Privacy policy

This is a courtesy translation of the German „Datenschutzerklärung“. The legally authoritative version is the German version. References to German and EU statutes (GDPR/DSGVO, TDDDG) are retained.

1. Controller

Daniel Ostner
Hasenheide 8b, 25474 Ellerbek, Germany
E-mail: webmaster@enterprise-ai.biz

(hereinafter “we” / “AI Navigator”)

2. Overview of processing

AI Navigator is a web-based application supporting enterprise AI strategy, governance and prioritization (Assessment, Use-Case Scoring, AI Use-Case Canvas, Governance Check, Compliance Center, Architecture Generator, Roadmap Generator). When you use it, we process the following categories of personal data:

• Registration and account data: e-mail address, password (hashed), profile settings
• Usage data: content you enter in the modules (e.g. assessment answers, canvas content, architecture configurations) — this may contain company-related information that you enter yourself
• Payment data: for paid plans (Pro/Enterprise) via our payment service provider Stripe; we ourselves do not store full payment card data
• Usage statistics: anonymized/pseudonymized product usage via PostHog (configured cookieless)
• Technical data: IP address (temporary, for delivery/security), timestamps, browser type — within the scope of hosting operations

Providing an e-mail address during registration is required to provide the service; without it we cannot set up access. All other entries in the modules are voluntary.

3. Legal bases

4. Processors & recipients

We use carefully selected service providers with whom — where necessary — data processing agreements (Art. 28 GDPR) are in place:

Your data is not transferred to any other third parties unless we are legally obliged to do so. Upon request at webmaster@enterprise-ai.biz, we will provide you with a copy of the respective agreed safeguards for third-country transfers (e.g. EU Standard Contractual Clauses).

5. AI-assisted analyses

Some AI Navigator features use an AI language model to analyse your input — for example the assessment of your target architecture, suggestions for components and responsibilities, or the enrichment of your use-case canvas. These features are labelled as AI-assisted within the application and only run when you explicitly trigger them; there is no automatic analysis in the background.

Data processed: Only the content you entered in the respective module is transmitted (e.g. use-case description, selected components, assessment answers). Contact and payment data are not transmitted.

Recipient and place of processing: The analysis runs via Amazon Bedrock (Amazon Web Services) in the Europe region (Ireland, eu-west-1). No transfer to a third country takes place.

No use for model training: According to Amazon Web Services, inputs to and outputs from Amazon Bedrock are not used to train the underlying models and are not shared with the model providers; processing stays within the selected region.

Legal basis: Performance of the contract, Art. 6(1)(b) GDPR — the analysis is part of the service you requested.

Storage period: Results are stored with your account until you delete them or close your account. To avoid repeating identical requests, the response is additionally cached for 24 hours; this cache contains no link to your person and expires automatically.

Labelling: AI-generated content is labelled as such within the application and in exported reports (Article 50 EU AI Act). Results are suggestions to inform your own decision and do not replace professional or legal advice.

6. Cookies and tracking

For product analytics we use PostHog in a cookieless configuration — no persistent tracking cookies are set. For login status we use technically necessary session cookies from Supabase Auth; these are required to provide the service (Art. 6 (1) (b) GDPR, § 25 (2) no. 2 TDDDG) and do not require separate consent.

7. Storage period and deletion

We store personal data only for as long as necessary for the stated purposes or as required by statutory retention periods (e.g. under commercial/tax law, generally 6–10 years for invoice documents). You can delete your account and all associated data yourself at any time via Settings → Delete account. Alternatively, you can contact us at webmaster@enterprise-ai.biz.

8. Your rights

You have the right to information (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21) to the processing of your personal data, as well as the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — either with the authority at your place of residence, place of work or the place of the alleged infringement. The authority responsible for us is the Independent State Centre for Data Protection Schleswig-Holstein (ULD).

9. No automated decision-making within the meaning of Art. 22 GDPR

Based on your inputs, AI Navigator generates analyses, scores and recommendations on business processes (e.g. governance assessments, architecture proposals). These analyses relate exclusively to organizational/technical matters that you enter yourself — there is no automated decision with legal or similarly significant effect on you as a person within the meaning of Art. 22 GDPR.

10. Changes to this privacy policy

We adapt this privacy policy when the legal situation or our data processing changes. You will always find the current version on this page.

As of: July 2026