where consent is required. You may object to direct marketing at any time.

Optional cookies and analytics are processed under Article 6(1)(a) GDPR where consent is required. Consent may be withdrawn at any time without affecting earlier lawful processing.

We may also process personal data under Article 6(1)(c) GDPR to comply with legal obligations and under Article 6(1)(f) GDPR to establish, exercise or defend legal claims. Where we rely on legitimate interests, we consider those interests against the rights and freedoms of the persons concerned.

4. Service providers, recipients and international transfers

We use service providers where necessary to operate our business and services. These may include website hosting, maintenance and security providers; Google Cloud for hosting and operating the MCP service; OpenAI as the provider of ChatGPT; email, communications and contact-form providers; cookie-consent and analytics providers where used; professional advisers such as lawyers, tax advisers and auditors; and courts, authorities or other recipients where disclosure is legally required.

Service providers process personal data according to their role, applicable agreements and legal requirements. We do not sell personal data.

Some providers may process personal data outside the European Economic Area. Where a transfer requires safeguards, we rely on a lawful transfer mechanism, such as an adequacy decision of the European Commission or approved Standard Contractual Clauses. Information about applicable safeguards may be requested at info@compoundio.co.

5. Retention

We retain personal data only for as long as necessary for the relevant purpose or as required by law.

Prompts and matching results are not persisted in a separate Compoundio Technology Cloud application database. Ordinary website and application operational logs are generally retained for up to 30 days. Relevant records may be kept longer where reasonably necessary to investigate a security incident or establish, exercise or defend legal claims.

Enquiries that do not lead to an ongoing business relationship are generally retained for up to 12 months after the last substantive communication. They may be retained longer where discussions continue or where necessary for legal claims.

Data used for direct marketing is retained until you object, withdraw consent or the purpose otherwise ends. A limited suppression record may be retained to respect your objection. Contractual, commercial and tax records are retained for the applicable statutory retention periods. Consent records are retained for as long as reasonably necessary to demonstrate compliance.

When personal data is no longer required, it is deleted, anonymised or restricted unless continued retention is required by law.

6. Whether you must provide data

Technical data is processed automatically when you use the website or application. Providing information through a contact enquiry or application request is otherwise voluntary. If you do not provide information needed to answer an enquiry or generate a requested result, we may be unable to respond or provide that result. There is no general statutory obligation to provide personal data to us.

7. Your rights

Subject to the conditions and limitations of the GDPR, you may have the right to access your personal data, correct inaccurate or incomplete data, request deletion or restriction of processing, and receive certain data in a structured, commonly used and machine-readable format. You may object to processing based on legitimate interests and may object to direct marketing at any time. Where processing is based on consent, you may withdraw that consent at any time. You also have the right to lodge a complaint with a data-protection supervisory authority.

The supervisory authority responsible for Compoundio is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI Baden-Württemberg)
Heilbronner Straße 35
70191 Stuttgart
Germany
www.baden-wuerttemberg.datenschutz.de

To exercise your rights, contact info@compoundio.co. We may request reasonable information needed to verify your identity.

8. Automated matching

Compoundio Technology Cloud may generate informational venture-matching suggestions from the information submitted to it. These suggestions do not produce legal or similarly significant effects and are not used to make decisions about employment, credit, insurance or access to essential services. No automated decision-making within the meaning of Article 22 GDPR takes place.

9. Data security

We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration or misuse. No transmission or storage system can be guaranteed to be completely secure.

10. Changes and contact

We may update this Privacy Policy when our services, providers or legal obligations change. The current version and its update date will be published on this page.

Questions about this Privacy Policy or our processing of personal data may be sent to info@compoundio.co or by post to Compoundio Technology Holding GmbH, Distlerstr. 18, 70184 Stuttgart, Germany. You may also contact us by telephone at +49 (0)176 31266319.