Privacy Policy
Last updated: September 2026
1. Controller
The controller for data processing on this website is NexAI – Next Generation Artificial Intelligence GbR (hereinafter “NEXAI”), represented by its partners Maximilian Trenk and Jason Brian Merklein, Untere Bergstraße 13, 74586 Frankenhardt-Honhardt, Germany. For privacy questions, reach us at mbt@nex-a-i.com.
2. What data we process
We process personal data only to the extent necessary to provide the website and to handle your enquiries. Depending on how you use the site, this includes in particular: – data from the contact and partner form (name, email, company, website if applicable, message), – data from the sales partner application form (name, email, phone, desired role, sales experience, availability, optional profile link and message, origin of the page visit), – your email address if you sign up for the newsletter, – input in the AI chat assistant and any contact details you voluntarily provide, – details for online appointment booking and for the AI phone/voice assistant (name, email, phone number, request, preferred time), – technical access data generated automatically when the website is called up (e.g. IP address, time, content requested). Details of purposes, legal bases, processors used and retention periods can be found in the sections below.
3. Legal bases
Depending on the processing, we rely on different legal bases: – Art. 6(1)(b) GDPR (contract or pre-contractual measures) – e.g. handling your enquiry and arranging appointments, – Art. 6(1)(f) GDPR (legitimate interests) – e.g. secure and efficient provision of the website and communication with prospects, – Art. 6(1)(a) GDPR (consent) – where we expressly ask for your consent (in particular the newsletter). We state the relevant basis for each individual processing activity in the sections below.
4. Retention and erasure
We erase personal data as soon as the purpose of processing no longer applies, at the latest after the following standard periods – unless statutory retention obligations (in particular § 147 of the German Fiscal Code, § 257 of the German Commercial Code) apply, in which case the data is restricted for the duration of the period and then erased: – contact and partner enquiries: until the matter is concluded, then erased, – sales partner applications: 6 months after the application process has been concluded (section 12), – prospect/lead data: 6 months, – appointment data: 12 months, – chat histories: 6 months, – appointment data from the phone/voice assistant: 6 months, – newsletter: until you withdraw your consent, – technical server/access logs: 30 days. Calls with the voice assistant are not recorded.
5. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw any consent given at any time with effect for the future. An informal message to mbt@nex-a-i.com is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI BW), Heilbronner Straße 35, 70191 Stuttgart, Germany.
6. Hosting and server logs
This website is hosted on a server in Germany by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. On our behalf (Art. 28 GDPR), Hetzner processes the technical access data generated when the website is called up — in particular your IP address, the time of access, the content requested, the referrer and the browser used (server log files) — in order to deliver the site and ensure security. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website). We delete server logs after 30 days. Processing takes place exclusively on servers in Germany; no transfer to a third country occurs. This website does not use any cookies for analytics or marketing purposes, and no tracking or analytics services.
7. Contact and partner form, email
When you contact us via the contact or partner form or by email, we process the data you provide (e.g. name, email address, company, website, message) in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at concluding or initiating a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). To send and deliver the associated emails we use Resend, Inc., San Francisco, California, USA as a processor. This transfers the data you submit to the USA. Resend is certified under the EU-U.S. Data Privacy Framework, so the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR) and, additionally, on the EU Standard Contractual Clauses (Art. 46 GDPR). You can request a copy of the safeguards from us. We also store the request and contact data you submit via the form in our self-operated CRM system (customer management) on a server in Germany (Hetzner Online GmbH, Gunzenhausen), in order to handle your enquiry and manage the ongoing contact; we operate the CRM ourselves and no hand-off to third parties takes place. Providing the data is voluntary; however, without the information required to respond we cannot process your enquiry.
8. Newsletter
If you sign up for our newsletter, we process your email address to send you information about our services. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. We use the double opt-in procedure: after signing up you receive a confirmation email, and we only add you to the distribution list after you confirm. You can withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link in every newsletter email or by messaging mbt@nex-a-i.com. Withdrawal does not affect the lawfulness of processing carried out beforehand. For capturing and sending we use the processor Resend, Inc. (USA); the statements on third-country transfers in section 7 apply accordingly.
9. AI-powered chat assistant
Our website offers an AI-powered chat assistant. You are communicating with an AI system, not with a natural person. Data processed. When you use the chat, we process the messages you enter (chat content) and — where you voluntarily provide them — your contact details (name, email address, phone number) and your request, in order to answer your enquiry and — at your request — to arrange a consultation appointment. So that the conversation is retained during a session, the messages of that session together with a random session identifier are stored in your browser's sessionStorage; this data is deleted when you close the browser tab. The chat does not set cookies. Purposes and legal bases. – Answering contract-related enquiries and arranging a consultation appointment: Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract). – Answering general enquiries without a contractual context and operating the chat assistant efficiently: Art. 6(1)(f) GDPR (legitimate interest in efficient communication with prospects and customers). Service providers used (processors). To provide the chat assistant and manage appointments, we use the following providers, which process personal data on our behalf pursuant to Art. 28 GDPR: – OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland – processing of chat input via an AI language model; processing by the US company (OpenAI, L.L.C.) is possible. – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – appointment management (Google Calendar); processing by the US company (Google LLC) is possible. The technical linking of these services runs on an automation instance we operate ourselves (software: n8n) on a server in Germany, which we run at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. We operate the automation software ourselves; no hand-off to its vendor takes place. We store your request and contact data, along with any prospect/lead record created from it, in our self-operated CRM system on the same server in Germany (Hetzner Online GmbH); no hand-off to third parties takes place. We have concluded data processing agreements pursuant to Art. 28 GDPR with the above providers. No use for training. The data entered via the chat is not used to train our providers' AI models. Transfer to third countries (USA). Using the services above may involve a transfer of personal data to the USA. Where the respective recipient is actively certified under the EU-U.S. Data Privacy Framework, we base the transfer on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise, it takes place on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR). You can request a copy of the safeguards from us. Retention. Where chat histories are technically stored, we keep them for a maximum of six months and then delete them. Contact details provided when arranging an appointment are stored for as long as necessary to handle your request and, beyond that, within the scope of statutory retention obligations. Voluntariness. Providing your data is voluntary. However, without contact details we cannot arrange an appointment with you. Your rights / objection. You have the rights set out in section 5 (Your rights). Where we base processing on Art. 6(1)(f) GDPR, you also have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR).
10. Online appointment booking
You can book a consultation slot yourself on our contact page. Data processed. To show you available times we query our booking calendar only for which slots are free — no event titles, contents or attendees are transmitted to your browser. When you book, we process your name, your email address, the time slot you selected and, if you choose to provide it, a brief description of your enquiry. Purpose and legal basis. The data is used solely to arrange and hold the appointment you requested. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures taken at your request). Booking calendar and recipients. The appointment is created in our self-operated booking calendar on a server in Germany (Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen); no transfer to a third country takes place. The consultation is conducted by a self-employed sales partner working on our behalf, who is given access to the appointment and the details listed above for this purpose. In addition, we store the appointment and the associated contact details in our self-operated CRM system on a server in Germany (Hetzner Online GmbH); no hand-off to third parties takes place. Confirmation and reminder. After booking you receive a confirmation at the email address you provided, with a calendar entry to save and a personal link through which you can reschedule or cancel the appointment. We send you an email reminder 24 hours before the appointment. We use Resend, Inc. to send these emails; section 7 applies accordingly. Storage period. Your contact details in the booking calendar are anonymised 12 months after your last appointment; longer retention only takes place where statutory retention obligations apply. The personal link to reschedule or cancel expires one hour after the appointment. Records of sent emails are deleted after 6 months. Voluntary provision and withdrawal. Providing the data is voluntary; without a name and email address we cannot confirm the appointment. You can reschedule or cancel up to 24 hours in advance through the link in the confirmation, and after that, or at any time, by contacting us informally. The rights set out in section 5 apply.
11. AI phone / voice assistant
For appointment requests we offer an AI-powered voice assistant — among other things via our phone number. At the start of the call you are informed that you are speaking with an AI system. Data processed. We process your phone number, the details you provide (name, request, preferred time and — if provided — email address) and technical connection data in order to handle your enquiry and arrange a consultation appointment. The call is not recorded. Purposes and legal bases. Art. 6(1)(b) GDPR (initiation/performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient appointment scheduling and reachability). Service providers used (processors). – Vapi, Inc., San Francisco, California, USA – voice assistant and telephony orchestration as well as speech synthesis (text-to-speech); – Soniox Inc, Foster City, California, USA – speech-to-text (speech recognition); Soniox acts as a sub-processor engaged by Vapi; – OpenAI Ireland Limited, Dublin, Ireland (possibly OpenAI, L.L.C., USA) – language model (understanding the request and phrasing the reply); – easybell GmbH, Berlin, Germany – telephony connection (SIP); – Google Ireland Limited, Dublin, Ireland (possibly Google LLC, USA) – appointment management (Google Calendar) and sending the appointment confirmation. Automation and the storage of your appointment and call data run on our self-operated n8n instance and our self-operated CRM system on a server in Germany (Hetzner Online GmbH); no hand-off to third parties takes place. Transfer to third countries. With Vapi, Soniox and OpenAI a transfer to the USA may occur; we base this transfer on the EU Standard Contractual Clauses (Art. 46 GDPR) together with additional safeguards. For Google we rely on the adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, additionally, on the Standard Contractual Clauses. You can request a copy of the safeguards from us. Retention. Your appointment data is deleted after six months at the latest, unless statutory retention obligations apply. Voluntariness. Providing the data is voluntary; without contact details and a preferred time we cannot arrange an appointment. The rights set out in section 5 apply.
12. Applications as a sales partner
On our "Sales partners" page you can apply as a self-employed sales partner (setter/closer). This concerns the initiation of a self-employed collaboration, not an employment relationship. Data processed. Name, email address, phone number, desired role, sales experience, availability, optionally a profile link (LinkedIn/Instagram) and a message, the selected language and the time of application. In addition we record the origin of your page visit (identifier of the link used or UTM parameters, landing page, domain of the referring page). This origin data is temporarily stored when the page is opened exclusively in your browser's session storage (sessionStorage), not via a cookie, and is only transmitted to us when you submit the application. Your IP address is processed briefly in memory to limit misuse of the form (rate limiting) and is not stored. Purposes and legal bases. Conducting the application and selection process and initiating a sales partner contract at your request: Art. 6(1)(b) GDPR. Evaluating which channels applications come from and protecting against misuse: Art. 6(1)(f) GDPR (legitimate interest in effective partner acquisition and in the secure operation of the form). Recipients and service providers. For the confirmation of receipt sent to you and the internal notification we use Resend, Inc., San Francisco, California, USA, as a processor; section 7 applies accordingly. We store your application data in our self-hosted CRM system on a server in Germany (Hetzner Online GmbH, Gunzenhausen) to manage the process; no data is passed on to third parties. If you subsequently book an intro call, section 10 (online appointment booking) applies. If a collaboration comes about, you receive access to our partner portal (app.nex-a-i.com) with its own privacy notices. No automated decision-making. Applications are reviewed by people. There is no automated decision-making or assessment by AI systems (Art. 22 GDPR). Retention. We keep your application data until the application process has been concluded and for 6 months thereafter in order to defend or assert claims, in particular under the German General Equal Treatment Act (AGG), which via § 6(3) AGG also covers access to self-employed activity. Longer retention only takes place with your separate consent. If a collaboration comes about, the data is transferred to contract management. Voluntariness. Providing the data is voluntary; without name, email address, phone number and desired role we cannot process your application. The confirmation of receipt is a transactional message, not a newsletter. You have the rights set out in section 5; you may object to processing based on Art. 6(1)(f) GDPR under Art. 21 GDPR.