Privacy Policy
Last updated: August 2026
1. Controller
The controller for data processing on this website is NexAI – Next Generation Artificial Intelligence GbR (hereinafter “NEXAI”), represented by its partners Maximilian Trenk and Jason Brian Merklein, Untere Bergstraße 13, 74586 Frankenhardt-Honhardt, Germany. For privacy questions, reach us at mbt@nex-a-i.com.
2. What data we process
We process personal data only to the extent necessary to provide the website and to handle your enquiries. Depending on how you use the site, this includes in particular: – data from the contact and partner form (name, email, company, website if applicable, message), – your email address if you sign up for the newsletter, – input in the AI chat assistant and any contact details you voluntarily provide, – details for online appointment booking and for the AI phone/voice assistant (name, email, phone number, request, preferred time), – technical access data generated automatically when the website is called up (e.g. IP address, time, content requested). Details of purposes, legal bases, processors used and retention periods can be found in the sections below.
3. Legal bases
Depending on the processing, we rely on different legal bases: – Art. 6(1)(b) GDPR (contract or pre-contractual measures) – e.g. handling your enquiry and arranging appointments, – Art. 6(1)(f) GDPR (legitimate interests) – e.g. secure and efficient provision of the website and communication with prospects, – Art. 6(1)(a) GDPR (consent) – where we expressly ask for your consent (in particular the newsletter). We state the relevant basis for each individual processing activity in the sections below.
4. Retention and erasure
We erase personal data as soon as the purpose of processing no longer applies, at the latest after the following standard periods – unless statutory retention obligations (in particular § 147 of the German Fiscal Code, § 257 of the German Commercial Code) apply, in which case the data is restricted for the duration of the period and then erased: – contact and partner enquiries: until the matter is concluded, then erased, – prospect/lead data: 6 months, – appointment data: 12 months, – chat histories: 6 months, – appointment data from the phone/voice assistant: 6 months, – newsletter: until you withdraw your consent, – technical server/access logs: 30 days. Calls with the voice assistant are not recorded.
5. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw any consent given at any time with effect for the future. An informal message to mbt@nex-a-i.com is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI BW), Heilbronner Straße 35, 70191 Stuttgart, Germany.
6. Hosting and server logs
This website is hosted on a server in Germany by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. On our behalf (Art. 28 GDPR), Hetzner processes the technical access data generated when the website is called up — in particular your IP address, the time of access, the content requested, the referrer and the browser used (server log files) — in order to deliver the site and ensure security. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website). We delete server logs after 30 days. Processing takes place exclusively on servers in Germany; no transfer to a third country occurs. This website does not use any cookies for analytics or marketing purposes, and no tracking or analytics services.
7. Contact and partner form, email
When you contact us via the contact or partner form or by email, we process the data you provide (e.g. name, email address, company, website, message) in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at concluding or initiating a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). To send and deliver the associated emails we use Resend, Inc., San Francisco, California, USA as a processor. This transfers the data you submit to the USA. Resend is certified under the EU-U.S. Data Privacy Framework, so the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR) and, additionally, on the EU Standard Contractual Clauses (Art. 46 GDPR). You can request a copy of the safeguards from us. We also store the request and contact data you submit via the form in our self-operated CRM system (customer management) on a server in Germany (Hetzner Online GmbH, Gunzenhausen), in order to handle your enquiry and manage the ongoing contact; we operate the CRM ourselves and no hand-off to third parties takes place. Providing the data is voluntary; however, without the information required to respond we cannot process your enquiry.
8. Newsletter
If you sign up for our newsletter, we process your email address to send you information about our services. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. We use the double opt-in procedure: after signing up you receive a confirmation email, and we only add you to the distribution list after you confirm. You can withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link in every newsletter email or by messaging mbt@nex-a-i.com. Withdrawal does not affect the lawfulness of processing carried out beforehand. For capturing and sending we use the processor Resend, Inc. (USA); the statements on third-country transfers in section 7 apply accordingly.
9. AI-powered chat assistant
Our website offers an AI-powered chat assistant. You are communicating with an AI system, not with a natural person. Data processed. When you use the chat, we process the messages you enter (chat content) and — where you voluntarily provide them — your contact details (name, email address, phone number) and your request, in order to answer your enquiry and — at your request — to arrange a consultation appointment. So that the conversation is retained during a session, the messages of that session together with a random session identifier are stored in your browser's sessionStorage; this data is deleted when you close the browser tab. The chat does not set cookies. Purposes and legal bases. – Answering contract-related enquiries and arranging a consultation appointment: Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract). – Answering general enquiries without a contractual context and operating the chat assistant efficiently: Art. 6(1)(f) GDPR (legitimate interest in efficient communication with prospects and customers). Service providers used (processors). To provide the chat assistant and manage appointments, we use the following providers, which process personal data on our behalf pursuant to Art. 28 GDPR: – OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland – processing of chat input via an AI language model; processing by the US company (OpenAI, L.L.C.) is possible. – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – appointment management (Google Calendar); processing by the US company (Google LLC) is possible. The technical linking of these services runs on an automation instance we operate ourselves (software: n8n) on a server in Germany, which we run at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. We operate the automation software ourselves; no hand-off to its vendor takes place. We store your request and contact data, along with any prospect/lead record created from it, in our self-operated CRM system on the same server in Germany (Hetzner Online GmbH); no hand-off to third parties takes place. We have concluded data processing agreements pursuant to Art. 28 GDPR with the above providers. No use for training. The data entered via the chat is not used to train our providers' AI models. Transfer to third countries (USA). Using the services above may involve a transfer of personal data to the USA. Where the respective recipient is actively certified under the EU-U.S. Data Privacy Framework, we base the transfer on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise, it takes place on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR). You can request a copy of the safeguards from us. Retention. Where chat histories are technically stored, we keep them for a maximum of six months and then delete them. Contact details provided when arranging an appointment are stored for as long as necessary to handle your request and, beyond that, within the scope of statutory retention obligations. Voluntariness. Providing your data is voluntary. However, without contact details we cannot arrange an appointment with you. Your rights / objection. You have the rights set out in section 5 (Your rights). Where we base processing on Art. 6(1)(f) GDPR, you also have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR).
10. Online appointment booking
You can book a consultation slot yourself on our contact page. Data processed. To show you available times we retrieve only the busy periods from our calendar — no event titles, contents or attendees are transmitted to your browser. When you book, we process your name, your email address, the time slot you selected and, if you choose to provide it, a brief description of your enquiry. Purpose and legal basis. The data is used solely to arrange and hold the appointment you requested. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures taken at your request). Processors. The appointment is created in our calendar at Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Calendar); processing by the US entity (Google LLC) is possible. You are added to the appointment as an attendee and therefore receive a calendar invitation at the email address you provided. The technical connection runs through an automation instance we operate ourselves on a server in Germany (Hetzner Online GmbH). In addition, we store the appointment and the associated contact details in our self-operated CRM system on a server in Germany (Hetzner Online GmbH); no hand-off to third parties takes place. The statements in section 9 on processing agreements and third-country transfers apply accordingly. Storage period. We keep the calendar entry and the contact details it contains for as long as necessary to handle your enquiry, but no longer than 12 months, and beyond that within the scope of statutory retention obligations. Voluntary provision and withdrawal. Providing the data is voluntary; without a name and email address we cannot confirm the appointment. You can cancel at any time via the calendar invitation or by contacting us informally. The rights set out in section 5 apply.
11. AI phone / voice assistant
For appointment requests we offer an AI-powered voice assistant — among other things via our phone number. At the start of the call you are informed that you are speaking with an AI system. Data processed. We process your phone number, the details you provide (name, request, preferred time and — if provided — email address) and technical connection data in order to handle your enquiry and arrange a consultation appointment. The call is not recorded. Purposes and legal bases. Art. 6(1)(b) GDPR (initiation/performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient appointment scheduling and reachability). Service providers used (processors). – Vapi, Inc., San Francisco, California, USA – voice assistant and telephony orchestration; – Deepgram, Inc., San Francisco, California, USA – speech-to-text (speech recognition); – OpenAI Ireland Limited, Dublin, Ireland (possibly OpenAI, L.L.C., USA) – language model and speech synthesis (text-to-speech); – easybell GmbH, Berlin, Germany – telephony connection (SIP); – Google Ireland Limited, Dublin, Ireland (possibly Google LLC, USA) – appointment management (Google Calendar) and sending the appointment confirmation. Automation and the storage of your appointment and call data run on our self-operated n8n instance and our self-operated CRM system on a server in Germany (Hetzner Online GmbH); no hand-off to third parties takes place. Transfer to third countries. With Vapi and Deepgram a transfer to the USA may occur; these providers are not certified under the EU-U.S. Data Privacy Framework, which is why we base the transfer on the EU Standard Contractual Clauses (Art. 46 GDPR) together with additional safeguards. For OpenAI and Google we rely, where the recipient is certified, on the adequacy decision (Art. 45 GDPR) and, additionally, on the Standard Contractual Clauses. You can request a copy of the safeguards from us. Retention. Your appointment data is deleted after six months at the latest, unless statutory retention obligations apply. Voluntariness. Providing the data is voluntary; without contact details and a preferred time we cannot arrange an appointment. The rights set out in section 5 apply.