Privacy

Privacy policy

This privacy policy describes how personal data is processed on the website and in the platform alluvo. This English text is a reading version; the German version is legally binding.

1. Controller

The controller within the meaning of the GDPR is:

Managing director: Pascal Kremp
Email: gdpr@alluvo.ai

A special rule applies to processing in the platform: if a business customer uses alluvo to manage data of its employees and contacts, the customer is the controller and we are its processor. Section 9 describes this allocation of roles in detail.

2. Hosting and technical provision

The website and the platform are hosted at Amazon Web Services. The contracting party is Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg. Servers and storage are in the region eu-central-1, Frankfurt am Main (Germany).

Processing takes place to provide our offering securely and reliably on the basis of Art. 6 (1) (f) GDPR. Where data is processed in the course of contractual use, processing additionally takes place on the basis of Art. 6 (1) (b) GDPR.

Where necessary, we conclude data processing agreements under Art. 28 GDPR with the service providers we use. Who is used in detail is listed in Annex 3 of the terms of use.

3. Access data and server logs

When the website and the platform are accessed, technically required access data is processed. This includes in particular the IP address, date and time of access, requested content, browser type, operating system and referrer information.

This processing serves system security, error analysis and the stable operation of our offering. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in defending against attacks and investigating disruptions. Server logs are deleted after 30 days at the latest, unless a specific security incident makes longer retention necessary for investigation.

4. Technically necessary storage

To provide the platform we use technically necessary storage mechanisms such as cookies, session data or local browser storage, for example for sign-in, security functions, language settings or interface preferences. This processing is required to operate the offering; the legal basis is § 25 (2) no. 2 TDDDG (the German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6 (1) (b) and (f) GDPR.

We do not use advertising or marketing cookies from third parties on the marketing website. We measure how the website is used ourselves, as described in the following section.

Audience measurement on alluvo.ai

To understand which pages are read, where visitors come from and how many register afterwards, we measure use of the website with our own software. For this we load the alluvo tracking code; the same code also loads the chat window and appointment booking (see the sections on those). We process the data on our own servers at AWS in Frankfurt. We do not use Google Analytics or other analytics services, and the data goes neither to analytics providers nor to advertising platforms. What is recorded: the page called up (without URL parameters), the domain of the referring page, campaign parameters (utm_*) and click identifiers from ads (for example gclid, msclkid, fbclid), device type and browser (from the user agent), the active time on the page, scroll depth, page load times (Web Vitals), clicks on buttons and links such as "Register" or "Demo", booked appointments and submitted forms. The contents of forms as well as names or email addresses are not part of the measurement.

With your consent we set first-party cookies that let us recognise a repeat visit and attribute a later registration to its source. Currently these are alluvo_site_vid (random visitor identifier, 30 days) and alluvo_site_sid (session, 30 minutes). After the switch to the alluvo tracking code they will be _alv_v_* (visitor identifier, up to 13 months) and _alv_s_* (session, 30 minutes). We store your decision in the cookie alluvo_site_consent or _alv_c_* (12 months); this cookie is technically necessary, the legal basis is § 25 (2) no. 2 TDDDG. For the measurement itself the legal basis is your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR.

Without consent we store nothing on your device. From IP address and user agent we form an identifier with a key that is generated anew every day and then deleted. This allows a visit to be counted coherently; recognition beyond the day is ruled out. We do not store the IP address itself. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is to improve the website on the basis of anonymous usage figures.

Country of origin: From the IP address we derive only the country, no city or region. This is done with an IP-to-country database hosted locally by us (DB-IP Lite); the IP address is not transmitted to any third party for this and is discarded afterwards.

Linking with registration: If you register at app.alluvo.ai, we also measure on the registration pages (app.alluvo.ai/register and the following steps) and link that measurement to your visit to the website. This tells us which page or campaign led to a registration. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is to measure the effectiveness of our own advertising. With consent the attribution works via the cookie, without consent only on the same day via the daily identifier.

We delete the individual measurement events after 13 months; after that only aggregated statistics remain, without an IP address and without a device identifier, which we keep for longer. You can change your decision at any time via "Cookie settings" at the end of every page; if you withdraw it, we delete the measurement cookies on the next page view.

5. Fonts and external content

The fonts used on the website are delivered from our own servers. There is no connection to Google Fonts or a comparable service, and no additional tracking services are activated when the website loads.

We also provide the same font files at /embed/lexend.css for the booking flow of the platform, so that a window embedded there appears in the same font. When a browser fetches this file, the IP address is transmitted to our own server, as with every retrieval of a file from a server. The processing corresponds to section 3.

6. Contacting us

If you contact us by email, we process your details to handle your request and for possible follow-up communication. The legal basis is Art. 6 (1) (b) GDPR if your request is aimed at a contract or pre-contractual measures, otherwise Art. 6 (1) (f) GDPR.

We keep your request for as long as is necessary for handling it and for possible follow-up questions. Retention periods under commercial and tax law remain unaffected.

Request a comparison

If you request the detailed comparison on one of our switching pages (/migration/…), we process your email address, your name and your telephone number to send you the link and to contact you about your switch. For this we create your details as a contact in our customer management in alluvo. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures at your request).

By submitting, you also agree that we may occasionally send you product updates and promotional emails from alluvo. The legal basis for this is your consent (Art. 6 (1) (a) GDPR, § 7 (2) no. 2 UWG, the German Unfair Competition Act). You can withdraw it at any time with effect for the future, via the unsubscribe link in every email or by message to info@alluvo.ai.

Appointment booking

If you book an appointment through our website, such as a demo, the booking page of our platform alluvo opens (app.alluvo.ai, hosted in Frankfurt am Main, see section 2). We process the details you give there: first and last name, email address, optionally telephone number and your answers to questions about the appointment, to arrange the appointment, send you confirmation and calendar invitation and prepare the conversation.

For this we compare the times offered with the Google calendar of the contact person and enter the appointment there; your email address is added as a participant. We store your details as a contact in our customer management in alluvo, to hold the conversation and any follow-up communication.

The legal basis is Art. 6 (1) (b) GDPR, as the processing serves pre-contractual measures at your request; for follow-up communication Art. 6 (1) (f) GDPR. Reservations that you do not confirm are deleted automatically; otherwise section 14 applies.

Chat on the website

Through the chat window on our pages you can write to us directly. The window is loaded from our platform alluvo (api.alluvo.ai, hosted in Frankfurt am Main, see section 2). When it loads, the address of the page called up and, as with every retrieval, your IP address are transmitted to this server.

When you start a chat, we process your name, the contact details you give voluntarily (such as email address or telephone number), your messages and campaign details from the page address (such as UTM parameters) to answer your request. Replies may be prepared or given by an AI assistant; the services named in section 10 apply for this. The legal basis is Art. 6 (1) (b) GDPR if your request is aimed at a contract or pre-contractual measures, otherwise Art. 6 (1) (f) GDPR.

The chat window sets no cookies on this website. So that a conversation that has begun is retained when you change pages, it stores in the storage area of our platform in your browser whether you have acknowledged the privacy notice and which conversation is open. We keep the conversation content like a request by email.

Free lead list

Through /tools/lead-liste you can request a free list of potential client companies. We process your wish list (industries, region, company size, decision-makers, desired content, scope and speed), your contact details (first and last name, company, position, email address, telephone number, message) and an optional exclusion list. The exclusion list needs no personal data: domains or company names are enough; we use it exclusively to keep these companies out of your list.

We store your request on our server and create your contact details together with the wish list as a contact in the alluvo platform, to research the list, send it to you and clarify follow-up questions. The legal basis is Art. 6 (1) (b) GDPR, as the processing is necessary to carry out your request; where we contact you beyond that about this request, your consent under Art. 6 (1) (a) GDPR, which you can withdraw at any time with effect for the future.

Lead radar

Through /tools/lead-radar you can query for free which employers in a radius are currently looking for staff. Our server transmits your search terms (occupation, place, radius) together with your IP address to our own platform (api.alluvo.ai) to retrieve the answer and to limit requests per visitor. The search is logged there without reference to your person (search term, place, radius, number of hits); your IP address is not stored, and no cookie is set. The legal basis is Art. 6 (1) (f) GDPR (provision of the tool and protection against misuse).

7. Registration and user account

Registration for alluvo takes place at app.alluvo.ai. We process the details required to set up the account and the tenant, in particular name, business email address, company and the security features belonging to sign-in.

The legal basis is Art. 6 (1) (b) GDPR. On registration we also record which version of the terms of use, including the annex on data processing, you accepted at that time; the legal basis for this is Art. 6 (1) (c) GDPR in conjunction with our accountability obligation under Art. 5 (2) GDPR.

8. Disclosure to sales and technology partners

We work with partners who sell alluvo or whose products work together with alluvo. If you have created an account and agreed to be approached by email, we may pass your business contact details to such partners so that they can present their own offering to you. There are two categories:

• Sales partners and resellers who refer, set up or support alluvo;
• Integration and technology partners whose product works together with alluvo.

What is passed on, and what is not. Only business contact details are passed on: name, business email address, telephone number, company and position. We do not pass on content from the platform. Data you keep there about your employees, applicants or clients is excluded from this disclosure; for it we are a processor and would not be allowed to use it for our own purposes anyway (section 9).

Who is affected. The disclosure affects registered users for as long as no paid contract exists, that is, trial and beta access. As soon as a contractual relationship comes about, it ends.

Legal basis. We base the disclosure on our legitimate interest in marketing our offering through partners, Art. 6 (1) (f) GDPR. For the promotional approach itself your consent is additionally required; you give it at registration, where the notice text expressly mentions the approach by our sales and technology partners. Without this consent no disclosure takes place.

What applies afterwards. A partner who receives your contact details is, from that point on, a controller in its own right. It must inform you about the processing under Art. 14 GDPR, and you exercise your rights directly against it. We do not pass your data on for sale and receive no payment for the disclosure itself.

Objection. You can object to the disclosure at any time and without giving reasons; an email to gdpr@alluvo.ai is enough. After that your data is no longer processed for this purpose. This is explained in detail in section 16.

9. Data processing in the platform

In the course of using alluvo, personal data of employees, applicants, contacts, clients, assignment sites and other business contacts may be processed. This concerns in particular data required for collaboration in employee management, assignment planning, communication, documentation and operational control.

Insofar as alluvo is used on behalf of business customers, this processing takes place as processing on behalf under Art. 28 GDPR. The business customer is the controller, we are the processor and process the data exclusively on its instructions. The basis is the data processing agreement in Annex 1 of the terms of use, which comes into being with the use relationship.

If you as a data subject want information about data that a company keeps about you in alluvo, please address your request to that company. We may only release such data on its instruction and support it in doing so; if you contact us directly, we forward your request without undue delay.

Special categories of personal data. alluvo is used to manage absences. Details that are health data within the meaning of Art. 9 (1) GDPR may be processed, such as periods of incapacity for work and certificates of incapacity for work stored as a document. The basis for processing by the responsible business customer is regularly Art. 9 (2) (b) GDPR in conjunction with § 26 (3) BDSG (the German Federal Data Protection Act). The stricter protective measures from Annex 2 of the terms of use apply to this data.

10. Use of AI services

alluvo uses language models to prepare processes: reading documents, drafting texts, answering requests, making suggestions for assignment planning, converting speech to text. For this the content required in each case is transmitted to the following providers and processed there:

• Anthropic PBC, San Francisco, USA: language models of the Claude family for agents, assistance functions and the knowledge base.
• OpenAI: models for transcription, audio processing and vector embeddings for search.

Both providers are processors for us. They process the transmitted content exclusively to provide the respective service and do not use it to train their models. For transfer to the USA see section 12.

The legal basis towards our business customers is Art. 6 (1) (b) GDPR in conjunction with the data processing agreement; towards data subjects the legal basis follows the determination of the respective responsible business customer.

11. Recipients of personal data

Within our company only the persons who need access to perform their tasks receive it. Beyond that we pass data on to the following categories of recipients:

• Processors for hosting, AI processing, voice and message channels. They are named individually in Annex 3 of the terms of use and act exclusively on instructions.
• Payment service providers for processing payments. They process payment data under their own responsibility under the regulatory requirements applicable to them.
• Services you connect yourself. If a business customer links alluvo to a calendar, a mailbox, a messaging service, a customer management system or an accounting system, the data required for the activated function is transmitted to that service. The transmission only takes place if the connection has been established and ends when it is disconnected. The provider of such a service is not a processor of ours: it processes on the instructions of the business customer or under its own responsibility. Which connections exist is decided and seen by the business customer in the platform settings.
• Google (Google Workspace, provider for users in the European Economic Area: Google Cloud EMEA Limited, Dublin, Ireland) as our processor for the calendar. When an appointment is booked, name, email address and appointment data are transferred to the Google calendar of the contact person (section 6).
• Sales and technology partners to whom we pass the business contact details of registered prospects insofar as they have agreed to the approach. From the disclosure on they are controllers in their own right; details in section 8.
• Professionals and authorities, insofar as we are legally obliged to provide information or the assertion of legal claims requires it.

Beyond the disclosure to partners described in section 8, we do not pass personal data to third parties for advertising purposes. We do not sell data.

12. Transfers to third countries

Some of the service providers named in sections 10 and 11 are based in the United States. This means a transfer to a third country takes place for which no unrestricted adequacy decision applies. This also applies to Google: our contracting party is in Ireland, but processing by Google LLC in the USA is not ruled out.

We base these transfers on the instruments of Chapter V GDPR: on the European Commission's adequacy decision on the EU-US Data Privacy Framework insofar as the recipient is certified there, otherwise on the standard contractual clauses under Art. 46 (2) (c) GDPR, supplemented by additional safeguards such as transport and storage encryption.

Which service provider is used for what and where it processes is listed in Annex 3 of the terms of use. Which instrument applies in the individual case, and a copy of the safeguards agreed in each case, we provide on request at gdpr@alluvo.ai.

13. No automated decision-making

Automated individual decision-making including profiling under Art. 22 GDPR does not take place.

For a product that works with agents this is a statement with substance, so in plain words: the agents in alluvo prepare processes and propose results, such as a contract draft, a staffing for a shift, a reply to a message. Whether it becomes a decision is decided by a person. Decisions with legal effect or similarly significant impact, for example on a hire, a warning or a termination, are not made by the platform on its own.

14. Storage period

We store personal data only for as long as is necessary for the respective purpose or statutory retention obligations exist. After that the data is deleted or anonymised in compliance with data protection law.

For data we process on behalf of a business customer, the customer determines the storage period. After the use relationship ends, we delete or hand over this data at its choice; the details are regulated in section 10 of the data processing agreement.

15. Your rights

Subject to the statutory conditions you have in particular the following rights:

• Access to the data processed about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR, see section 16)

If processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of processing carried out until the withdrawal remains unaffected.

To exercise your rights you can contact us at gdpr@alluvo.ai. If your request concerns data that a company keeps about you in alluvo, section 9 applies.

16. Right to object under Art. 21 GDPR

17. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

Competent supervisory authority:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia)
Kavalleriestr. 2–4
40213 Düsseldorf
www.ldi.nrw.de

18. Currency of this policy

This privacy policy is current as of 03.10.2026. We reserve the right to adapt this privacy policy if legal, technical or business conditions change.