Privacy

The controller responsible for processing personal data on this website is:

David Andre UG (haftungsbeschränkt) Schmalwiesenweg 19 61206 Wöllstadt Germany

Managing director: David-Andre Strittmatter Phone: +49 159 05827741 Email: hello@cortaris.ai

We have not appointed a data protection officer because the statutory conditions requiring one are not met. Please direct privacy enquiries to hello@cortaris.ai.

We process personal data only to the extent necessary to operate this website and to handle your enquiries. This website sets no cookies for visitors, uses no tracking pixels and embeds no social media content. Fonts are served from our own server; no connection is made to Google Fonts or other font providers.

Where we use service providers based in the United States, we do so under data processing agreements pursuant to Art. 28 GDPR. Transfers to the United States rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and additionally on the EU standard contractual clauses under Art. 46 (2) (c) GDPR.

This website is hosted by Vercel Inc., Covina, California, USA. The server-side application runs in Vercel's Frankfurt region; static assets are delivered through Vercel's global delivery network.

When you visit the website, Vercel processes technically necessary data on our behalf: IP address, date and time of access, requested URL, referrer URL, browser type and version, operating system and the status code of the request. This data is used to deliver the pages, for security and for error analysis. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the secure and stable operation of the website. Server logs are retained for a limited period only and are not combined with other data.

To measure usage we use Vercel Web Analytics, a service of Vercel Inc. The service works without cookies and without accessing information stored on your device. It records page views, referrer, country, browser, operating system and device type. To distinguish visits, Vercel states that it derives a non-reversible hash from request data that expires after 24 hours; visitors are not recognised across days or websites.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in analysing and improving our offering. Because no information is stored on or read from your device, no consent under section 25 of the German TDDDG is required. Should we introduce analytics tools that require consent in the future, we will ask for your consent first.

Our forms use Cloudflare Turnstile, a service of Cloudflare, Inc., San Francisco, California, USA, to detect automated submissions. Turnstile evaluates technical characteristics of your browser and interaction, including the IP address and browser and device information, and passes only the result of the check to us. Usually no action on your part is required.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in protecting our forms from spam and abuse. Where Turnstile stores technically necessary information in your browser, this is permitted under section 25 (2) no. 2 TDDDG because it is required to provide the service you requested.

In addition, we limit the number of form submissions per IP address. For this purpose the IP address is held in memory for a few minutes only and is not stored permanently.

Through our forms you can get in touch, request a strategy session or a workflow assessment, and request the executive briefing. We process the details you enter: name, work email address, company, role, company size, information about your request and timeline, and your message. We also record the page from which you submitted the form, the referrer URL, campaign parameters (UTM) and the selected language so that we can trace where enquiries come from.

The purposes are answering your enquiry, preparing a conversation or proposal, and sending the briefing you requested. The legal basis is Art. 6 (1) (b) GDPR (steps prior to entering into a contract and answering your enquiry); no separate consent is required for this. We process the source data under Art. 6 (1) (f) GDPR to evaluate our communication channels.

The mandatory fields are required to process your request; without them we cannot respond. After submitting you receive an automatic confirmation of receipt at the email address you provided.

We deliver enquiries through the email service Resend (Resend, Inc., San Francisco, California, USA); processing for us takes place in the provider's EU region in Ireland. We receive the notifications in our business mailbox, which is operated by Google Ireland Limited, Dublin, Ireland.

We keep enquiries for as long as necessary to handle them. If no engagement follows, we delete the data no later than six months after the last contact. If an engagement follows, we keep the correspondence for the duration of the business relationship and delete it once the statutory commercial and tax retention periods of six or ten years have expired.

If you write to us by email, for example to hello@cortaris.ai, we process your details to handle your request. Emails to our domain are forwarded through Cloudflare Email Routing (Cloudflare, Inc.) to our mailbox at Google Ireland Limited. The legal bases and retention periods are the same as for the enquiry forms.

This website sets no cookies for visitors. Only editors signed in to our content management system receive a technically necessary session cookie when they use the preview function. A consent banner is therefore not currently required.

We manage editorial content with Sanity (Sanity AS, Oslo, Norway). Content is retrieved from Sanity server-side; no personal data of visitors is transmitted to Sanity in the process.

You have the following rights towards us:

An email to hello@cortaris.ai is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit Gustav-Stresemann-Ring 1 65189 Wiesbaden datenschutz.hessen.de

We do not make automated individual decisions and do not carry out profiling within the meaning of Art. 22 GDPR.

We update this privacy notice when our processing activities or the legal situation change. The version published on this page applies.

Last updated: 6 September 2026