Privacy Policy

This is a convenience translation. In case of any discrepancy, the German version at solarisagents.com/datenschutz prevails.

This policy explains how personal data is processed on solarisagents.com and konfig.solarisagents.com, in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Controller

Solaris Agent e.U.: Lilienfelder Straße 54/2/1, 3150 Wilhelmsburg, Austria; Email: office@solarisagents.com

2. Hosting, server logs and audience measurement

This website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). When you access the site, Vercel processes technically necessary server log data (IP address, timestamp, requested resource, user agent) in order to deliver and secure the site. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning web presence).

Place of processing: Server-side processing (page rendering, sign-in, form and chat requests) takes place in the European Union — data centre Dublin, Ireland, right next to our database, which is also operated in Ireland. Vercel Inc. is nevertheless a US company as the provider, so access from the USA (for example during support or maintenance) cannot be ruled out. For that case, transfers are safeguarded under the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses.

All fonts, videos and other assets on this website are served from our own servers. Simply visiting the website triggers no requests to third parties — no external CDNs, no Google Fonts, no advertising networks and no cross-site tracking.

Audience measurement: On our public pages we use Vercel Web Analytics to count how often each page is opened, how many visitors start the price configurator and reach its result, and how many send a request – in the configurator or via the AI-check form (plain counters, not linked to you). The service comes from the same provider that hosts this website and is served from our own address, so no request goes to an external server. No cookies are set, and no data is stored on or read from your device. Recorded per page view are: timestamp, the address opened, the referring page, filtered address parameters, approximate origin (country, region, city), operating system, browser and device type. Repeat views are grouped by a check value computed from the request, which expires after 24 hours; your IP address is neither stored nor linked to these figures. We only ever see aggregated reports and cannot identify an individual person from them — nor follow anyone across websites. No audience measurement takes place in the signed-in client and partner area. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing which content is in demand). You may object to the measurement at any time — a message to the address given above is sufficient; common content blockers also prevent it.

3. Contact form

If you use our contact form, we process your name, email address, optionally your phone number and the content of your message in order to handle your enquiry and any follow-up questions. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures). The data is stored in our database (section 8); the owner is notified by email (email delivery provider Resend) and, for urgent enquiries, additionally by a short messenger notification — that message contains no personal data, only an internal reference ID. To prevent abuse, your IP address is processed by a rate-limiting counter for a maximum of 60 seconds (Art. 6(1)(f) GDPR).

Marketing consent (optional): Below the form — including on the “AI check” page — you can separately allow us to contact you about AI assistants, chatbots and automation by phone and email. This consent is not a condition for handling your enquiry. It only takes effect once you click the confirmation link in the email we send for that purpose and then confirm with a second click on the button on the page that opens (double opt-in). Opening the link alone does not count, because mail scanners often open links in advance. Until then we keep your details in a queue for at most 7 days and delete them afterwards. On confirmation we store, as evidence, the wording of the consent, the time, the chosen channels, the browser type and a non-reversible check value of your IP address (Art. 6(1)(a) GDPR; § 174 of the Austrian Telecommunications Act 2021). You may withdraw at any time by an informal message to the address above — the withdrawal is documented as well.

Source tag: If you reach us via an ad or a post, the link carries a short campaign tag (e.g. “meta-ki-check-09”). It is stored with your submission so we know which channel brought the enquiry. Nothing is stored on or read from your device, and no data flows back to advertising networks (Art. 6(1)(f) GDPR).

4. Price configurator

In the configurator we process the services and details you select together with your email address in order to produce and send your non-binding quote (Art. 6(1)(b) GDPR). The enquiry is stored in our database; the internal notification about it is sent by email via Resend (see section 8).

4a. Förder-Check for Claude (MCP server)

At konfig.solarisagents.com/api/mcp we operate “Förder-Check Österreich”, a connector that users of Claude (Anthropic) can add themselves. It processes only the three details of a request: federal state, type of project and, optionally, the project budget. These are fixed values or a number and are not personal data; the server receives no names, contact details or conversation content from Claude. There is no sign-in, there are no cookies, and inputs are not stored.

We use the IP address of the calling system only as the key for rate limiting (a counter at our abuse-protection provider, kept for at most 60 seconds, see section 8); for requests from Claude this is usually an Anthropic address. Section 2 applies to server log data. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable service protected against abuse). How Anthropic processes your conversation in Claude is governed by Anthropic’s privacy policy.

5. AI chatbot

An AI chatbot is available on our website. In accordance with Art. 50 of the EU AI Act it is clearly labelled as an AI — you are not communicating with a human being.

Processing: your chat messages are transmitted to our processor Anthropic (Claude language model, USA) to generate responses; for searching our knowledge base, queries are additionally processed as mathematical text representations (embeddings) by OpenAI (USA).
Storage: chat histories are stored in our database together with a randomly generated conversation ID in order to ensure service quality, detect abuse and — if you request contact — pass your enquiry to the owner. Stored histories are deleted automatically after 12 months. The history is additionally kept in your browser's localStorage so that it survives a page reload. We only access it once you open the chat window — if you never use the chat, we do not touch your device. Locally stored histories are discarded after 30 days; you can also delete them yourself at any time.
No model training, but not without storage: according to Anthropic and OpenAI, data from commercial API use is not used to train their models. That is not the same as “not stored”: both providers retain content for a limited period for abuse monitoring. The 12-month period above applies to our own database only.
Handover of contact details: only if you actively provide your contact details in the chat and request to be contacted will an enquiry with a summary of your request be passed to the owner or one of our independent sales partners (section 7; processing as in section 3).
Please do not enter sensitive data (Art. 9 GDPR) in the chat.

Legal basis: Art. 6(1)(f) GDPR (providing an advisory service), or Art. 6(1)(b) GDPR where you request to be contacted.

6. Client and partner area

For the protected area (login) we process the email address, password (stored solely as a cryptographic hash, never in plain text) and roles assigned to our clients and sales partners (Art. 6(1)(b) GDPR). Sign-in uses technically necessary session cookies. New accounts are set up by invitation: you receive a single-use link by email (delivery service Resend, section 8) and choose your password yourself — we never know it.

6a. Appointments and calls

If you arrange an appointment with us, we store the time, the type of appointment (call, on-site meeting, video call or follow-up), a short note on the occasion, and the link to your enquiry (Art. 6(1)(b) GDPR). This information is held solely in our own database (section 8); it is not transferred to any external calendar service.

Reminder the day before (optional): If you agree during our conversation, we remind you of the appointment by email the day before. For this we store, with the appointment, the time of your consent and the time the reminder was sent; it is delivered via the email service Resend (section 8). The legal basis is your consent (Art. 6(1)(a) GDPR). Without your consent there is no reminder. You can withdraw it at any time, informally, to the address given above; no reminder is sent to addresses on our block list.

For video calls we operate no service of our own. You receive the access link with the appointment confirmation, and it states which provider handles the call technically. We have no influence over that provider's processing — by joining, you decide whether to use it. A phone call or an in-person meeting is always available as an alternative.

7. Disclosure to sales partners

Enquiries may be passed to one of our independent sales partners for the purpose of preparing a quote. The partner receives the details you provided (name, contact details, requested services or your enquiry) and uses them solely to handle your request and prepare a quote for you. Legal basis: Art. 6(1)(b) GDPR. You can object to this disclosure at any time — write to the address above and we will handle your enquiry ourselves.

8. Processors and third-country transfers

Vercel Inc. — hosting and audience measurement (section 2); provider USA, processing in the EU (Dublin, Ireland).
Supabase — database and authentication; data located in the EU (AWS Ireland).
Anthropic — AI language model for the chatbot and the replies on Instagram (USA).
OpenAI — text embeddings for knowledge search, speech recognition for the dictation function and speech synthesis for the read-aloud function in our internal sales tool (USA). Nothing is stored for speech synthesis: the text goes out, the audio comes back.
Resend — delivery of emails: internal notifications, confirmations, invitations to the partner area and appointment reminders (USA).
Upstash — technical abuse protection (rate limiting; IP counters stored for a maximum of 60 seconds or 1 hour) and a technical cache for searching our knowledge base: for short questions put to the chatbot, the mathematical text representation (embedding) is stored for 7 days so that the same question does not have to be computed again. What is stored is a hash of the question as the key and that sequence of numbers, not the question text itself; questions containing email addresses or longer sequences of digits are excluded.
Telegram — internal signalling channel for urgent enquiries; receives no personal data, only an internal reference ID.

Data processing agreements are in place with these providers where required. Transfers to third countries (e.g. the USA) are safeguarded under the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses.

9. Cookies and local storage

We use no tracking, analytics or marketing cookies. We use only: (a) technically necessary session cookies for signing in to the client and partner area, and (b) localStorage for the chatbot history (section 5). Both are required for the respective function (§ 165(3) Austrian Telecommunications Act 2021; Art. 6(1)(f) GDPR) — a cookie banner is therefore not required. We only access localStorage once you open the chat window: if you never open the chat, nothing is written to or read from your device.

The audience measurement described in section 2 likewise works without cookies and without storing anything on your device. Because no information is placed on or read from your terminal equipment, the consent requirement of § 165(3) Austrian Telecommunications Act 2021 does not apply.

10. Retention periods

Enquiries and lead data are stored for the duration of processing and thereafter for any applicable statutory retention period (in particular § 132 of the Austrian Federal Fiscal Code: 7 years for business records). Chat histories are deleted automatically after 12 months, rate limit counters after a maximum of 60 seconds or 1 hour, embeddings in the cache after 7 days. Account data is retained for the duration of the business relationship. Researched company data (section 10a) from which no business contact has arisen is deleted automatically 24 months after the research, together with the contact persons researched for it.

10a. Researched business contact data

For business development we additionally collect business contact data from publicly accessible sources — the Austrian commercial register, the Chamber of Commerce company directory and public company websites. As this data is not collected from you directly, the information duty under Art. 14 GDPR applies; the required details — in particular the data source and your right to object — are on a separate page (in German): Woher wir Ihre Kontaktdaten haben.

Holding such data does not mean we will contact you: in Austria, calls and emails for advertising purposes are permitted only with prior consent under § 174 of the Telecommunications Act 2021, also between businesses.

10b. Email information for customers

If you have commissioned a service from us, we use the email address provided in that context to inform you occasionally about our own similar services (§ 174(4) Telecommunications Act 2021; Art. 6(1)(f) GDPR). We point this out on the quote and the invoice. You can decline at any time free of charge — by an informal message to the address above or via the unsubscribe note in every such message (right to object under Art. 21(2) GDPR, no reasons required). We record the objection in a block list so that it takes lasting effect.

11. No automated decision-making

Incoming enquiries are prioritised automatically for internal purposes (lead scoring). This serves internal work organisation only and has no legal effect on you within the meaning of Art. 22 GDPR.

12. Your rights

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). To exercise these rights, please contact office@solarisagents.com. You also have the right to lodge a complaint with the Austrian Data Protection Authority (www.dsb.gv.at).

13. Social media presences

We run pages on LinkedIn (LinkedIn Ireland Unlimited Company) and Instagram (Meta Platforms Ireland Ltd.). When you visit or interact with these pages, the respective provider processes your data under its own terms; for the page statistics (“Insights”) we are joint controllers with the provider (Art. 26 GDPR; CJEU C-210/16). We only receive aggregated statistics without personal reference. Ads we place there lead to our website; no data flows back from our website to these providers (section 2). The easiest way to exercise your rights is directly with the provider; for our part, section 12 applies.

Messages and comments on Instagram. Direct messages to @solarisagent and comments under our posts are first answered by an AI assistant; in direct messages it says so in its first reply, under comments it only uses fixed, pre-approved texts. For this, your username, the text of your message or comment and the previous conversation are retrieved through Meta’s interface and passed to Anthropic (section 5) to generate the reply. The legal basis is Art. 6(1)(b) GDPR where you ask about an offer, otherwise our legitimate interest in replying quickly (point (f)). If you write “human”, Nemanja Stojaković takes over personally. We keep messages and comments on our side for at most 90 days; on Instagram itself they remain under Meta’s rules.

Connected Instagram accounts of other businesses. Businesses can connect their own Instagram professional account to our Instagram assistant through an invitation link; they log in directly with Instagram and we never see the password. While the connection exists, we store the access token in encrypted form as well as the account’s username, name and profile picture (Art. 6(1)(b) GDPR). We process messages and comments sent to that account as described in the previous paragraph, on behalf of the connected business: towards the people who write to it, that business is the controller (Art. 28 GDPR). We never publish anything on a connected account. The connection can be removed at any time on the account page; we then delete the access token, conversations and comments of that account immediately. If you remove our app on Instagram (Settings → Apps and websites) or request the deletion of your data there, Meta notifies us; we then likewise remove the connection and immediately delete the access token, conversations and comments of that account.

Last updated: 22 October 2026. This policy is updated whenever our processing changes.